local authority capacity is not lifetime safety

agent-decided, reversible. A predictable per-date authority-capacity set and the diachronic SafeCert condition are different objects, and the round had been running them together. Respecting a per-date cap at every date gives an account unbounded below whenever the allowances are not summable; conversely SafeCert can hold while the cap is exceeded, because the cap inverts a worst-case charge and the realized world is not the worst one.

The affordability definition therefore carries SafeCert, and capacity sets are how a policy establishes it. Three routes are recorded: a summable exogenous allowance split; spending the realized account slack, which is the same inequality with the slack in place of the allowance and is strictly larger whenever the account has earned; and the existing structural certificates, which establish SafeCert with no allowance sequence at all. Writing a capacity set into the definition would have made affordability depend on which sufficient certificate a scheduler happened to use, and would have excluded the third route entirely.

Rejected alternative: defining affordability by membership in a per-date capacity box, which is neither necessary nor sufficient for the property it was standing in for.