BoundaryTransitionRecord and AuditService use ambient wall-clock

[flyingrobots]

Migrated from Method backlog

GitHub Issues are now the live work tracker. Repository docs remain Method evidence.

Field	Value
Source backlog	docs/method/backlog/bad-code/HEX_btr-audit-ambient-timestamps.md
Archived source	docs/archive/backlog/github-issue-migration-2026-06-01/docs/method/backlog/bad-code/HEX_btr-audit-ambient-timestamps.md
Original lane	bad-code
Original id	HEX_btr-audit-ambient-timestamps
Original legend	HEX
Original feature	observer-admission-runtime
Original release home	v19.0.0

Original backlog card

BoundaryTransitionRecord and AuditService use ambient wall-clock

Effort: S

Three domain files default to wall-clock timestamps when the caller
doesn't provide one:

• BoundaryTransitionRecord.js:232 — timestamp = new Date().toISOString()
• AuditReceiptService.js:371 — timestamp = Date.now()
• AuditVerifierService.js:329 — verifiedAt: new Date().toISOString()

These are observational wall time — metadata about when the outside
world observed an event. They belong at the adapter boundary, not
as defaults in domain services.

Violates no-ambient-time invariant.

Suggested fix

Make timestamp a required parameter in each case. The CLI, HTTP
handler, or adapter provides the wall-clock timestamp at the
boundary. The domain service receives it as data, never generates it.