"raio-core stays IO-free." That's the one rule.

If a change would make core depend on a network, a filesystem, a clock, or a runtime, it belongs in a different crate. The trait seams exist so you can add real capabilities — durable storage, transport, settlement, scheme-specific QR profiles — without ever touching the root of trust. core has no network, no filesystem, and no clock, so it stays deterministic, runtime-agnostic, and trivially fuzzable.