A tenant-boundary defect shows Distill in use: locked inputs, inspectable manifests, repeatable builds, and explicit integrity failures.