The Constitution

Things Drop Zone cannot do — structurally, in code, not by promise. Every article names the mechanism that enforces it. These limits exist because our founder runs his own store on this exact software and learned each one the hard way.
1. It cannot price below your floor.
Every price the engine computes is clamped to your margin floor ($1.99 on buyer-paid-shipping listings, $4.99 on free-shipping) before any call to eBay is made. This is a clamp in the pricing path, not a preference — there is no code path that lists, reprices, or marks down under the floor.
⚙ Enforced by: Floor clamp in the pricing/repricing path (resolve-time, per listing).
2. It cannot negotiate below your floor.
Best-Offer auto-accept AND auto-decline thresholds are both clamped to your floor, and always ordered decline < accept < asking price. Zero negotiation under floor — an offer below it is auto-declined by eBay itself before we ever see it.
⚙ Enforced by: BO threshold clamp; eBay-side auto-decline enforces it even if Drop Zone is offline.
3. It cannot mass-churn your listings.
End/Relist writes are hard-capped at 20 per day, enforced at the lowest API layer so no script, feature, or future bug can route around it. The cap fails CLOSED. This guardrail exists because mass relisting once cost the founder's own store 38% of its search views in days — the cap makes that class of damage impossible.
⚙ Enforced by: Churn governor at the eBay-API layer; fail-closed; explicit same-day override required for deliberate waves.
4. It cannot touch your Vault.
Cards you place in the PIN-protected Vault are excluded from ALL automation — no repricing, no offers, no refresh, no bundling, nothing. Removing a card from the Vault requires your PIN.
⚙ Enforced by: Vault guard checked before every write; PIN-gated membership.
5. It cannot overrule your approvals.
Once you approve a card or an action, that approval is authoritative. Downstream checks may HOLD an item and tell you why — they may never silently demote or reverse a decision you made.
⚙ Enforced by: Status gates are hold-and-log only; approval states are never rewritten by automation.
6. It cannot act in bursts that endanger your search ranking.
All writes flow through a pacing scheduler with per-action daily ceilings, human-like spacing, and quiet hours. Change arrives at seller speed, because burst activity is what search algorithms punish.
⚙ Enforced by: Single write chokepoint (pacing scheduler) with per-family ceilings and jitter.
7. It cannot guess when it isn't sure.
If identification confidence falls short of the bar, the card is held for your review with the specific uncertainty named. A blank field beats a wrong one; an honest flag beats a confident mistake.
⚙ Enforced by: Confidence gate at intake; MANUAL_REVIEW hold state; refusals surfaced on your dashboard.
8. It cannot hide what it did.
Every action is journaled — what, when, why, the before-state, and the rollback payload. Price changes are undoable. Your dashboard shows the actions taken AND the actions refused.
⚙ Enforced by: Append-only automation journal with before/after state and rollback payloads.
9. It cannot keep running against your will.
One switch pauses ALL automation on your store, checked before every cycle. Your listings stay exactly as they are until you resume. Your data can be exported or erased on request.
⚙ Enforced by: Automation-pause gate re-checked every cycle; export/erasure tooling built in.
10. The AI assistant cannot execute anything.
The in-app assistant is text-only on every tier. It can explain, recommend, and answer — it has no ability to list, price, end, or modify anything on your store.
⚙ Enforced by: Assistant surface has no write tools; execution paths require your session's explicit actions.
Why publish this?
Because "trust us" isn't an argument. Software that acts on your store should be able to show you the cage it operates inside — and refuse to act when a rule would be broken. Your dashboard shows every refusal alongside every action, so you can audit both. If you ever find this software doing something this page says it cannot do, tell us — that's a bug of the most serious class we track.