# Round 10 review — sections 1, 2, 3, 15, 16 (revision 16)

**Prior disposition check:** The round-9 Opus 1 correction is present in §16 (Cloudflare Tunnel endpoint): cloudflared runs under the dedicated transport account; §3 transport-key custody is applied to both the tunnel credential and the push-gateway submission credential, including protected provisioning paths, no argument/log exposure, independent rotation/revocation, and honest offline-uninstall cleanup. The Opus 2 and 3 corrections concern update/frontend sections outside this pass's scope. The disposition's claim of no UX cost is confirmed in-scope: no added biometrics, forced pairing, response-window reduction, or command restriction appears in the reviewed text.

**Independent check:**
- §1 biometric table matches the binding UX exactly: one biometric for command/1Password/credential actions; LS cancel, deny-once, and allow-once without; every rule create/change/remove (including the default Forever decision) with; "do not silently select Once" and "preserve the Forever default" are mutually consistent.
- §3 pre-login fallback ("administrator-controlled" directories and registrations) uses the stricter definition established earlier in §3 (root-owned, non-user-writable, anti-rollback); the fallback is correctly excluded from credential-receiving and authority keys, and the blocker/consult path is retained.
- §15/§16 boundaries are consistent: gateway separate from the live proxy; opaque push with verified fetch before actionable UI; Mac authoritative for validity and consumption; single request ID/expiry across path changes with atomic first-valid-decision consumption; revoked phones rejected Mac-side even before Access revocation completes; relay limited to delay/drop/metadata.
- No double-execution, expiry-extension, replay, or notification-as-consent path found in the reviewed sections; feasibility gates (service installation, background Access auth, macOS 14+ floor) are properly framed as planned work.

NO SUBSTANTIVE FINDINGS