# Round 13 review — GLM, management scope

Scope: sections 1–2 plus the supplied section 16 cross-context (and section 5/17 excerpts), frozen revision 19. Prior disposition read; current text checked independently. No runtime verification claimed.

## Round-12 corrections verified

**Opus 1 (counter recovery).** The head is gateway-authenticated, bound to owner/Mac/gateway/fresh query, and carries the retained Mac-signed control receipt, so the root cannot be fed an fabricated applied revision. Advancing to max(local, acknowledged)+1 and re-signing current trusted desired state (never renumbering an old outbox mapping) correctly clears drift. Lifecycle-epoch changes, revoked registrations, and unverified trust are explicitly excluded from numeric repair, with administrator recovery as fallback and pre-commit rollback preserving trust state. Sound.

**Opus 2 (token challenge sequencing).** Candidate creation is root-signed and non-mutating; only the gateway sends the opaque challenge; the phone responds over its authenticated channel binding candidate/nonce/digest/epoch with no action authority; final activation is root-signed after an enrollment recheck; candidates are single-use and expiring; revocation invalidates pending candidates and late proofs cannot supersede a newer mapping. No biometric, approval notification, admin prompt, or re-pairing is added; an offline Mac defers rather than authorizes. Sound and UX-consistent.

## Independent boundary checks

- Unprivileged transport relaying the control outbox cannot forge controls (root-signed, pinned key) or help by withholding/replaying: monotonic revisions, operation-ID idempotency, envelope expiry, and fresh-envelope regeneration cover it; delayed remote cleanup after local revocation is explicitly not promised and is backstopped by phone-side Mac-authority checks.
- A dishonest gateway can at most suppress or misdeliver: wakes are opaque and phones check current Mac authority before showing actions, so no authority is mintable; stale-revision lying requires a receipt it actually holds.
- Tombstones survive mapping updates; re-add requires a new phone epoch; lifecycle-epoch binding on control objects blocks cross-epoch replay after gateway state loss, where repair is the authorized new-epoch registration.
- Credential table matches the prose: submission credential is wake-only, provisioning credential is owner-scoped and grants no provider/Cloudflare rights, provider secret never reaches Mac or phone; audit records exclude tokens and management secrets.
- Section 1/2 remain internally consistent with the new boundary; no consultation-triggering UX change is smuggled in.

Feasibility items (Cloudflare permission scoping, provider granularity) are properly gated planned work, not defects.

NO SUBSTANTIVE FINDINGS