# Round 13 review — GLM transport/management follow-up

Scope: sections 1, 2, 3, 15 of revision 19, plus the labelled cross-section context (section 16 management, section 16 LAN/relay, section 5 enrollment, section 17 generation checks and release manifest).

**Prior disposition check (verified in current text):**
- Opus 1 (counter recovery): section 16 now reconciles an authenticated gateway head (owner/Mac/gateway-bound, with retained Mac-signed control receipt), advances to max(local, acknowledged)+1, and signs current trusted desired state. Epoch, tombstone, and revoked-registration guards block repair-by-renumbering. The backup-restore and failed-migration acceptance cases cover the dangerous variants. Correction present and sound.
- Opus 2 (token challenge sequencing): the four-step candidate flow root-signs candidate creation, gateway-delivered possession challenge, enrolled-installation response over the authenticated Mac channel, and root-signed final activation. Expiry, single consumption, revocation invalidation, race handling, and the no-biometric/no-prompt UX are all specified. Correction present and sound; no new gap introduced (a token string alone still cannot redirect wakes, and candidate creation cannot mutate the active mapping).

**Independent check of the changed management boundary:** gateway bootstrap ownership, provisioning-credential scope, typed control objects with epoch/revision/operation-ID binding, idempotent retries, outbox refresh after expiry, tombstone survival, offline revocation semantics, uninstall/reactivation epochs, and the credential table are mutually consistent with sections 3 and 15 (transport submission credential is wake-only; gateway never an enrollment authority; local revocation immediate; pending-remote-cleanup surfaced honestly). Gateway state loss resolves through lifecycle-epoch rejection and authorized repair rather than silent re-acceptance.

**Sections 1, 2, 3, 15:** the biometric table matches the binding UX exactly (allow-once/deny-once/cancel without biometrics; every reusable rule, Forever default, command/1Password/credential release with biometrics); consumption, dispatch-permit, crash-unknown-result, session availability, push privacy, wake/fetch, first-valid-decision, and delivery-health requirements are internally consistent; LAN/relay path rules preserve request identity, expiry, and single consumption. No contradiction, missing error path, or authority-escalation route found in the reviewed text.

No UX regression is proposed; no correction is needed.

NO SUBSTANTIVE FINDINGS