# Round 15 review — revision 21, sections 1–2 plus the changed management boundary

## Prior disposition verification

Round 14 Opus 1 accepted: revision 21 extends restore protection to security floors and policy via one combined trust generation. Verified in the current text: the gate commits to enrollment keys/tombstones, committed floors, authenticated policy revisions, installed-generation records, lifecycle epochs, and replay state (gateway, routing, scheduling, enrollment, authorization). Continuity is checked at the installation boundary before loading affected code and at the root before accepting phone operations. Atomic witness commit, interrupted-write recovery, and the no-blessing rule for administrator recovery are present, as are the pre-floor-restore acceptance cases. The disposition's claims match the text.

## Independent checks of the changed boundary

- **Gateway authority posture:** the gateway is never an enrollment authority; its evidence is restrict-only (verified revocations apply locally, unknown trust changes suspend to administrator recovery, higher counters alone prove nothing, Mac-signed receipts with exact trust changes required). Consistent internally and with section 2's "network messages alone cannot" rule, since adopted revocations originate from the Mac root's own signature retained as receipts.
- **Token-possession flow:** candidate creation cannot change the active mapping; the proof is bound to a root-signed fresh nonce, phone identity, enrollment epoch, and token digest; activation consumes the unexpired candidate once; revocation invalidates pending candidates and blocks late proofs. No biometric or notification is added; failures preserve the prior mapping and surface as registration health. Consistent with binding UX.
- **Counter reconciliation:** fresh-envelope retry, max(local, acknowledged)+1 advance, no replay of obsolete mappings with new counters, receipt validation against local trust history before reconciliation. Sound against both drift and rollback.
- **Credential table vs. narrative:** all seven holders/roles match the surrounding constraints; management and provisioning credentials are root-only controller-scoped; transport and phone credentials carry no mutation authority; provider secret never leaves the gateway.
- **Uninstall/reactivation:** control-path removal, tombstone, new lifecycle epoch for reactivation, and fail-closed handling of surviving queued pushes (phone checks current Mac authority) are coherent.
- **Cross-checks against frozen text:** sections 1–2, the section 5 enrollment excerpt, and the section 17 generation checks are consistent with the new boundary; no new confirmation, biometric, manual step, physical-access, or re-pairing requirement was introduced anywhere in the changed text.

One residual observation, considered and not flagged as substantive: gateway-side backup restoration could in principle defeat a tombstone together with revision monotonicity. The plan's architecture already contains the consequence — pushes are opaque untrusted wakes, actionable content requires the authenticated channel, and revoked/unverifiable requests grant nothing — so the impact is bounded to delivery anomaly under operator action on user-operated infrastructure, not an authority defect requiring text changes in this scope.

NO SUBSTANTIVE FINDINGS