# Round 16 disposition

Input: revision 22, SHA-256 `392c9cd7f171f2024ea08f35688693aa9c389737788852e2298b593b6c7dc88b`.

K3 completed its full-plan review with no substantive findings. Both GLM scopes completed with no substantive findings and normal stops. Opus found one medium audit-continuity defect. All processes exited zero with nonempty reports. The previous pending K3 report also completed cleanly and is reconciled in round-15-disposition.md.

## Opus 1: audit-only rollback can bypass trust recovery

Accepted. Revision 23 creates a fresh random journal epoch before the first write on every root-service start and after journal replacement or recovery. It never resumes sequence allocation in a persisted older epoch. A running writer also verifies its expected head before appending.

This works independently of enrollment/floor changes, so an audit-only restore cannot reuse sequence numbers within an epoch. Authenticated cursors or receipts that exceed or conflict with retained history produce a visible gap; they cannot modify trust or rewrite history. Old cached records remain available, and the phone syncs the current epoch without waiting for obsolete sequence numbers.

Normal restarts are labelled accurately and do not imply rollback. Missing evidence is reported as possible loss, not invented continuity. No user step, biometric, or network prerequisite is added.

## Pending UX decision

The Mac migration interaction remains unresolved and explicitly gated for user choice before implementation. This does not affect ordinary updates or the normal approval flow. No user answer or approval is inferred.