# Round 16 review — gateway/management boundary (revision 22)

**Scope reviewed:** §1 (Product contract), §2 (Scope and threat model), plus the labelled cross-section context: §16 (gateway ownership and recipient authority, token binding, lifecycle sync/cleanup, cloud management authority, restored-trust-state feasibility gate, transport acceptance cases), §5 (enrollment excerpt), §17 (generation/release excerpts). Text-only review; no runtime verification claimed. Checked independently against the round-15 disposition.

**Checks performed on the highest-risk logic:**

- **Biometric table vs binding UX:** allow-once/deny-once/cancel without biometrics; every rule-setting decision (Forever default, create/change/remove) with biometrics; single biometric for command/1Password/credential release. Consistent; no correction needed, so none can worsen UX.
- **Stale-revision reconciliation:** requires the retained Mac-signed receipt, validates it against local trust history, applies verified revocations before any phone operation, and auto-reconciles only delivery-only drift. Found no path where a higher gateway number alone, a replayed mutation, a reused revision after counter rollback, or a restored backup resurrects revoked authority or lowers floors/policy; unknown trust changes suspend to the existing admin recovery.
- **Token binding:** root-signed candidate control → gateway-only challenge to the candidate token → phone proof over its authenticated Mac channel → root recheck before final mapping. Candidates cannot displace the active mapping, revocation kills candidates per epoch, no general send-to-token endpoint. Internally sound, including the revocation-between-candidate-and-activation race listed for test.
- **Credential separation:** the seven-credential table keeps provisioning, control signing, tunnel run, push submission, phone Access, and provider secrets in distinct scoped roles; transport/phone credentials cannot mutate mappings or invoke management; the controller pins resources and rejects caller-supplied ingress targets. No overlap found.
- **Restored-trust-state gate:** explicitly fails rather than overclaims (no assumed Secure Enclave monotonic counter; device-bound key alone insufficient); preserves offline/LAN operation without a gateway startup check; consultation required before any online check, recurring authorization, physical access, or forced re-pairing — no UX regression introduced by the gate as written.
- **Uninstall/rollback:** tombstones reject delayed pre-uninstall controls; reactivation requires a new lifecycle epoch; queued provider pushes grant nothing when current Mac authority cannot be confirmed.

The migration-recovery interaction question from round 15 remains recorded in the disposition as an unresolved user-choice gate with its failure/consultation path present in the text; that is a pending decision properly tracked, not a defect in this scope.

NO SUBSTANTIVE FINDINGS