# Round 16 review — identity/history scope (revision 22)

Scope checked independently: sections 1, 2, 3, 12, plus the provided section 5, 16, and 17 context.

**Disposition accuracy.** Both round-15 corrections are present and correctly bounded in the current text: device-bound, non-exportable custody with the backup-clone/recipient-certification tests applies to authority and recipient-certification keys only, with the transport-only-key fallback explicitly excluded from those roles and a blocker-plus-consultation path if custody and pre-login availability conflict. Journal epochs are bound to trust generation, restoration creates a fresh epoch, old cursors cannot select new-epoch records, and cached old-epoch history is preserved with a labelled discontinuity. The migration ceremony remains an unresolved user-choice gate without adopting extra biometrics or re-pairing — consistent with the disposition's "no clean convergence claimed" stance.

**Checks that found no defect:**

- Biometric contract: allow-once/deny-once/cancel/dismiss require none; every reusable rule (session, timed, Forever) requires biometrics; Forever default preserved; no forced physical presence or re-enrollment in routine flows.
- Gateway counter reconciliation: a higher gateway number alone is insufficient; trust-changing claims require the retained Mac-signed receipt validated against local trust history; verified revocations are applied locally before phone operations; unknown trust changes suspend authority pending administrator recovery. Restored-backup and stale-tombstone paths are each closed (receipt validation; lifecycle-epoch rejection of delayed controls; wake-only exposure on gateway compromise is neutralized by phone-side authority checks).
- Candidate-token flow: root rechecks enrollment before the final revision; candidates are single-use, expirable, and cannot redirect wakes on failure; probes are bounded and are background traffic, not approval prompts.
- Key custody: transport key is separated from approval authority; relay compromise remains delay/drop/metadata only; credential packages are recipient-encrypted; the "administrator-controlled" wording for the transport fallback is governed by the earlier strict definition (no interactive-admin-writable paths).
- Audit: consumption and initial event commit atomically; audit state derives from the single consumption ledger (no second execution authority); closed metadata enums with no bound target values; unknown outcomes never imply success; retention cannot delete active requests or weaken replay protection; revoked phones cannot fetch new history with the offline-cache limitation stated.
- Process boundaries: per-request live code identity plus persisted minimum build/generation; caller UID captured at the service boundary; same-user frontend invocation is not treated as consent.

No correction is proposed, so none can worsen UX. No runtime verification is claimed; platform gates remain planned feasibility work.

NO SUBSTANTIVE FINDINGS