# Round 17 review — identity & history scope (revision 23)

Scope checked independently against the current text: sections 1, 2, 3, 12, plus the labelled cross-section context from 5, 16, and 17. The round-16 disposition was read first; nothing in it was assumed true without re-checking the text.

## Verification of the round-16 correction

The audit-epoch mechanism is present and coherent in section 12:

- A fresh cryptographically random epoch is generated before the first journal write on every root-service start and after journal replacement or recovery; sequence allocation never resumes in a persisted older epoch. This closes the sequence-reuse path independently of trust changes.
- The live writer verifies its expected head before each append; mismatch closes the epoch with a discontinuity marker.
- Authenticated phone cursors or batch receipts that exceed or conflict with retained history produce a read-only reconciliation: the phone's cached evidence is preserved, the gap is labelled possible rollback or loss, and no trust or history rewrite occurs.
- Restart versus restore is labelled accurately; the gateway is never an enrollment authority; a phone report cannot rewrite Mac history or authorize actions.

Adversarial scenarios traced against this text (restore mid-epoch, restore after a restart, stale cursor on an absent epoch, replayed old signed batches, relay delay/drop, revoked-phone fetch) all terminate in explicitly specified behavior with no authority impact.

## Identity-boundary checks (section 16 context)

- Token binding: candidate-token control is root-signed and enrollment-checked; the challenge goes only to the candidate token; the proof returns only via the phone's authenticated Mac channel; candidates are single-use, expiring, and invalidated by revocation; a token string alone cannot redirect wakes; no general send-to-token endpoint exists.
- Counter drift repairs only with retained Mac-signed receipts validated against local trust history; a higher number alone adopts nothing; revocation tombstones survive mapping updates; restored backups cannot revive revoked authority locally or remotely; stale queued pushes grant nothing because the phone checks current Mac authority.
- Offline-Mac and unreachable-gateway cases are handled without manual operator work or forced recovery; recovery remains remotely available.

## UX-contract consistency

No reviewed correction adds confirmations, biometrics, physical access, re-enrollment, or manual steps. Little Snitch once/cancel and rule-setting biometric classes, command/1Password biometrics, and the no-biometric token-rotation flow all match the binding UX. The migration interaction remains the only acknowledged pending decision and is correctly gated rather than resolved by inference.

No substantive actionable defect found in the reviewed scope.

NO SUBSTANTIVE FINDINGS