# Round 18 disposition

Input: revision 24, SHA-256 `875893ce0879fbee5e00ec2f4ea373863231b75dbc4b3a57ff9e72671288ba51`.

GLM completed the changed scope with no substantive findings. Opus completed with two findings. K3 is still running when the next snapshot is frozen; its result will be reconciled separately. No pending process is counted as clean.

## Opus 1: recovery-required state across restart

Accepted. Revision 25 requires a protected continuity checkpoint and recovery marker outside the replaceable journal, covered by the combined restoration gate. Startup checks both before admission and epoch creation. The journal/checkpoint commit protocol must be crash-consistent before dispatch. Partial commit or inability to persist recovery state cannot be cleared by restart. Unknown outcomes or non-enumerable history-loss intervals remain visible.

Ordering, reconciliation and power-loss tests are explicit feasibility deliverables. No platform primitive is assumed to exist. This preserves the existing repair and consultation paths.

## Opus 2: rejection flood exhausts journal capacity

Accepted. Unauthenticated rejects use bounded aggregate counters, not one event per packet. Individual records require verified current or retained prior enrollment identity, and repeated authenticated rejects are bounded too. Capacity is reserved for real request lifecycles and outcomes. Forged and revoked-key floods cannot spend the reserve or force early pruning. Essential-storage failure rejects new admission before dispatch.

No added biometric or normal-use confirmation. Migration UX remains pending user choice.

## Pending process resolved

K3 completed with exit 0 and a nonempty full-plan report. It reported no substantive findings; no additional correction was needed.