# Round 18 review — revision 24, sections 1, 2, 3, 12 (+ sections 5, 16, 17 context)

## Disposition verification (round 17)

- **K3 1 (writer ownership):** Correctly incorporated. §12 "Atomic journal writes" requires the OS-held exclusive process lock in protected storage for the service lifetime, transactional compare-and-set, stable lock identity validation across installation/restore/replacement, closed admission on ownership failure, no consumption or new epoch after head mismatch until recovery validates ownership and continuity, proof-gated automatic recovery with the existing repair path otherwise, and no kill/retry of dispatched work. All disposition commitments are present verbatim in behavior terms.
- **K3 2 (trust generation in batches):** Correctly incorporated. The batch field is the immutable epoch-creation trust generation from the authenticated epoch header; every batch for the epoch carries the same value with phone-side conflict rejection; normal revocation or floor commits do not rewrite it or reset history; it is explicitly descriptive, with channel and authority identity verified separately; audit metadata cannot enroll, lower a floor, or override trust state. Matches the disposition.
- **Opus non-blocking note:** Retained as caution; text still prohibits claiming continuous history without evidence.

## Independent checks performed

- **UX binding (§1, §2, §5, §16):** Biometric table matches the binding contract exactly — one biometric for command/1Password/credential release; LS cancel/deny-once/allow-once without biometrics; every rule-setting decision (create/change/remove, session/timed/Forever) with biometrics; no silent Once downgrade; no forced physical access or re-pairing anywhere in scope; enrollment and admin recovery remain remotely performable; unreachable gateway never requires admin recovery; the restored-trust gate mandates consultation before any online-check/re-pairing UX change. Token rotation requires no biometric and grants no action authority, consistent with the contract.
- **Gateway control plane (§16):** Provisioning is operator-authorized and bootstrap-only; post-bootstrap mutations require Mac-authority-signed typed objects with owner/Mac/gateway/lifecycle-epoch/revision/operation-ID/expiry binding; idempotent retries; submission credential is wake-only; candidate-token flow prevents token-string redirection, late proofs after revocation, and offline-Mac mapping changes; counter reconciliation requires the Mac-signed receipt, applies only restriction (never enrollment), and suspends on unexplained trust-changing revisions; tombstones and re-enrollment epochs prevent revocation bypass; uninstall/reactivation require a fresh lifecycle epoch.
- **Audit epoch mechanics (§12):** Epoch-per-start with random IDs, no sequence resumption, prior-head linking, read-only reconciliation when a phone cursor exceeds retained history, old-epoch cursor isolation, and rollback labels are internally consistent and independent of the trust witness, as claimed.
- **Restored-trust gate (§16):** Failure/consultation path, atomicity constraint on partial commits, offline operation preservation, and test coverage (pre-revocation restore, floor rollback, stale controls, interrupted witness commits) are specified and consistent with §17 generation checks.

Minor observations (event ordering "by journal epoch" relying on prior-head links rather than the random epoch IDs themselves, and "exports" named once in acceptance cases without a defined export feature) are wording-level ambiguities already resolved by surrounding text; neither produces a concrete failure and neither warrants a requirement change.

## Conclusion

NO SUBSTANTIVE FINDINGS