# Round 21 review — GLM scoped recovery pass

**Scope:** §1, §2, §12, plus the labelled §16 gate and §17 recovery excerpts, revision 27.

## Prior disposition verification

The round-20 Opus F1 correction is verifiably present in the current text:

- §16 requires the witness to be readable/writable in the root/daemon context before GUI login, while locked, without an Aqua session; a login-keychain-only mechanism is explicitly insufficient, and gate failure routes to user consultation.
- §12 places transient witness/storage faults (including the epoch-creation write) in a retryable, admission-closed starting state with bounded backoff, an honest "Mac authority starting / storage unavailable" status, preserved cancellation, unconsumed input, and an explicit rule that timeouts alone cannot trigger administrator recovery.
- The required tests (login-window SSH approval, transient first-start witness fault) appear in §16.

No regression of that fix was found, and no UX-protected behavior was weakened: the biometric table still matches the binding contract (one biometric for command/1Password/credential and all rule-setting decisions; none for LS once/cancel/dismiss), and §16 still forbids approving online checks, recurring authorization, physical access, or forced re-pairing without consultation.

## Independent checks performed

- **Journal atomicity and recovery classification:** the four states (protocol-resolvable interruption, history-only loss, genuine continuity mismatch/unresolvable, transient unavailability) are disjoint and each has a defined admission, persistence, and UX outcome; partial commit never permits dispatch; neither recovery path retries actions; recovery-required marker failure degrades to closed admission with independent startup revalidation. Internally consistent with §16's continuity gate and §17's no-rollback-below-floor rule.
- **Epoch and sequence integrity:** fresh random epoch per service start, no resumption in persisted epochs, head verification before append, head-mismatch handling, prior-head linking, phone-side cursor/receipt conflict handling, and retention-boundary signing are mutually consistent; sequence reuse after backup restore is prevented without claiming the witness detects audit-only truncation.
- **Flood resistance:** unauthenticated traffic gets bounded aggregate counters only; authenticated rejection telemetry (including revoked-key replays) is rate-limited with dropped-event counts; lifecycle budget reservation plus reject-admission-before-dispatch prevents rejection floods from forcing early pruning or spending the consumption/outcome reserve.
- **Metadata hygiene:** closed action/scope classes with no bound target values, unknown-value mapping, no biometric samples, and no person-identity claims; consistent with the memory-only pending payload rule and the detail-view disclosure.
- **Cross-section coherence:** §1's dismissal/cancellation distinctions, one-decision-one-action binding, and current-display-only signing align with §12's event distinctions and no-replay rules; §2's threat boundary, adapter-asserted UI details, and honest signature-semantics claims match the audit schema's authentication classes.

## Conclusion

NO SUBSTANTIVE FINDINGS