# Round 22 review — recovery scope (revision 28)

Scope checked: §1 (approval flow, biometric table, UX constraints), §2 (threat boundary, signature semantics), §12 (audit journal, atomic writes, recovery classification, sync, retention), with the cross-referenced §16 witness gate and §17 failure/recovery excerpts.

**Dispositions verified against current text**

- Round 21 / Opus F1 (witness-fault ordering): present and coherent. Prepared/anchored/finalized intent phases; restrictive effects immediate in the live process with durable intent; permissive effects and repeatable control-plane side effects held for durable anchoring; restrictive-ahead intents roll forward after restart; ambiguous writes reconciled by operation ID; local enforcement and durable completion reported separately; no claim that a never-anchored operation survives whole-backup restore. No conflict with §12's per-action crash protocol ("Per-request action consumption retains section 12's separate crash protocol").
- Round 21 / Opus F2 (starting-state submission): present and coherent. Submission-bound authenticated no-admission result, bounded wait, resubmission and GUI recapture per §17; generic health indications and lost responses cannot trigger replay; input preserved unconsumed and cancellation preserved while admission is closed; the status grants no action authority.

**Independent checks performed**

- Recovery classification is exhaustive and mutually consistent across §12/§16/§17: protocol-resolvable interruption (auto rollback/roll-forward, no dispatch) vs. history-only loss (fresh epoch, labelled discontinuity, no admin repair) vs. genuine continuity mismatch (recovery-required marker, repair path) vs. transient witness/storage failure (retryable starting state, bounded backoff). Marker-write failure, restart-skips-checks, and timeout-is-not-rollback hazards are all explicitly closed.
- Replay/rollback safety: random per-start epochs plus per-epoch cursors prevent sequence reuse after backup restore without relying on the witness for audit-only truncation; phone receipts and cached old-epoch records are preserved read-only; consumption ledger and audit event commit in one pre-dispatch transaction; post-dispatch interruption records Unknown and never retries.
- Flood resistance: no durable per-packet events for unauthenticated traffic; authenticated rejection telemetry (including revoked-key replays) rate-limited with bounded counters; reserved lifecycle budget for admitted requests.
- Binding UX intact: biometric table matches the frozen contract (command/1PW/credential and all rule-setting including Forever, session, and timed rules require one biometric; LS allow-once/deny-once/cancel and dismiss/decline require none); no forced warning modals or truncation; witness gate fails explicitly and consults the user rather than silently requiring GUI login, online checks, physical access, or re-pairing; manual Mac approval remains available on every repair path; history reading needs no extra biometric and cannot approve or replay.
- Prior-round acceptance cases (power loss at each commit phase, duplicate service starts, lock replacement, live journal replacement, head mismatch plus crash/restart/reboot/restore, cursor-ahead-of-journal, sustained forged traffic) are all carried in the text.

No internal contradictions, authority-bypass paths, replay/rollback gaps, UX regressions, or mis-scoped claims found in the reviewed sections.

NO SUBSTANTIVE FINDINGS