# Remozio plan review: revision 28 (`reviews/round-22-plan.md`)

## Findings

I found no substantive planning defects in revision 28.

## Disposition of round 21

**Opus F1: live witness-fault ordering.** The fix holds.
- §16, *Feasibility gate: restored trust state*, now separates two kinds of effect:
  - Restrictive effects (revocation, floor enforcement, replay-ID reservation) apply immediately in the live process.
  - Permissive effects and repeatable side effects (enrollment, mapping publication, scheduling) wait for the durable anchor.
- A restrictive-ahead intent rolls forward after restart.
- An ambiguous write reconciles by operation ID, so a retry cannot finalize a different operation or publish twice.
- Unknown or conflicting intents stay genuine recovery failures, which keeps "recoverable" from covering arbitrary mismatches.
- A failed write of the intent itself falls under the §12 storage-failure rule, so admission stays closed. I found no path where a revoked phone regains authority, other than the disclosed limit that a whole-backup restore can undo a never-completed operation.
- Revoking and replacing a phone during a persistent witness fault can leave no active phone. The §5 "no approval surface remains" rule then applies. This is honestly surfaced, not silent.

**Opus F2: starting-state submission behavior.** The fix holds.
- §12, *Atomic journal writes*, and §17, *Automatic activation and optional drain*, now give Mac authority starting the same treatment as Update installing:
  - The response must be authenticated and bound to the submission.
  - Wait, resubmission, and cancellation are bounded.
  - stdin/PTY input is preserved.
  - Resubmission uses a fresh capture and requires a fresh decision.
- A generic health hint, timeout, or lost acknowledgment explicitly cannot trigger replay.
- For UI requests (§17, *State across restarts*), recapture preserves the original age and target deadline and does not revive expired authority.

## What I assessed

- **Scope and key separation**
  - The biometric-free set is limited to cancel, deny-once, and Little Snitch allow-once.
  - Every reusable rule needs biometrics, including Forever and temporary or session rules.
  - The key class comes from retained action semantics, not message claims (§1, §6, §9).
  - Unknown compatibility contracts cannot inherit one-time classification.
  - Command execution and 1Password stay biometric-only.
- **Relay resistance**
  - The relay, transport, gateway, and push token cannot mint decisions, alter mappings, or read payloads.
  - Token possession uses a challenge before mapping activation (§15–§16).
- **Command binding (§8)**
  - Capture comes first, including stdin source and environment.
  - Rendering is unambiguous, execution uses no extra shell, and the no-child-started outcome is distinct.
  - Descriptor execution and sudoers compatibility are properly scheduled feasibility gates with consultation paths.
- **Android (§7)**
  - Consent binds to one immutable selected request, and there is no keyguard surface.
  - Single-biometric credential release is a gate with an explicit fallback to user consultation.
  - Pairing preservation follows the documented recovery path.
- **UI races (§9)**
  - The permit is consumed before any dialog mutation, and a failure after mutation is Unknown.
  - A late adapter cannot act on an invalidated permit.
  - Refresh never replays an approval.
- **Recovery, audit, and updates**
  - An epoch and journal checkpoint sit between the per-action crash protocol and the witness anchor. Recovery from history-only loss versus an authority mismatch is classified.
  - Floors are proposed until activation commits. Anti-rollback does not depend on the candidate binary.
  - Updates are quiescence-gated with no forced kills. Negotiation is authenticated and never re-encodes an existing request into a weaker schema.
- **Remote UX**
  - No new confirmations, biometrics, command restrictions, or shortened windows were introduced.
  - Manual routing controls are persistent and need no extra authentication.

## Non-blocking observations (no action required for convergence)

1. **Gap between old and new authority processes (§17, *Automatic activation and optional drain*).** A command sent just as the old root exits, before the new root answers, falls into "unknown admission": no auto-resubmit, so the user sees an uncertainty report.
   - One option is an authenticated hello before transmitting the submission. A connection failure before that point would then be a locally known no-admission.
   - This would improve UX and worsen nothing. It fits naturally in the service-installation and update-continuity feasibility work.
2. **Command requests after an unexpected root restart (§17, *State across restarts*).** Never-consumed UI requests are recaptured automatically, but never-consumed command requests end with "explain fresh submission".
   - This is a coherent current policy, not a defect.
   - Automatic command resubmission would be a UX improvement to raise with the user, not something to adopt silently.

## Tentative UX items still open (not defects)

- Migration ceremony (§3, *Key custody and pre-login transport*): an explicit user-choice gate.
- Idle-interval default (§14): an explicitly deferred preference.
- Retention duration and budget (§12): an explicitly deferred preference.
- Optional detached command mode (§8): requires a separate user decision.

## Limits of this review

This is a plan-only review; I executed, inspected, and tested nothing. All of the following remain unproven until the scheduled gates and tests run:

- Secure Enclave or other key custody that is available before login.
- Witness mechanism availability and rollback detection.
- Protected placement and anti-rollback enforcement for root code under Sparkle and service management.
- Descriptor-based execution.
- Single-operation BiometricPrompt credential release.
- Little Snitch and 1Password true one-time semantics and AX stability.
- Cloudflare Access noninteractive credentials and permission scoping.
- FCM delivery under Doze.

Convergence from earlier rounds does not carry over; this verdict covers revision 28 only.

**NO SUBSTANTIVE FINDINGS**