# Round 23 review — sections 1, 2, 8 + cross-section context

## Prior disposition verification (revision 29)

The round-22 K3 fix is present and consistently integrated:

- Section 8 defines one authenticated, submission-bound no-admission result (Mac/account, submission identity+nonce, reason, retry class) for **all** admission rejections, with the four busy reasons tabled and given distinct deadline statuses.
- One caller deadline spans all retries and reason changes; backoff cannot reset it; indefinite drain/outage never produces an indefinite caller wait, and admitted requests' approval lifetime is unaffected.
- Automatic resubmission is authorized only by negotiated retry classes; permanent rejection, unknown codes, lost acks, and ambiguous results never retry. GUI capture reuses the same classification while preserving target age/expiry (§17).
- Sections 12 (storage reserve checked before dispatch), 17 (atomic admission close; Update installing bound to submission identity; restart-matrix recapture only for established-never-consumed UI requests), and 18 (all four reasons for command and UI prompt, deadline exhaustion, reason changes, lost acks) agree with section 8.

## Independent checks performed

- **UX bindings**: biometric table in §1 matches the binding contract (LS allow-once/deny-once/cancel/dismiss without biometrics; every rule-setting decision including timed/session rules with biometrics; Forever default preserved). Update-scheduling phone controls add no extra biometric and no new confirmation dialog, and cannot supply artifacts, alter floors, or authorize target actions — no UX regression.
- **One decision / one action**: busy-state resubmission performs fresh capture and fresh decision; no old approval or execution is retried; unexpected-restart command requests are cancelled without auto-retry (matches the disposition's non-adoption).
- **No-admission proof soundness**: admission closes atomically with request creation and permit dispatch (§17), so "no request created, no action dispatched" is establishable; nonce/submission binding blocks replay of stale rejections; timeout/lost-ack paths reconcile or report uncertainty rather than guess.
- **Execution-boundary semantics**: requester-exit liveness recheck distinguishes before-child-start (consume decision, no-effect outcome) from post-start races; "no effect" claimed only when no child started is provable; per-request continue/terminate option defaults to attached CLI lifetime.
- **Caller/race handling**: identity recheck before execution, hash-check limits disclosed, descriptor-execution spike gated with an explicit semantic contract, no silent relocation, no immutable-transitivity claims.
- **Restart matrix and recapture**: never-consumed establishment against the durable ledger, Unknown retention when unprovable, no recapture of denials/expired/changed dialogs, notification retries bounded without resetting age.
- Cross-references between §8, §12, §17, and §18 resolve without contradiction; the GUI-capture busy-state retry is bounded by dialog presence and target expiry, consistent across all four statements.

No defect correction is needed; nothing that would worsen UX is proposed.

NO SUBSTANTIVE FINDINGS