# Round 8 GLM scoped review — history/expiry/routing

**Scope:** Sections 1, 2, 12, 13, 14 of revision 14, as excerpted. Text-only review; no runtime claims.

**Checks performed:**

- **Biometric contract (§1) vs binding UX:** matrix matches exactly — one strong biometric for command/1Password/credential actions; LS allow-once/deny-once/cancel exempt; every reusable rule (session, timed, Forever default) requires biometrics; Forever default preserved without silently downgrading to Once. No double-biometric, forced re-pairing, or physical-access requirement appears in §13/§14 (biometric-in-progress is not invalidated by presence changes; revalidation before dispatch checks dialog/deadline, not a second biometric).
- **§12 internal consistency:** consumption + audit commit is one transaction with a no-dispatch failure path; audit state derived from the consumption ledger (no second execution authority); unknown outcomes never rendered as success. Sensitive-data exclusions do not conflict with §1's full-detail display requirement — pending payloads are memory-only, and the detail view discloses non-retention. Revoked-phone sync cutoff and offline-cache limits are stated honestly. Retention is decoupled from the ledger and trust records.
- **§13 internal consistency:** age anchored to adapter first observation; estimate, observed timeout, and disappearance kept distinct; authority stays with the Mac's monotonic deadline; terminal requests lose approval controls; refresh only recreates a challenge when the dialog survives; late biometric results cannot revive authority. Consistent with §12 unknown-outcome rules.
- **§14 internal consistency:** routing is delivery-only and never grants authorization; locked/dark overrides activity; unknown brightness is not treated as dark; degraded-detector fallback routes to phone with a label (delivery-only, biometrics still gate action); handoff preserves identity, age, deadline, and single consumption; coarse audit reasons respect §12 exclusions. The local-command feasibility gate is properly framed as planned work with an interim caller obligation, not missing planning.

**Findings:** none. No contradiction, authorization gap, or UX regression found within the reviewed sections.

NO SUBSTANTIVE FINDINGS