# Scoped review: sections 1, 2, 3, 17 (revision 14)

## Round-7 corrections verified present

- **Opus 1 (drain freeze):** Automatic activation begins only when already quiescent; otherwise "Update ready" with continued admission. Drain is optional, explicit, and cancelable/deferrable from both Mac and phone; long-lived commands defer activation indefinitely; no forced deadline or new response limit. Consistent throughout.
- **Opus 2 (old signed peers):** Every privileged RPC enforces a persisted, authenticated minimum generation from OS-validated signed metadata; certs and receiving keys bind to that generation; access-group membership alone is insufficient; failure raises a key-custody gate with a consult path, not a silent weakening.
- **Opus 3 (adapter termination):** Quiescence applies to every replaced component including a bundled GUI adapter; a bounded attempt that cannot reach quiescence defers rather than kills; update-caused interruptions are audited with unknown outcomes recorded.

## Independent checks

- **Binding UX:** Biometric table matches the contract exactly — one biometric for command approval, 1Password unlock/access, credential release, and every rule-setting decision (create/change/remove, session/timed, default Forever); none for allow-once/deny-once/cancel/dismiss. Forever default preserved. Pairing, device keys, and preferences survive updates; consultation is required before any path adding prompts, physical access, or re-pairing. Phone update-scheduling controls use the existing decision key with no extra biometric and no added confirmation dialog, and can only schedule an already-verified release — no UX regression.
- **Consistency:** Admission closes atomically with request creation and permit dispatch, with a retryable "Update installing" result for races; the drain continues existing requests, expiry, command I/O, and permit completion, so no approval is silently discarded. Restart matrix is consistent with never-redispatch, permit invalidation on lost acknowledgment, and no resurrection of consumed requests. Pre-login transport fallback is transport-key-only and explicitly excluded for credential-receiving and authority keys. The relay cannot mint approvals; E2E payload encryption bounds relay exposure. "Administrator-controlled" placement follows section 3's strict root-owned/non-user-writable definition. Both feasibility gates (service installation, update continuity) define required evidence and failure/consultation paths.
- **Terminology edge cases examined and found reconcilable:** the bounded automatic activation wait versus indefinite explicit-drain deferral (both resolve to "defer, never kill"); floor-raising versus certification refresh ("current peers" are those meeting the new floor); per-request adapter-key certification with account/session/incarnation binding.

No internal contradictions or actionable defects found in the scoped sections.

**NO SUBSTANTIVE FINDINGS**