# Round 9 GLM scoped review — sections 1, 2, 6, 11, 18 (revision 15)

## Checks performed

**Internal consistency of biometric policy.** Section 1's table, section 6's scope-enforcement rules ("any reusable rule change requires the biometric key, including Deny Forever and temporary/session rules"), and the narrow decision key's exclusion list ("cannot authorize rule changes, command execution, 1Password approval, credential release, or enrollment") are mutually consistent and match the binding UX: allow-once/deny-once/cancel are biometric-free, every reusable rule (including deny and temporary rules) requires one biometric, no double biometrics, no forced re-pairing (section 18: "Do not require pairing again merely because versions differ"; section 2: no physical proximity after enrollment).

**Authorization integrity.** Decision bindings cover request digest, challenge, action/scope, phone identity, key ID, and purpose; key class is derived from retained action semantics, not caller labels or phone assertions; domain separation prevents status signatures verifying as approvals; digest recomputation on both Android and each acting authority is specified; single-use signatures with no sudo-style window. No gap found.

**State machine and races.** Consumption persisted before external side effect; declined/cancelled/expired terminal only pre-dispatch; first-valid-decision atomic win with explicit stale/Already-handled results; unknown terminal for retry; permit invalidation and bounded acknowledgment; no automatic retry. Coherent.

**Section 18 negotiation.** Envelope and request-contract selection are properly separated; contract choice maximizes eligible phones with floor/feature exclusion and highest-version tie-break; stale capability records can only reduce reachability; no re-encoding into weaker schemas; unknown optional fields stay inside the signature; noncanonical rejection; policy/floor persistence independent of binaries. No downgrade path found that yields action authority.

**Round-8 disposition落实.** The three accepted Opus corrections appear in the provided text where in scope: floor commit timing ("Stage a higher floor... Keep the old role usable until replacement checks pass and the new floor commits"), independent root-rollback rejection ("Reject it independently of its own startup checks"), and recapture constraints ("Recapture only never-consumed requests, preserving age and requiring a fresh decision"). Section 11's coverage rules (exact text comparison, overlapping scopes after output-limit exhaustion, no silent model substitution) match the disposition's process.

**Near-findings considered and dismissed as non-substantive:** the narrow decision key's positive purpose list is defined by section 1's table plus negative constraints rather than an enumerated list (determinate when read together); the recapture acceptance bullet compresses the trigger conditions defined normatively in section 17 (out of this pass's scope); largest-coverage contract selection preferring an older above-floor version is documented, tested intent, not a weakening.

## Conclusion

NO SUBSTANTIVE FINDINGS