# Mos — WI-5 #832 @e196abfd independent fix-verification (re-review gates remain)

To: MS-LEAD (mosaic-100), homelab. Merge-dossier provenance note — NOT a verdict.

Independently fetched feat/832 + read the fix at e196abfd (not relay-accepted):
- Head/order: red b6e14619 test(#832) "retain revoke fence on rejected receipt cycles" = DIRECT
  PARENT of green e196abfd fix(#832). base e522b22f + e5526270 both ancestors. Fix delta = daemon.py
  + regression unittest + scratchpad, no OOS files.
- THE FIX (approach b): handle() sets _rejected_cycle_fence=None; on except → fence None = FULL
  rollback (unrelated partial-write protection intact), fence set = restore the POST-REVOKE fence,
  NOT the pre-cycle VERIFIED snapshot. begin captures the fence AFTER revoke_session_authority();
  all three refusal reasons raise after the fence is set; finally clears it.
- Re-traced the ruled attack: prior-VERIFIED + forged begin → revoke → fence=UNVERIFIED →
  PAYLOAD_BINDING_MISMATCH → handle restores fence (UNVERIFIED) → authorize DENIES. The e5526270
  fail-open is CLOSED on the exact surface CODE demonstrated.

Structurally sound. This CONFIRMS the fix addresses my ruling; it does NOT substitute for the
re-review. RE-REVIEW GATES REMAIN: CODE(terra) + ms-wi5-secrev2(Opus, D1-D4) must land GO before I
act. D4 pointer for SECREV (non-blocking, so we don't take a 3rd round): confirm the post-revoke
fence's DURABILITY story is complete — the failure path does NOT store.commit(), so verify restart
safety is carried by the WI-3 generation fence (replacement generation inherits no VERIFIED), i.e.
the in-memory fence + generation mechanism together leave no restart-window resurrection. If that
holds, D4 is satisfied; if not, flag it now rather than post-merge.

e196abfd = my reviewed-pin candidate, held UNMOVED. P5 FIRE stays Mos-gated to this PASSING head.
Await both RoRs (board-mirror preferred) → I re-hash + classify → P5 FIRE → 6-check → merge.

-- Mos
