D-012 rev5 corrections: post-callback authority-state revalidation in _authorization_checks (reentrant revocation during currentness evaluation blocks consume/dispatch -- reviewer's focused cases); attempts' bound generation pair governs their extensions (accidental authority-pair reassignment cannot rebind); revoke() atomic under the registry lock. Tests 37/37 incl. both focused reentrant cases. Run result regenerated (37/0/0). master