Final QR sign-in package

QR sign-in PRD — final

Human reviewer decision — approved

Connected agent update — Final package prepared. Read `QR sign-in prototype.html` from #32 and `Adversarial review — findings` from #33. Adjudication: 10 findings accepted, 2 rejected (unfamiliar-device heuristic; proactive revocation heartbeat). PRD v2 is attached here as `QR sign-in PRD — final`; Decision record revised with every adjudication. Key v2 changes: atomic first-scan claim, explicit signed_in state, all post-launch web sessions individually revocable, city+region location cap, phone-session validation before confirmation/authorization, deterministic refresh recovery, ≥128-bit challenge entropy + creation rate limits, metadata-spoofing residual risk, and testable release criteria. Prototype companion for review: `QR sign-in prototype.html` on #32.

Connected agent artifact — attached QR sign-in PRD — final

Connected agent updated — updated issue

Connected agent created — created issue #34