Clarity map — TakeoverPrompt (v2)
Clarity review + the 4 B1 invariants on the embedded identify. The point: two unmistakable audited outcomes, no cash amount before auth, and the obligatory tier-2 case never hides here.
aTwo outcomes, both audited, no redundant third. Take-over = DrawerTakeover (accountability transfers, close-A/open-B count); Continue as seller = SellerJoin (owner keeps the drawer) — this IS the valid "decline the takeover" path, so the old separate "Not now" (same event) is gone. The audit log can say afterward exactly which the cashier chose.
bTotal-gated (the fix). Pre-identify shows whose drawer + how long (decision + accountability) but never the cash amount — zero dollars pre-auth. The expected total appears only post-identify, as the count baseline (illustrated in the post-auth block). One structural rule: no drawer amount renders without an authenticated actor behind it.
cIdentify-first reuses B1 — number VISIBLE (non-secret label), PIN masked. Inherits B1's invariants in this context: no roster rendered (by-number), uniform failure + decoy PBKDF2, no name-of-B leak pre-auth, no length/format on the number. (To verify in the JSX markup.)
dNamed owner = intentional (not a leak): a takeover transfers responsibility for a specific person's drawer — the name is the accountability context the taker needs; "whose" (name) is pre-auth OK, "how much" (amount) is post-auth only. Personal-mode variant (entry b): the actor is already authenticated by their login, so it skips straight to the outcome with the total shown. The owner "I'm-still-here" refresh is a separate PRODUCT-TBD affordance (spec §3), not this screen.