Wallet
User device · NCH + PIN
Wallets
Account
—
Activated
no
Y deleted
—
Seq SN
0
Token key
none
WSCA
Software container · not firmware
PIN counter PC
0
Lockout τ
5
Blocked
no
Trust boundary
An attacker who owns this process can reset PC or skip auth. That is expected. Security does not stop here.
Simulate compromise
HSM / WSCD
backend · —
Every key use is logged. Monitoring trusts this log, not the WSCA.
Monitor
Annex F · independent axis
—
Run after honest traffic or an attack.
Inputs: Transaction Records + HSM audit. No secrets. Reproducible by any third party.