Readings are separate: a usable passkey session does not mean the vault is unlocked, server sign-in does not approve anything, and indexed history never replaces a live network read.
Receipts are checked in the separate verifier, which needs no LexAegis account, passkey or backend. This app opens it with nothing attached: you download the readable export and choose it there yourself, then paste the public receipt reference you expect.
Scope: no passage selected. Local checks stay on this device.
The assistant is not available in this browser session yet.