Function confirm 

pub fn confirm(
    store: &dyn ConsentStore,
    reference: &ConsentReference,
    stamped_did: &str,
) -> Result<PendingConsent, ConsentError>

This is the seam. A future PreToolUse-stamped tool call reaches this function (through whatever HTTP or in-process boundary the harness that drives it uses — not decided here) with reference from the tool call’s arguments and stamped_did from the rewrite, not from the caller.

Runs the two checks in order, so the error always names the first one that failed:

1. store.consume(reference) — live and unused.
2. stamped_did == pending.did — the account named in the request is the agent that was stamped.

There is no policy check here, and the reference’s own existence is why: a reference is minted only for a decision PAR did not deny.

Consuming the reference happens as check 1 regardless of what check 2 decides: a reference is spent by the attempt, not by success, so a refused attempt cannot be retried with a different claimed identity.