The 2a-n>f fork-safety bound is enforced solely in runViewChangePass (fail-secure halt).
safeConfig() was an unused second predicate; removed to keep one source of truth. roundView
retains n/f only for noteSender's f+1 round-skip.
Co-authored-by: Hanzo Dev <[email protected]>