Function echo_transcript 

pub fn echo_transcript(
    challenge: &[u8],
    device_fpr: &[u8; 32],
    handshake: &[u8; 32],
) -> [u8; 32]

K31 proof-of-possession echo bound to the conversation.

HMAC-SHA256(key = challenge secret, "CC/v1/echo-transcript" ‖ device_fpr ‖ handshake), where handshake comes from handshake_transcript.

Including the transcript prevents an echo from moving to a different handshake when the challenge secret repeats. It cannot distinguish a fully repeated transcript after snapshot and clock rollback, or protect against a stolen key.