Continuous authentication on iOS: why one-shot Face ID isn't enough

Face ID is a great unlock primitive, a poor session-integrity one. What fails when biometry is treated as session auth, and the continuous-auth shape on 17+.