arXiv:2604.03900v2 Announce Type: replace Abstract: A zero-knowledge proximity proof certifies geometric nearness but carries no commitment to an application context. In stateful geo-content systems, where drops can share coordinates, policies evolve, and content has persistent identity, this gap can permit proof transfer between application objects. We present a systems-security analysis of this deployment problem: a taxonomy of context-binding vulnerabilities; a formal model whose replay game asks whether a recorded proof transcript can be re-bound to a different application context (fresh in-radius proving is provably beyond any statement-level mechanism and is delegated to an orthogonal presence layer); an assumption comparison across five binding strategy classes; and a concrete instantiation, Zairn-ZKP, that embeds drop identity, policy version, and session context as public circuit inputs. In-proof binding removes the nonce-to-drop mapping and nonce-uniqueness invariants from the operational assumption set and adds no measurable proving cost over a sound geo-only baseline. A hardened stored-digest check blocks the same transfer attacks under per-request nonces, but its resistance comes from an in-statement challenge digest -- a hybrid, not a purely off-circuit design -- while purely off-circuit strategies cannot resist an adversary able to request fresh challenges; holding nonce policy constant, in-proof context binding is the only strategy blocking same-epoch transfer under shared nonces. Measurements across six network conditions, seven venues in four countries, and an epoch-window simulation indicate same-epoch transfer is a realistic concern in dense urban deployments. Evaluation spans five platforms, seven strategies, and an end-to-end transfer attack; all artifacts are public.