Findings from the task and whole-branch reviews that were ruled non-blocking, plus the behaviour changes that need release notes. None is an authorization bypass. Recorded in the repo because the review workspace is scratch and git history does not carry the reasoning. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>