Seed fine-grained console permissions (goose 00065), gate admin handlers by system:* keys, and persist settings change audits for all upserts. KB ops and whitelist consumers stay deferred.
Verify concurrent revision conflicts, null/string rejection, plain-user denials, and PG lock/read paths for the new policy key. Co-authored-by: Cursor <cursoragent@cursor.com>