Stop inventing reviewer_id=2. Use project document_duty as the authority, heal missing or non-member placeholders, and keep write paths rejected for reviewer and outsiders. Co-authored-by: Cursor <cursoragent@cursor.com>