Auth flow and guard order as built now, new architecture decisions (user-management escalation guard, SSO identity binding, sealed backups), a section on API security with the remaining known gaps, and the audit table with commits, new env variables and steps after the update. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>