Helper-side preflight scope is complete and unit-tested; the live flex-auth deny capability is re-scoped to flex-auth-side work (capability request 893ff109). Autonomous decision, documented in the task note for easy revert. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>