RBAC closed. Four multi-team gaps sealed in one pass.
Multi-team operators were hitting trust gaps: KPI snapshots mixed cross-team data, roadmap queries weren't scoped, the assertTeamRole bootstrap could be skipped, and standing orders leaked teamId. All four closed. Two-team isolation now verified by a dedicated smoke test — create two teams, two members each, confirm zero cross-contamination.
