Feedback from the first rollout: a default-off gate is the wrong way around — the default must be active and enforced, with the opt-out as an explicit, documented per-invocation emergency flag (same posture as the image-scan gate). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg Reviewed-on: #5 Co-authored-by: peet <peet@noctrl.eu>