The first-pass review was busy. Style nits, nulls. Hardcoded timeout: not mentioned. Reimbursement cap pulled from the wrong department’s chunk, plus a quiet “authorized by default” in the diff: not mentioned. A complete PR description makes merge look already checked. Generation-layer filters are too late.