What it actually is

The two ephemeral layers the site must not conflate, sessions and the thread-affinity bug behind them, the watchdog, both API surfaces, the auth-model correction, the isolation table, and how artefacts come back.