Restoring a clean high-severity dependency gate sounds like a package upgrade. Often the code change is tiny—a lockfile override, a regenerated lock, two files touched. The hard part is proving you fixed the right thing without weakening CI policy, broadening scope, or writing acceptance criteria fo...

After two structural fixes had landed, the honest answer to "is this fast enough now?" was still: we don't actually know. The fixes looked right. Nothing obviously misbehaved. But "it feels better" is a feeling, not a finding. The next piece of work wasn't another fix — it was figuring out whether a...