Red-test-driven fix pass over 14 review findings: partial-refund revocation, renewal guard, per-site secret with rotation, fail-closed crypto, variation nonce, mail-gated invites, atomic check-in, rate limits, CSV guard, edit/delete UI, locked upgrades, single-site guard, erase opt-in, readme.txt, POT, behavioral suite. 28/28 behavioral, 38/38 contract.