v1.3.1

Changed

• Behavior change: the consent gate is opt-in and off by default again.
  policy.auto_approve_notional reverts to its pre-1.3.0 semantics - the default
  0 now disables the gate, so place_order / close_position /
  modify_order auto-execute (full-open) with no approval step. Set
  auto_approve_notional > 0 to arm the gate: orders/closes at or above that
  notional then require human approval, and widening or removing a stop does too.
  This reverses the 1.3.0 fail-closed default, which broke unattended agents that
  expected orders to execute. The pre-flight limits (max_*) and symbol
  allow/deny lists remain opt-in (0 / empty = off), as before.

Added

• A startup WARNING (both transports) when the consent gate is off
  (auto_approve_notional <= 0), so the fail-open posture is visible in the logs.
  Mirrors the existing empty-auth_token warning.

Fixed

• place_order (priced / pending orders) and modify_order (widening or removing
  a stop) no longer turn a quote outage into an INTERNAL_ERROR when the consent
  gate is armed. If approval is required but no live tick is available to render
  the preview, they now refuse gracefully with SYMBOL_NOT_ENABLED (mirroring
  close_position); modify_order also falls back to the position's last-known
  price for widening detection during the outage.
• Corrected the doctor --smoke-trade hint when the gate is armed: to run the
  smoke order you raise auto_approve_notional above it (or set 0), not lower it.

Upgrade note

If you relied on 1.3.0's fail-closed default to force approval on every trade,
you must now set auto_approve_notional > 0 explicitly to keep that behavior;
otherwise mutating calls execute without an approval step.