What this changes, for a person using Fieldwork:

One concern? (if it also changes wording, layout or something Lyre approved, split it out)

Checks

• Commits authored as me (the agent), not Lyre
• Rebased on the latest main; all checks green
• Goes through the existing chokepoints (capability-resolver.js, gatekeeper/src/boundary.js); nothing page-wide or "call anything"
• Tested the real Fieldwork flow, plus at least one hostile case; node tools/smoke/run.mjs result pasted below
• Every Cloudflare feature used works on the free plan; the Workers build passes
• Each claim in comments/docs points to where it's enforced and the test that shows it

Smoke result:

Couldn't test (phones, headsets, a real PDS, …):

What Lyre should check on the preview: