fix(housekeeping): harden people account workflows

.superpowers/sdd/2026-08-26-housekeeping-completion/task-12-report.md

@@ -153,3 +153,56 @@ Exit 0
 The Node engine warning remains the approved non-blocker: the repository requests Node `>=26.8.1 <27`, while this host runs Node `v26.7.0` with pnpm `11.24.0`. All test and type gates exited successfully.
 
 No database operation, deployment, push, or pull-request update was performed.
+
+## Official review fix round 1
+
+The official review reported 0 Critical and 5 Important findings. This round addresses the five findings without widening the Task 12 route catalog or changing legacy redirects, safe-action response shapes, or cutover behavior.
+
+### RED evidence
+
+```text
+Production server authority: auth resolver was called 0 times at the public service boundary (1 failing regression).
+Canonical external audit: 3 failing regressions for missing durable intent/outcome behavior.
+Transactional audit: expected one transaction and observed zero (1 failing regression).
+Legacy/production workflows: new production matrix initially exposed bulk truncation/deduplication, trade-lock hierarchy/state, missing StaffActivities, and missing word-filter refresh behavior.
+Primary workflows: page suite started at 7 passed / 2 failed (no executable command form and no bounded URL parser); preview contract started at 61 passed / 3 failed (searchParams/loading propagation).
+Import boundary after real forms: test:housekeeping reached 481 passed / 1 failed, then the focused boundary exposed one exact page-state -> People models edge (22 passed / 1 failed).
+```
+
+### GREEN implementation
+
+- Production People services now rehydrate `getHousekeepingCapabilityContext()` on every public mutation. Invocation data can carry correlation and an expected actor only; it cannot synthesize permissions. The production adapter stays private, while test factories inject an authority resolver.
+- Pure database mutations write their canonical before/after audit evidence in the same transaction. Mixed database/RCON/cache work writes sanitized intent first and a correlated success, failure, or partial outcome afterward. Audit-outcome persistence errors retain truthful completed/partial state, and legacy wrappers preserve their observable behavior.
+- Ban/unban use observed active-ban state; trade-lock uses observed sanction/settings state. Passwords, hashes, API keys, and secrets are excluded from canonical evidence.
+- Shared legacy bulk paths preserve original order, duplicates, totals, and iteration with no service-side 100-item cap. The <=100 bound remains in command schemas. Trade lock has no invented hierarchy gate and its missing-user wrapper message remains exactly `User not found`.
+- Original `StaffActivities` side effects are retained for bulk ban/unban/currency/badge, guild disband, VPN, and trade lock. Missing word-filter deletion still reloads local cache, sends RCON refresh, and returns legacy success.
+- The nine registered pages now expose capability-gated, accessible command forms backed by `executeHousekeepingCommand`; no inert command spans remain. Edit submits a mutation, list inputs come from bounded URL search parameters, and the dynamic preview route passes them through. Atomic Task 11 queries keep their fail-closed contracts; the impossible synthetic partial state was removed. A real Next loading route was added.
+- The foundation contract allows only the exact same-domain edges required here: each People page to the shared People command form, the form to the single housekeeping command action, and page-state to the People `ListInput` model. No wildcard or prefix relaxation was introduced.
+
+### Final verification after review fixes
+
+```text
+Focused wrapper/command/page/service/route/auth/audit/staff-smoke matrix
+Test Files 24 passed (24)
+Tests 187 passed (187)
+
+pnpm test:housekeeping
+Test Files 58 passed (58)
+Tests 482 passed (482)
+
+pnpm test
+Test Files 206 passed | 3 skipped (209)
+Tests 1321 passed | 5 skipped (1326)
+
+pnpm typecheck
+tsc --noEmit
+Exit 0
+
+pnpm exec biome check --formatter-enabled=false <40 exact changed Task 12 source files>
+Checked 40 files. No fixes applied.
+
+git diff --check e1b31ff7738eb5cc59e7765c8ed7290d62130972 --
+Exit 0
+```
+
+The approved Node engine warning remains: the repository requests Node `>=26.8.1 <27`, while the host runs Node `v26.7.0` with pnpm `11.24.0`. No database operation, deployment, push, or pull-request update was performed.