- Commands hash with bcrypt, validate role codes, and revoke tokens on reset - Generated app main appends cabana.RuntimeCommands exactly once
- Fresh migrate is missing tokens_valid_after and the admin blacklist table - Reapplying the seed is not idempotent and role codes reject Winter duplicates