Source: MIZOKI audit 2026-09-06 (pinned fc8b03f9) → work-order backlog 2026-09-08 (docs/audits/AUDIT_WORK_ORDERS_2026-09-08.md). Findings are hypotheses until reproduced on current main (WO-00).

Finding: 419 unbounded declarations in 52 of 135 requirements manifests; pin ratchet covers only Firestore and google-api-core [R27]. Not a vulnerability scan. Files: tests/test_client_library_pin_ratchet.py; per-service requirements*.txt. Fix: lockfiles per deployed service; ratchet extended to all deployed services; advisory scan added as a separate job. Acceptance: ratchet test covers every service in the deploy allowlist (tests/governance/test_deploy_allowlist_completeness.py pattern). Depends on: WO-00.