Run #15: fix 5 SERIOUS findings; seal subscription access gate
test: streaming workflow gaps (12 tests)