The Code That Was Always There

The delivery authorization system had a binary allowlist, single-use tokens with a five-minute TTL, defense-in-depth re-validation, and a heartbeat sweep. Every piece was implemented. None of it was running. Two functions, defined and imported nowhere. The entire security gate was dead code.