- Add authorization.integration.test.ts covering unauthenticated/regular-user/admin access across both admin-only and merely-authenticated routes - Add stale push subscription cleanup test (disableSubscription excludes a device from fan-out without deleting its row/history) - Add retention test for a topic with no override falling back to the resolved Admin-configured global default - Update README status: Phases 2-10 complete