- Add route coverage for push and pull requests when a remote node apiKey is empty
- Reject malformed and non-exact bearer headers for settings and auth receive endpoints
- Verify sourceNodeId never bypasses bearer validation while valid tokens still reach apply paths
- Assert 401 responses do not echo attempted bearer tokens
Fusion-Task-Id: FN-4862