Cloud project IDs, buckets and secrets are not validated yet. Fake production health indicators are disabled. Bind controls to /api/health / /api/ready after bootstrap. Mutations remain fail-closed.