approval stopped re-scanning osv; it just reads what detection already found. soak gate + age gate are real settings now (env→db→default), and the dead soak-override column + table got composted.