- Fair-share tenant processing: weighted round-robin, per-tenant queue depth tracking - API key → stack ownership validation on all ingestion routes - Enhanced replay attack prevention (timestamp + nonce + report_id dedup) - Remediation lock: Redis-based mutex prevents scan/remediation race conditions - Reports during active remediation tagged and excluded from scoring - 006_noisy_neighbor.sql migration