Turn it up where it matters

The ControlLevelAssignment map — Level 0 globally, Level 2 on finance processes, Level 3 on payment-release gates — and a request touching two scopes resolving strictest-wins, live, with matched_assignments and the resolution rule recorded on the bundle.

Control posture is assigned, not coded: declarative scope selectors, resolved deterministically at request time, recorded on every DecisionBundle.

Live POSTs create the three scoped assignments (with registered teardown so other scenes stay clean); a /resolve probe returns matched_assignments and strictest-wins; the resolved level is stamped on a real DecisionBundle's control_level_resolution.