VERIFIED (repository): read API src/routes.py on api-phase1-development; registered write-capable routes and methods are captured in https://gitlab.com/moneymarche/api/-/blob/api-phase1-development/docs/security/write-routes.md.
OBSERVED: route inventory includes machine candidates (/save-nav, /jobs/upload, home-page categories), public-form candidates (quote, booking, enquiry, FAQ), and U/client-data candidates (customer, KYC, family, address, bank, income, portfolio, risk-profile, watchlist). This is preliminary classification, not verified handler auth.
UNKNOWN: handler-level session enforcement, consumer-to-route mapping, runtime SHA/configuration, effective credentials, and staging DB isolation.
Action: opened Claude Design review/correction issue https://github.com/moneymarche-dev/MMDEP/issues/213 (label agent:claude) with explicit gaps, including U-route session checks and current-vs-future /api/ingest/*.
Gate: no security implementation until Design review and design check pass. Any U/client-data write found without session/authorization must be escalated with exact handler evidence; no runtime change made.
Next: await Design review while continuing independent Lane P preflight; do not touch auth enforcement or staging/production settings.