Reverts this week: 2

• Fran got locked out the morning of an invoice deadline because we required 2FA for managers. The principle was right; the implementation was a hostage situation. 2FA is now optional for everyone, recommended for admins, and we explain why we recommend it.
• Alex runs a client with eight subprojects under one contract. Each one lived as a peer project, so reports were noise. Added a parent-child hierarchy with rollups — the contract is one number now, not eight.