BIO-018: the store was a process-global dictionary keyed on the client-supplied Idempotency-Key alone, so one caller could replay another caller's key and receive their cached response. The key is now scoped with the caller SubjectId. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> # Conflicts: # docs/project/refactor-backlog-setup/refactor-backlog/99-backlog.md # libs/shared/docs/behaviour-spec.mdx