fix: close task 3 resolution findings

.superpowers/sdd/2026-09-22-control-panel-operational-ux-v1/task-3-report.md

@@ -71,3 +71,61 @@ The warnings are existing third-party test-environment warnings from `pytest_asy
 
 - Live PostgreSQL and agent execution were not exercised; verification used the repository's offline SQLite test fixtures.
 - The blocker remains open until the agent's normal reprocess completion path reports resolution; this prevents marking it resolved before the bounded job succeeds.
+
+## Review Fixes
+
+### RED
+
+Added regression tests before changing production code for the four review findings:
+
+- Legacy blockers with `installation_id=NULL` must fail closed without selecting an Agent or creating work.
+- Cross-tenant installation and Agent pointers must fail before context, job, or audit mutation.
+- Oversized values/reasons and non-string fields must be rejected cleanly.
+- Successful web resolution must redirect to the blocker detail page.
+
+Focused command before the fixes:
+
+```text
+python -m pytest central/tests/test_blocker_resolution_panel.py -q
+```
+
+RED result:
+
+```text
+4 failed, 5 passed
+```
+
+The failures reproduced the legacy Agent fallback, cross-tenant acceptance, unbounded/malformed input, and `/blockers` redirect behavior.
+
+### GREEN
+
+- Resolution now requires a non-null exact installation and verifies both installation and Agent tenant ownership before mutation.
+- `value` is required to be a string of at most 512 characters; `reason` is required to be a string of at most 2000 characters.
+- Boundary-sized audit data retains all required audit fields without whole-context truncation.
+- Web success redirects to `/blockers/{blocker_id}`.
+
+Focused command:
+
+```text
+python -m pytest central/tests/test_blocker_resolution_panel.py -q
+```
+
+Result:
+
+```text
+9 passed, 1 warning
+```
+
+Full central command:
+
+```text
+python -m pytest central/tests -q
+```
+
+Result:
+
+```text
+265 passed, 1 warning
+```
+
+The existing `pytest_asyncio` configuration and `openpyxl` print-area warnings remain unchanged.