docs: append weak password fix report

.superpowers/sdd/2026-09-22-control-panel-operational-ux-v1/task-1-report.md

@@ -67,3 +67,35 @@ Implementation commit: `0846b9d1b076c60c57ad2a30a3071480a680bccf` (`feat: add op
 
 - The existing pytest environment emits one non-failing `pytest-asyncio` deprecation warning; the full central suite also emits the pre-existing `openpyxl` warning noted above.
 - `operational_priority` intentionally uses only operational blocker type, field, and reason signals; it does not infer fiscal severity.
+
+## Reviewed Finding Fix
+
+Finding: `create_admin` used the import-time `settings.allow_weak_dev_password` value as the default for the call-time environment lookup. If the flag was enabled during import and later removed, short passwords remained accepted.
+
+Fix: `ALLOW_WEAK_DEV_PASSWORD` now defaults to `"0"` at every call. The existing `APP_ENV != production` check remains enforced, and Docker Compose still explicitly sets `ALLOW_WEAK_DEV_PASSWORD: "1"` for the local `fiscal-hub` service.
+
+Regression RED command:
+
+```text
+python -m pytest central/tests/test_control_plane.py::test_removed_weak_password_flag_is_fail_closed_after_import -q
+```
+
+Result before the fix: `1 failed`; after reloading configuration/auth with the flag enabled, removing the flag did not raise `ValueError` for a short password.
+
+Regression GREEN command:
+
+```text
+python -m pytest central/tests/test_panel_presentation.py central/tests/test_control_plane.py -q
+```
+
+Result: `11 passed`.
+
+Full central regression:
+
+```text
+python -m pytest central/tests -q
+```
+
+Result: `242 passed, 1 warning`; the warning is the existing `openpyxl` print-area warning.
+
+Fix commit: `de571e3ac2ce214677e1f9baa673181350b7d411` (`fix: fail closed weak password opt-in`).