Work the task backlog.

1. Read CLAUDE.md, especially "Critical context" and "Task backlog". ALSO check
   `.claude/tasks/` for standalone task specs (e.g. T8+) that aren't inline in the
   backlog — treat those as first-class backlog items.
2. Pick the lowest-numbered task that is not yet done (default: $ARGUMENTS if a
   task id like T8 is given). Note: T1-T7 are done + live-verified; new work
   generally lives in `.claude/tasks/`.
3. Restate the task and its acceptance criteria before writing any code.
4. Implement it demo-grade, following the repo conventions:
   - Fusion is shared SaaS — never build/host it or automate its console config.
   - Endpoints Fusion calls must be public HTTPS with auth.
   - Detection returns typed findings; we own minting/vault/restore.
   - Never commit AWS creds, secrets, or real PII; seed data is synthetic only.
   - Terraform runs with `-chdir=terraform`.
5. Do NOT run deploys or anything that incurs AWS spend without asking first.
6. When done: note what you changed in the relevant file, tick the task (in its
   `.claude/tasks/` file or in CLAUDE.md), and state how you verified the
   acceptance criteria (or what still needs a human/live check).