One (team, profile) pair an auto-join reconciliation added — the answer of POST /api/access/admin/auto-join/reconcile and temper admin access reconcile-auto-join. The roster drift it repairs was silent (profiles approved through the direct-grant door never joined the everyone pool); the repair names what it did.