The Oura egress guard now covers every auto-discovered oura*.py instead of only oura.py, including oura_auth.py where OAuth and loopback callback networking live. The allowlist is keyed by module, owner, and capability rather than line numbers, permits module-level network imports for oura_auth only, and preserves oura.py's lazy-import discipline. The guard fails on later-added socket, TLS, HTTP, mail, subprocess, dynamic-import, __import__, os.system, os.popen, and unallowlisted browser escape hatches. A synthetic self-test feeds violations to prove the guard can actually fail. Future Oura authorization requests drop email and personal while deliberately keeping metabolic. metabolic authorizes only blood_glucose, which stays partner-gated and unpolled. Docs now spell out exact retention semantics, the reserved writer-less Oura stream identity, the scope table, lock and consent-expiry behavior, and owner remediation. They also state that dropping email/personal affects future authorization requests only and does not revoke scopes already granted on existing tokens; narrowing an existing token requires owner-present re-consent or revocation as an operator action. (cherry picked from commit 26ad7301707c3c4c9359d8930483cf357942f3b7)