fix: address independent review findings

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## Unreleased
+
+- Bound JSON nesting before parsing and return a JSON-RPC parse error instead
+  of dropping the request connection.
+- Bound request-body reads and return HTTP 408 for incomplete slow requests.
+- Enforce the advertised object-item schema for result evidence and review
+  findings.
+- Correct the documented post-`CHANGES_REQUESTED` remediation path.
+
 All notable changes to this project are documented here.
 
 ## 0.1.0 — 2026-07-30
@@ -14,4 +23,3 @@ Initial review candidate:
 - transport authentication abstraction and BASDM separation controls;
 - tests, container example, contract, threat model, production profile, and
   WP-PA-001 review evidence.
-