Deny policy (AirGate_Deny_{username}) was removed during disable but not recreated on restore. Now _update_deny_policy is called during restore to rebuild project isolation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>