R1: accept best-effort FCM background delivery as a documented limitation. R7: server FCM sender uses google-auth-library (not hand-rolled RS256). All three open questions (incl. R2 license) now decided; nothing blocks AW3/AW5.