Routes converted: updates.js (17), notifications.js (8), tailscale.js (12). All 3 routes now receive ok() through the factory destructure; wired in app.js. notifications.js: kept 2 res.json() calls for genuine partial-failure semantics - POST /test with ?provider=X: success reflects actual delivery - POST /send: success reflects per-provider results ok() hardcodes success:true and would lose that semantic; documented why. tailscale.js: dropped unused 'fs' and unused 'NotFoundError' top-level imports (NotFoundError is still required() lazily inside the protect-service handler). Net change: 12 calls cleaned up, 2 lint warnings fixed. 750/750 tests still pass.