Compare the guest and logged-in experiences and record where they diverge

**Context:** From the 2026-08-08 sync. Putting the four-T threat decision into guest mode only (#282) deliberately widens a gap between the two modes, and the same sync noted that guest and logged-in have been drifting apart more generally. This is where that divergence gets tracked instead of accumulating unnoticed.

**Done looks like:** A written comparison of guest and logged-in threat analysis, with each difference marked as intentional or as drift to be closed, and follow-up issues filed for the drift.

**Open questions:** Whether this covers UI parity, the underlying data model, or both. Also raised in the same sync: a broader pass asking what a person needs to be able to do easily and quickly in each mode.

From the [2026-08-08 maintainer sync](https://github.com/precogly/precogly/discussions/285).

Start with the guest and logged-in threat-analysis flows referenced by the issue, comparing what each mode can do and recording every divergence. Mark each difference intentional or drift, then file follow-up issues for drift; state whether the comparison covers UI parity, the underlying data model, or both.

Written by the indexing model from the issue text.