diff --git a/docs/nips/NIP-FI-CONF.md b/docs/nips/NIP-FI-CONF.md
index 2428bd9720..c6ba387977 100644
--- a/docs/nips/NIP-FI-CONF.md
+++ b/docs/nips/NIP-FI-CONF.md
@@ -193,7 +193,9 @@ For each listed oracle the suite MUST retain at least one **mutant**: an
 implementation variant that violates a requirement that oracle governs,
 together with that oracle's failing output (`FI-CONF-MUTATION`). Evidence is
 the exact patch identity, the oracle identifier, and the retained failure
-output at the claimed head.
+output at the claimed head. For this document's own oracles the implementation
+under test includes the conformance suite and its report; a mutant is a single
+variant of the suite or report that the entry's own oracle rejects.
 
 While `FI-CONF-INTEROP-EXIT` is validly deferred it remains in claim
 completeness but is excluded from this section's mutation and global-control
diff --git a/docs/nips/NIP-FI-DELEG.md b/docs/nips/NIP-FI-DELEG.md
index 30f4fc44e8..30e8312019 100644
--- a/docs/nips/NIP-FI-DELEG.md
+++ b/docs/nips/NIP-FI-DELEG.md
@@ -17,7 +17,11 @@ and RFC 8174) when, and only when, they appear in all capitals.
 This profile authorizes a delegate key from separately validated delegation
 evidence rooted in a currently eligible NIP-FI owner binding. The delegate
 proves its own key. It does not present a federated assertion and never receives
-or inherits the owner's binding.
+or inherits the owner's binding. Because a trusted edge inserts assertion and
+provenance fields on every request it forwards, and `FI-DELEG-PATH-SEPARATION`
+denies any such field on a delegated request, delegated requests cannot traverse
+a route that requires edge provenance; they use ingress on which NIP-FI-EDGE is
+not required.
 
 This profile defines the normalized delegation result and its additional
 preparation, final-admission, and lease witnesses. It does not define a wire
@@ -51,8 +55,9 @@ when their concrete encoding belongs to the supplying delegation protocol.
 The evidence authenticates every field, has one unambiguous owner and delegate,
 matches the server-owned domain and exact request or target, and has a finite
 expiry satisfying `now < mandatory_expiry`; equality at an expiry is expired.
-Optional `not_before` satisfies `not_before <= now + skew`, as core defines for
-`nbf`. The proven actor equals `delegate_key`. [FI-DELEG-EVIDENCE-CLOSED]
+Optional `not_before` satisfies `not_before <= now + skew`, using the
+configured delegated `skew`; arithmetic is overflow-safe. A missing value
+denies. The proven actor equals `delegate_key`. [FI-DELEG-EVIDENCE-CLOSED]
 
 A delegated request carries fresh request-appropriate Nostr proof and no
 `Nostr-Federated-Identity` or profile provenance field. Mixed direct and
@@ -120,8 +125,8 @@ material. [FI-DELEG-NO-BINDING]
 
 ## Delegated leases
 
-A deployment configures a positive finite delegated maximum. The lease deadline
-is no later than the minimum of:
+A deployment configures a positive finite delegated maximum and a non-negative
+finite delegated `skew`. The lease deadline is no later than the minimum of:
 
 - delegation expiry;
 - delegate proof or connection bound;
@@ -149,11 +154,11 @@ or owner key on the same connection. [FI-DELEG-OWNER-CURRENT]
 
 ## Discovery
 
-A relay claiming this profile MAY add `"delegation": true` to the NIP-FI
-object in NIP-11 only when owner-current resolution, the positive finite
-maximum, uniform final admission, and all profile oracles are active. It does
-not advertise relationship IDs, owner keys, private delegation protocol names,
-or policy detail. [FI-DELEG-DISCOVERY]
+A relay claiming this profile MAY add `"delegation": true` to the NIP-11
+`federated_identity` object only when owner-current resolution, the positive
+finite maximum, uniform final admission, and all profile oracles are active. It
+does not advertise relationship IDs, owner keys, private delegation protocol
+names, or policy detail. [FI-DELEG-DISCOVERY]
 
 ## Behavioral oracles
 
diff --git a/docs/nips/NIP-FI.md b/docs/nips/NIP-FI.md
index 982233a677..663210659b 100644
--- a/docs/nips/NIP-FI.md
+++ b/docs/nips/NIP-FI.md
@@ -44,8 +44,7 @@ public identity projection, application membership policy, or user interface.
 - **actor** (`k`): the 32-byte public key returned by Nostr-proof validation.
 - **request context** (`R`): `R_t` sealed with `k`.
 - **binding**: a durable, versioned association `(D, i, k)` with immutable
-  provenance `attested-key`, `tofu`, or a companion-profile value such as
-  `provisioned`.
+  provenance `attested-key`, `tofu`, or `provisioned`.
 - **retired pair**: a durable denial fact for an exact `(D, i, k)`.
 - **revoked key**: a durable denial fact for `(D, k)`.
 - **prepared authorization**: immutable, read-only evidence and witnesses for a
@@ -185,7 +184,7 @@ The Nostr-key claim is named `nostr_pubkey`. When present it MUST be a
 lowercase hexadecimal encoding of exactly one 32-byte Nostr public key; other
 encodings and aliases deny. In `attested-key` enrollment policy and wherever
 current matching issuer attestation is required, this exact claim MUST be
-present and equal the proven actor. Authorization claims or capabilities use a
+present and equal the proven actor; authorization claims or capabilities use a
 closed bounded input set and deterministic canonical encoding. Unchecked claims
 never enter the result. [FI-TRACE-VERIFIER-PARITY]
 
@@ -314,7 +313,7 @@ to lowercase hexadecimal SHA-256 of the **body bytes**: the complete content
 after transfer decoding and before any content decoding. Absence, duplication,
 mismatch, validation of only a prefix, or substitution of the body bytes after
 validation denies. For an irrelevant body, no
-Authorization decision, target, capability, or effect selector derives from a
+authorization decision, target, capability, or effect selector derives from a
 body field not bound by NIP-98. A `payload` tag present on an operation whose
 body is declared authorization-irrelevant is validated identically against the
 body bytes; duplication or mismatch denies. [FI-TRACE-BODY-BINDING]