The published contract named a `trusted-proxy-hmac-v1` profile that no
implementation accepts. This replaces it with `trusted-proxy-hmac-v2` as the
sole stock proxy transport, specified from the wire format: envelope layout,
length-prefixed MAC input, canonical encodings, discovery identifier, replay
namespace, and lease bounds, with negative vectors.
Denial handling is re-scoped. The no-mutation invariant now covers
authoritative authorization state only, and denial observability moves to a
separately bounded, non-authoritative channel carrying reason codes and
correlation identifiers under payload minimization. A denied admission
creates no authorization receipt, and a failed observation write never
blocks, retries, or latches the denial.
Runtime operations, deployment, and integration guidance is framed as future
contract rather than current behavior. Subject stability is stated as a
verifier trust assumption with its reassignment consequence, and the
key-snapshot rollback claim is narrowed to what the model enforces.
This is a documentation change. It adds no runtime parser, adapter, or
enforcement path. Session-path rechecks and the policy digest input set
remain relay-side follow-ups. The 24 trace and 16 invariant identifiers are
unchanged.
