diff --git a/crates/registry-notary-core/config/documentation-intent.json b/crates/registry-notary-core/config/documentation-intent.json
index 685276f9e1..ea7a74ebc7 100644
--- a/crates/registry-notary-core/config/documentation-intent.json
+++ b/crates/registry-notary-core/config/documentation-intent.json
@@ -680,6 +680,51 @@
       ],
       "open_map_semantics": "Each reviewed key names a Relay consultation and each value defines the bounded consultation contract used to support this evidence claim."
     },
+    {
+      "id": "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map",
+      "purpose": "Each reviewed key names a closed structured output field and each value defines its requiredness and bounded recursive schema.",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "introduced_in": "0.15.3",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
+      "open_map_semantics": "Each reviewed key names a closed structured output field and each value defines its requiredness and bounded recursive schema."
+    },
     {
       "id": "notary_evidence_claims_evidence_mode_consultations_outputs_open_map",
       "purpose": "Each reviewed key names a consultation output and each value defines its bounded evidence-result interpretation.",
@@ -3590,6 +3635,56 @@
       "default_source": "not_applicable",
       "schema_facts_reviewed": true
     },
+    {
+      "schema": "notary",
+      "pointer": "/$defs/RelayOutputContract/oneOf/4/properties/fields",
+      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields",
+      "path_kind": "property",
+      "profile": "notary_evidence_internal",
+      "purpose_source": "profile",
+      "default_source": "no_schema_default",
+      "schema_facts_reviewed": true
+    },
+    {
+      "schema": "notary",
+      "pointer": "/$defs/RelayOutputContract/oneOf/4/properties/fields/additionalProperties",
+      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*",
+      "path_kind": "map_value",
+      "profile": "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map",
+      "purpose_source": "profile",
+      "default_source": "not_applicable",
+      "schema_facts_reviewed": true
+    },
+    {
+      "schema": "notary",
+      "pointer": "/$defs/RelayOutputObjectFieldContract/properties/required",
+      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.required",
+      "path_kind": "property",
+      "profile": "notary_evidence_internal",
+      "purpose_source": "profile",
+      "default_source": "no_schema_default",
+      "schema_facts_reviewed": true
+    },
+    {
+      "schema": "notary",
+      "pointer": "/$defs/RelayOutputObjectFieldContract/properties/schema",
+      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.schema",
+      "path_kind": "property",
+      "profile": "notary_evidence_internal",
+      "purpose_source": "profile",
+      "default_source": "no_schema_default",
+      "schema_facts_reviewed": true
+    },
+    {
+      "schema": "notary",
+      "pointer": "/$defs/RelayOutputContract/oneOf/5/properties/items",
+      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.items",
+      "path_kind": "property",
+      "profile": "notary_evidence_internal",
+      "purpose_source": "profile",
+      "default_source": "no_schema_default",
+      "schema_facts_reviewed": true
+    },
     {
       "schema": "notary",
       "pointer": "/$defs/RelayOutputContract/oneOf/2/properties/max_bytes",
@@ -3600,6 +3695,16 @@
       "default_source": "no_schema_default",
       "schema_facts_reviewed": true
     },
+    {
+      "schema": "notary",
+      "pointer": "/$defs/RelayOutputContract/oneOf/5/properties/max_items",
+      "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_items",
+      "path_kind": "property",
+      "profile": "notary_evidence_internal",
+      "purpose_source": "profile",
+      "default_source": "no_schema_default",
+      "schema_facts_reviewed": true
+    },
     {
       "schema": "notary",
       "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/maximum",
diff --git a/crates/registry-notary-core/src/config/evidence/claims.rs b/crates/registry-notary-core/src/config/evidence/claims.rs
index f2a122b71d..5dce389a3b 100644
--- a/crates/registry-notary-core/src/config/evidence/claims.rs
+++ b/crates/registry-notary-core/src/config/evidence/claims.rs
@@ -10,6 +10,20 @@ use super::*;
 pub const MAX_CLAIM_DEPENDENCY_NODES_V1: usize = 64;
 pub const MAX_CLAIM_DEPENDENCY_EDGES_V1: usize = 256;
 pub const MAX_CLAIM_VALUE_STRING_BYTES_V1: u32 = 64 * 1024;
+pub const MAX_RELAY_OUTPUT_SCHEMA_DEPTH_V1: usize = 8;
+pub const MAX_RELAY_OUTPUT_SCHEMA_NODES_V1: usize = 256;
+pub const MAX_RELAY_OUTPUT_EXPANDED_NODES_V1: usize = 4_096;
+pub const MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1: usize = 32;
+pub const MAX_RELAY_OUTPUT_ARRAY_ITEMS_V1: u16 = 256;
+pub const MAX_RELAY_OUTPUT_NAME_BYTES_V1: usize = 128;
+pub const MAX_RELAY_OUTPUT_VALUE_BYTES_V1: u32 = 64 * 1024;
+
+// The platform decoder wraps consultation outputs in the Relay result root and
+// its closed `outputs` object. The remaining fixed result fields consume 18
+// more nodes. Reserving all 20 fixed nodes here ensures an accepted authored
+// contract cannot fail later when the complete result decoder is compiled.
+const RELAY_OUTPUT_ROOT_DEPTH_V1: usize = 3;
+const RELAY_RESULT_ENVELOPE_NODES_V1: usize = 20;
 
 fn default_claim_formats() -> Vec<String> {
     vec![FORMAT_CLAIM_RESULT_JSON.to_string()]
@@ -160,6 +174,26 @@ pub enum RelayOutputContract {
         #[serde(default)]
         nullable: bool,
     },
+    Object {
+        #[serde(default)]
+        nullable: bool,
+        max_bytes: u32,
+        fields: BTreeMap<String, RelayOutputObjectFieldContract>,
+    },
+    Array {
+        #[serde(default)]
+        nullable: bool,
+        max_bytes: u32,
+        max_items: u16,
+        items: Box<RelayOutputContract>,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Deserialize, Serialize, JsonSchema)]
+#[serde(deny_unknown_fields)]
+pub struct RelayOutputObjectFieldContract {
+    pub required: bool,
+    pub schema: Box<RelayOutputContract>,
 }
 
 impl RelayOutputContract {
@@ -169,7 +203,9 @@ impl RelayOutputContract {
             Self::Boolean { nullable }
             | Self::Integer { nullable, .. }
             | Self::String { nullable, .. }
-            | Self::Date { nullable } => *nullable,
+            | Self::Date { nullable }
+            | Self::Object { nullable, .. }
+            | Self::Array { nullable, .. } => *nullable,
         }
     }
 
@@ -180,10 +216,107 @@ impl RelayOutputContract {
             Self::Integer { .. } => "integer",
             Self::String { .. } => "string",
             Self::Date { .. } => "date",
+            Self::Object { .. } => "object",
+            Self::Array { .. } => "array",
+        }
+    }
+
+    #[must_use]
+    pub const fn is_scalar(&self) -> bool {
+        matches!(
+            self,
+            Self::Boolean { .. } | Self::Integer { .. } | Self::String { .. } | Self::Date { .. }
+        )
+    }
+
+    /// Validate one exact public Relay value without retaining a serialized
+    /// copy or exposing value-bearing error details.
+    #[must_use]
+    pub fn validates_value(&self, value: &serde_json::Value) -> bool {
+        if value.is_null() {
+            return self.nullable();
+        }
+        match (self, value) {
+            (Self::Boolean { .. }, serde_json::Value::Bool(_)) => true,
+            (
+                Self::Integer {
+                    minimum, maximum, ..
+                },
+                serde_json::Value::Number(value),
+            ) => exact_json_i64(value).is_some_and(|value| value >= *minimum && value <= *maximum),
+            (Self::String { max_bytes, .. }, serde_json::Value::String(value)) => {
+                value.len() <= *max_bytes as usize
+            }
+            (Self::Date { .. }, serde_json::Value::String(value)) => {
+                crate::is_rfc3339_full_date(value)
+            }
+            (
+                Self::Object {
+                    max_bytes, fields, ..
+                },
+                serde_json::Value::Object(value),
+            ) => {
+                serialized_value_fits(value, *max_bytes)
+                    && value.keys().all(|name| fields.contains_key(name))
+                    && fields.iter().all(|(name, field)| {
+                        value
+                            .get(name)
+                            .is_some_and(|value| field.schema.validates_value(value))
+                            || !field.required && !value.contains_key(name)
+                    })
+            }
+            (
+                Self::Array {
+                    max_bytes,
+                    max_items,
+                    items,
+                    ..
+                },
+                serde_json::Value::Array(value),
+            ) => {
+                value.len() <= usize::from(*max_items)
+                    && serialized_value_fits(value, *max_bytes)
+                    && value.iter().all(|value| items.validates_value(value))
+            }
+            _ => false,
         }
     }
 }
 
+fn exact_json_i64(value: &serde_json::Number) -> Option<i64> {
+    value
+        .as_i64()
+        .or_else(|| value.as_u64().and_then(|value| i64::try_from(value).ok()))
+}
+
+fn serialized_value_fits<T: ?Sized + Serialize>(value: &T, max_bytes: u32) -> bool {
+    struct ByteLimitWriter {
+        remaining: usize,
+    }
+
+    impl std::io::Write for ByteLimitWriter {
+        fn write(&mut self, bytes: &[u8]) -> std::io::Result<usize> {
+            if bytes.len() > self.remaining {
+                return Err(std::io::Error::other("serialized value exceeds its bound"));
+            }
+            self.remaining -= bytes.len();
+            Ok(bytes.len())
+        }
+
+        fn flush(&mut self) -> std::io::Result<()> {
+            Ok(())
+        }
+    }
+
+    serde_json::to_writer(
+        ByteLimitWriter {
+            remaining: max_bytes as usize,
+        },
+        value,
+    )
+    .is_ok()
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize, JsonSchema)]
 #[serde(deny_unknown_fields)]
 pub struct RequestVariableConfig {
@@ -691,12 +824,14 @@ fn validate_consultation(
             );
         }
     }
-    if !(1..=64).contains(&consultation.outputs.len()) {
+    if !(1..=MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1).contains(&consultation.outputs.len()) {
         return invalid_claim_evidence_mode(
             claim,
-            "consultation outputs must contain one to 64 entries",
+            "consultation outputs must contain one to 32 entries",
         );
     }
+    let mut schema_nodes = RELAY_RESULT_ENVELOPE_NODES_V1;
+    let mut expanded_nodes = RELAY_RESULT_ENVELOPE_NODES_V1;
     for (output_name, output) in &consultation.outputs {
         if !is_input_name(output_name) || matches!(output_name.as_str(), "matched" | "outcome") {
             return invalid_claim_evidence_mode(
@@ -704,26 +839,102 @@ fn validate_consultation(
                 "consultation output names must match [a-z][a-z0-9_]{0,95} and cannot be matched or outcome",
             );
         }
-        let valid = match output {
-            RelayOutputContract::String { max_bytes, .. } => (1..=64 * 1024).contains(max_bytes),
-            RelayOutputContract::Integer {
-                minimum, maximum, ..
-            } => {
-                const MAX_SAFE_INTEGER: i64 = (1_i64 << 53) - 1;
-                minimum <= maximum && *minimum >= -MAX_SAFE_INTEGER && *maximum <= MAX_SAFE_INTEGER
+        let expanded = validate_relay_output_schema(
+            output,
+            RELAY_OUTPUT_ROOT_DEPTH_V1,
+            &mut schema_nodes,
+        )
+        .ok_or_else(|| EvidenceConfigError::InvalidClaimEvidenceMode {
+            claim: claim.id.clone(),
+            reason: "consultation output schema must be closed and remain within platform depth, field, item, node, name, numeric, and byte bounds".to_string(),
+        })?;
+        expanded_nodes = expanded_nodes.checked_add(expanded).ok_or_else(|| {
+            EvidenceConfigError::InvalidClaimEvidenceMode {
+                claim: claim.id.clone(),
+                reason: "consultation output schema exceeds the platform expanded-node bound"
+                    .to_string(),
             }
-            RelayOutputContract::Boolean { .. } | RelayOutputContract::Date { .. } => true,
-        };
-        if !valid {
+        })?;
+        if expanded_nodes > MAX_RELAY_OUTPUT_EXPANDED_NODES_V1 {
             return invalid_claim_evidence_mode(
                 claim,
-                "consultation output bounds must be positive and JSON-interoperable",
+                "consultation output schema exceeds the platform expanded-node bound",
             );
         }
     }
     Ok(())
 }
 
+fn validate_relay_output_schema(
+    schema: &RelayOutputContract,
+    depth: usize,
+    nodes: &mut usize,
+) -> Option<usize> {
+    *nodes = nodes.checked_add(1)?;
+    if depth > MAX_RELAY_OUTPUT_SCHEMA_DEPTH_V1 || *nodes > MAX_RELAY_OUTPUT_SCHEMA_NODES_V1 {
+        return None;
+    }
+    match schema {
+        RelayOutputContract::Boolean { .. } | RelayOutputContract::Date { .. } => Some(1),
+        RelayOutputContract::Integer {
+            minimum, maximum, ..
+        } if valid_json_integer_bounds(*minimum, *maximum) => Some(1),
+        RelayOutputContract::String { max_bytes, .. }
+            if (1..=MAX_RELAY_OUTPUT_VALUE_BYTES_V1).contains(max_bytes) =>
+        {
+            Some(1)
+        }
+        RelayOutputContract::Object {
+            max_bytes, fields, ..
+        } => {
+            if !(1..=MAX_RELAY_OUTPUT_VALUE_BYTES_V1).contains(max_bytes)
+                || !(1..=MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1).contains(&fields.len())
+            {
+                return None;
+            }
+            let mut expanded = 1_usize;
+            for (name, field) in fields {
+                if !valid_relay_output_name(name) {
+                    return None;
+                }
+                expanded = expanded.checked_add(validate_relay_output_schema(
+                    &field.schema,
+                    depth + 1,
+                    nodes,
+                )?)?;
+            }
+            Some(expanded)
+        }
+        RelayOutputContract::Array {
+            max_bytes,
+            max_items,
+            items,
+            ..
+        } => {
+            if !(1..=MAX_RELAY_OUTPUT_VALUE_BYTES_V1).contains(max_bytes)
+                || !(1..=MAX_RELAY_OUTPUT_ARRAY_ITEMS_V1).contains(max_items)
+            {
+                return None;
+            }
+            validate_relay_output_schema(items, depth + 1, nodes)?
+                .checked_mul(usize::from(*max_items))
+                .and_then(|expanded| expanded.checked_add(1))
+        }
+        RelayOutputContract::Integer { .. } | RelayOutputContract::String { .. } => None,
+    }
+}
+
+fn valid_json_integer_bounds(minimum: i64, maximum: i64) -> bool {
+    const MAX_SAFE_INTEGER: i64 = (1_i64 << 53) - 1;
+    minimum <= maximum && minimum >= -MAX_SAFE_INTEGER && maximum <= MAX_SAFE_INTEGER
+}
+
+fn valid_relay_output_name(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= MAX_RELAY_OUTPUT_NAME_BYTES_V1
+        && !value.chars().any(char::is_control)
+}
+
 fn is_request_identifier_name(value: &str) -> bool {
     let mut bytes = value.bytes();
     matches!(bytes.next(), Some(b'A'..=b'Z' | b'a'..=b'z'))
diff --git a/crates/registry-notary-core/src/config/tests/relay.rs b/crates/registry-notary-core/src/config/tests/relay.rs
index 663c5e20ef..6a29c1f34f 100644
--- a/crates/registry-notary-core/src/config/tests/relay.rs
+++ b/crates/registry-notary-core/src/config/tests/relay.rs
@@ -65,6 +65,29 @@ fn valid_registry_backed_config() -> StandaloneRegistryNotaryConfig {
     config
 }
 
+fn registry_backed_config_with_output(
+    output_name: &str,
+    output: RelayOutputContract,
+) -> StandaloneRegistryNotaryConfig {
+    let mut config = valid_registry_backed_config();
+    let value_type = output.value_type().to_string();
+    let claim = &mut config.evidence.claims[0];
+    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
+        panic!("registry-backed mode")
+    };
+    consultations
+        .get_mut("person_status")
+        .expect("consultation exists")
+        .outputs = BTreeMap::from([(output_name.to_string(), output)]);
+    claim.rule = RuleConfig::ConsultationOutput {
+        consultation: "person_status".to_string(),
+        output: output_name.to_string(),
+    };
+    claim.value.value_type = value_type;
+    claim.value.nullable = true;
+    config
+}
+
 fn expect_mode_error(config: &StandaloneRegistryNotaryConfig, expected: &str) {
     let error = config
         .validate()
@@ -1212,14 +1235,61 @@ outputs:
   date_of_birth: { type: date, nullable: true }
   sequence: { type: integer, nullable: false, minimum: 0, maximum: 9007199254740991 }
   given_name: { type: string, nullable: true, max_bytes: 128 }
+  parents:
+    type: array
+    nullable: false
+    max_bytes: 4096
+    max_items: 2
+    items:
+      type: object
+      nullable: false
+      max_bytes: 2048
+      fields:
+        type:
+          required: true
+          schema: { type: string, nullable: false, max_bytes: 16 }
+        name:
+          required: true
+          schema: { type: string, nullable: false, max_bytes: 256 }
+        identifier:
+          required: false
+          schema: { type: string, nullable: true, max_bytes: 128 }
 "#,
     )
     .expect("authored typed consultation parses");
-    assert_eq!(consultation.outputs.len(), 4);
+    assert_eq!(consultation.outputs.len(), 5);
     assert!(matches!(
         consultation.outputs.get("date_of_birth"),
         Some(RelayOutputContract::Date { nullable: true })
     ));
+    let parents = consultation
+        .outputs
+        .get("parents")
+        .expect("parents contract exists");
+    let RelayOutputContract::Array {
+        nullable,
+        max_bytes,
+        max_items,
+        items,
+    } = parents
+    else {
+        panic!("parents is an array contract")
+    };
+    assert!(!nullable);
+    assert_eq!(*max_bytes, 4096);
+    assert_eq!(*max_items, 2);
+    assert!(matches!(
+        items.as_ref(),
+        RelayOutputContract::Object { fields, .. }
+            if !fields["identifier"].required
+                && matches!(
+                    fields["name"].schema.as_ref(),
+                    RelayOutputContract::String {
+                        nullable: false,
+                        max_bytes: 256
+                    }
+                )
+    ));
 
     assert!(serde_norway::from_str::<RelayConsultationConfig>(
         r#"
@@ -1233,3 +1303,336 @@ outputs:
     )
     .is_err());
 }
+
+#[test]
+fn recursive_output_contract_serde_is_closed_and_preserves_scalar_shapes() {
+    let wire = serde_json::json!({
+        "type": "object",
+        "nullable": true,
+        "max_bytes": 1024,
+        "fields": {
+            "active": {
+                "required": true,
+                "schema": { "type": "boolean", "nullable": false }
+            },
+            "children": {
+                "required": false,
+                "schema": {
+                    "type": "array",
+                    "nullable": true,
+                    "max_bytes": 512,
+                    "max_items": 4,
+                    "items": { "type": "integer", "nullable": false, "minimum": 0, "maximum": 9 }
+                }
+            }
+        }
+    });
+    let contract: RelayOutputContract =
+        serde_json::from_value(wire.clone()).expect("recursive contract parses");
+    assert_eq!(
+        serde_json::to_value(contract).expect("recursive contract serializes"),
+        wire
+    );
+
+    for invalid in [
+        serde_json::json!({
+            "type": "object",
+            "nullable": false,
+            "max_bytes": 64,
+            "fields": {},
+            "open": true
+        }),
+        serde_json::json!({
+            "type": "object",
+            "nullable": false,
+            "max_bytes": 64,
+            "fields": {
+                "value": {
+                    "required": true,
+                    "schema": { "type": "string", "nullable": false, "max_bytes": 8 },
+                    "default": "secret"
+                }
+            }
+        }),
+        serde_json::json!({
+            "type": "array",
+            "nullable": false,
+            "max_bytes": 64,
+            "max_items": 2,
+            "items": {
+                "type": "string",
+                "nullable": false,
+                "max_bytes": 8,
+                "pattern": ".*"
+            }
+        }),
+    ] {
+        serde_json::from_value::<RelayOutputContract>(invalid)
+            .expect_err("recursive contract variants must remain closed");
+    }
+}
+
+#[test]
+fn recursive_output_contract_validates_exact_values_and_composite_byte_bounds() {
+    let parent = RelayOutputContract::Object {
+        nullable: false,
+        max_bytes: 128,
+        fields: BTreeMap::from([
+            (
+                "birth_date".to_string(),
+                RelayOutputObjectFieldContract {
+                    required: false,
+                    schema: Box::new(RelayOutputContract::Date { nullable: false }),
+                },
+            ),
+            (
+                "name".to_string(),
+                RelayOutputObjectFieldContract {
+                    required: true,
+                    schema: Box::new(RelayOutputContract::String {
+                        nullable: false,
+                        max_bytes: 8,
+                    }),
+                },
+            ),
+            (
+                "sequence".to_string(),
+                RelayOutputObjectFieldContract {
+                    required: true,
+                    schema: Box::new(RelayOutputContract::Integer {
+                        nullable: false,
+                        minimum: 0,
+                        maximum: 2,
+                    }),
+                },
+            ),
+        ]),
+    };
+    let parents = RelayOutputContract::Array {
+        nullable: true,
+        max_bytes: 256,
+        max_items: 2,
+        items: Box::new(parent),
+    };
+
+    assert!(parents.validates_value(&serde_json::Value::Null));
+    assert!(parents.validates_value(&serde_json::json!([
+        { "name": "Ada", "sequence": 0, "birth_date": "2000-02-29" },
+        { "name": "Grace", "sequence": 2 }
+    ])));
+    for invalid in [
+        serde_json::json!({ "name": "Ada", "sequence": 0 }),
+        serde_json::json!([{ "sequence": 0 }]),
+        serde_json::json!([{ "name": "Ada", "sequence": 0, "unknown": true }]),
+        serde_json::json!([{ "name": "too-long-name", "sequence": 0 }]),
+        serde_json::json!([{ "name": "Ada", "sequence": 3 }]),
+        serde_json::json!([{ "name": "Ada", "sequence": 1.0 }]),
+        serde_json::json!([{ "name": "Ada", "sequence": 0, "birth_date": null }]),
+        serde_json::json!([{ "name": "Ada", "sequence": 0, "birth_date": "2001-02-29" }]),
+        serde_json::json!([
+            { "name": "Ada", "sequence": 0 },
+            { "name": "Grace", "sequence": 1 },
+            { "name": "Linus", "sequence": 2 }
+        ]),
+    ] {
+        assert!(
+            !parents.validates_value(&invalid),
+            "wrong type, shape, or bound must fail"
+        );
+    }
+
+    let byte_bounded = RelayOutputContract::Object {
+        nullable: false,
+        max_bytes: 8,
+        fields: BTreeMap::from([(
+            "a".to_string(),
+            RelayOutputObjectFieldContract {
+                required: true,
+                schema: Box::new(RelayOutputContract::String {
+                    nullable: false,
+                    max_bytes: 64,
+                }),
+            },
+        )]),
+    };
+    assert!(
+        !byte_bounded.validates_value(&serde_json::json!({ "a": "x" })),
+        "compact serialized object is nine bytes"
+    );
+
+    let nested_byte_bounded = RelayOutputContract::Object {
+        nullable: false,
+        max_bytes: 64,
+        fields: BTreeMap::from([(
+            "inner".to_string(),
+            RelayOutputObjectFieldContract {
+                required: true,
+                schema: Box::new(byte_bounded),
+            },
+        )]),
+    };
+    assert!(
+        !nested_byte_bounded.validates_value(&serde_json::json!({ "inner": { "a": "x" } })),
+        "every composite enforces its own serialized byte bound"
+    );
+}
+
+#[test]
+fn direct_consultation_output_accepts_object_and_array_claim_types_but_cel_stays_scalar() {
+    let parent_fields = BTreeMap::from([(
+        "name".to_string(),
+        RelayOutputObjectFieldContract {
+            required: true,
+            schema: Box::new(RelayOutputContract::String {
+                nullable: false,
+                max_bytes: 128,
+            }),
+        },
+    )]);
+    let object = RelayOutputContract::Object {
+        nullable: false,
+        max_bytes: 1024,
+        fields: parent_fields.clone(),
+    };
+    registry_backed_config_with_output("parent", object)
+        .validate()
+        .expect("direct object-valued consultation output validates");
+
+    let array = RelayOutputContract::Array {
+        nullable: false,
+        max_bytes: 4096,
+        max_items: 2,
+        items: Box::new(RelayOutputContract::Object {
+            nullable: false,
+            max_bytes: 1024,
+            fields: parent_fields,
+        }),
+    };
+    let config = registry_backed_config_with_output("parents", array);
+    config
+        .validate()
+        .expect("direct array-valued consultation output validates");
+
+    let mut wrong_claim_type = config.clone();
+    wrong_claim_type.evidence.claims[0].value.value_type = "object".to_string();
+    expect_mode_error(&wrong_claim_type, "must match its declared output");
+
+    let mut cel = config;
+    cel.evidence.claims[0].rule = RuleConfig::Cel {
+        expression: "true".to_string(),
+        bindings: CelBindingsConfig::default(),
+    };
+    cel.evidence.claims[0].value.value_type = "boolean".to_string();
+    cel.evidence.claims[0].value.nullable = false;
+    cel.validate()
+        .expect("a scalar CEL claim may share a consultation with direct composite outputs");
+}
+
+#[test]
+fn recursive_output_schema_enforces_envelope_compatible_platform_bounds() {
+    fn array_layers(depth: usize) -> RelayOutputContract {
+        if depth == 1 {
+            RelayOutputContract::Boolean { nullable: false }
+        } else {
+            RelayOutputContract::Array {
+                nullable: false,
+                max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
+                max_items: 1,
+                items: Box::new(array_layers(depth - 1)),
+            }
+        }
+    }
+
+    registry_backed_config_with_output("value", array_layers(6))
+        .validate()
+        .expect("six output-schema levels fit beneath the two-level Relay envelope");
+
+    for output in [
+        array_layers(7),
+        RelayOutputContract::Array {
+            nullable: false,
+            max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
+            max_items: MAX_RELAY_OUTPUT_ARRAY_ITEMS_V1 + 1,
+            items: Box::new(RelayOutputContract::Boolean { nullable: false }),
+        },
+        RelayOutputContract::Array {
+            nullable: false,
+            max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1 + 1,
+            max_items: 1,
+            items: Box::new(RelayOutputContract::Boolean { nullable: false }),
+        },
+        RelayOutputContract::Array {
+            nullable: false,
+            max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
+            max_items: 256,
+            items: Box::new(RelayOutputContract::Array {
+                nullable: false,
+                max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
+                max_items: 16,
+                items: Box::new(RelayOutputContract::Boolean { nullable: false }),
+            }),
+        },
+        RelayOutputContract::Object {
+            nullable: false,
+            max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
+            fields: (0..33)
+                .map(|index| {
+                    (
+                        format!("field_{index}"),
+                        RelayOutputObjectFieldContract {
+                            required: true,
+                            schema: Box::new(RelayOutputContract::Boolean { nullable: false }),
+                        },
+                    )
+                })
+                .collect(),
+        },
+        RelayOutputContract::Object {
+            nullable: false,
+            max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
+            fields: BTreeMap::from([(
+                "x".repeat(MAX_RELAY_OUTPUT_NAME_BYTES_V1 + 1),
+                RelayOutputObjectFieldContract {
+                    required: true,
+                    schema: Box::new(RelayOutputContract::Boolean { nullable: false }),
+                },
+            )]),
+        },
+        RelayOutputContract::Object {
+            nullable: false,
+            max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
+            fields: (0..8)
+                .map(|outer| {
+                    (
+                        format!("outer_{outer}"),
+                        RelayOutputObjectFieldContract {
+                            required: true,
+                            schema: Box::new(RelayOutputContract::Object {
+                                nullable: false,
+                                max_bytes: MAX_RELAY_OUTPUT_VALUE_BYTES_V1,
+                                fields: (0..32)
+                                    .map(|inner| {
+                                        (
+                                            format!("inner_{inner}"),
+                                            RelayOutputObjectFieldContract {
+                                                required: true,
+                                                schema: Box::new(RelayOutputContract::Boolean {
+                                                    nullable: false,
+                                                }),
+                                            },
+                                        )
+                                    })
+                                    .collect(),
+                            }),
+                        },
+                    )
+                })
+                .collect(),
+        },
+    ] {
+        expect_mode_error(
+            &registry_backed_config_with_output("value", output),
+            "consultation output schema",
+        );
+    }
+}
diff --git a/crates/registry-notary-core/src/model.rs b/crates/registry-notary-core/src/model.rs
index 2805e2071c..0604418d43 100644
--- a/crates/registry-notary-core/src/model.rs
+++ b/crates/registry-notary-core/src/model.rs
@@ -1377,7 +1377,7 @@ pub struct EvidenceFormat {
     pub status: String,
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Clone, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct ClaimResultView {
     pub evaluation_id: String,
@@ -1398,6 +1398,28 @@ pub struct ClaimResultView {
     pub provenance: ClaimProvenance,
 }
 
+impl std::fmt::Debug for ClaimResultView {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("ClaimResultView")
+            .field("evaluation_id", &"[REDACTED]")
+            .field("claim_id", &self.claim_id)
+            .field("claim_version", &self.claim_version)
+            .field("subject_type", &self.subject_type)
+            .field("requester_ref", &"[REDACTED]")
+            .field("target_ref", &"[REDACTED]")
+            .field("value", &"[REDACTED]")
+            .field("satisfied", &self.satisfied)
+            .field("disclosure", &self.disclosure)
+            .field("redacted_fields", &self.redacted_fields)
+            .field("format", &self.format)
+            .field("issued_at", &self.issued_at)
+            .field("expires_at", &self.expires_at)
+            .field("provenance", &self.provenance)
+            .finish()
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct TargetRefView {
@@ -1522,7 +1544,7 @@ pub struct ProvenanceUsed {
     pub relay_consultation_count: usize,
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Clone, Serialize, Deserialize)]
 pub struct StoredEvaluation {
     pub client_id: String,
     pub purpose: String,
@@ -1550,6 +1572,26 @@ pub struct StoredEvaluation {
     pub subject_access: Option<StoredSubjectAccessMetadata>,
 }
 
+impl std::fmt::Debug for StoredEvaluation {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("StoredEvaluation")
+            .field("client_id", &"[REDACTED]")
+            .field("purpose", &self.purpose)
+            .field("claim_ids", &self.claim_ids)
+            .field("claim_refs", &self.claim_refs)
+            .field("disclosure", &self.disclosure)
+            .field("format", &self.format)
+            .field("result_count", &self.results.len())
+            .field("created_at", &self.created_at)
+            .field("expires_at", &self.expires_at)
+            .field("request_hash", &"[REDACTED]")
+            .field("issuance_provenance", &self.issuance_provenance)
+            .field("subject_access", &self.subject_access)
+            .finish()
+    }
+}
+
 impl StoredEvaluation {
     #[must_use]
     pub fn access_mode(&self) -> AccessMode {
@@ -1588,6 +1630,13 @@ pub struct StoredIssuanceProvenance {
     /// record. A missing empty legacy field is readable but nonissuable.
     #[serde(default)]
     pub consultations: Vec<StoredIssuanceConsultationProvenance>,
+    /// Keyed commitment joining the complete opaque evaluated target reference
+    /// to the target's canonical primary authorization identity. The
+    /// commitment permits a later RAR comparison without retaining the raw
+    /// identity. Evaluations stored before this field existed remain readable,
+    /// but cannot initiate a registry-client credential offer.
+    #[serde(default)]
+    pub authorization_target_binding: String,
 }
 
 impl std::fmt::Debug for StoredIssuanceProvenance {
@@ -1617,6 +1666,11 @@ pub struct StoredIssuanceClaimProvenance {
     /// credential-issuable.
     #[serde(default)]
     pub execution_binding: String,
+    /// Canonical commitment to the exact evaluated result retained for
+    /// issuance. The value itself is deliberately not duplicated into this
+    /// restricted provenance record.
+    #[serde(default)]
+    pub result_content_binding: String,
 }
 
 impl std::fmt::Debug for StoredIssuanceClaimProvenance {
@@ -1630,6 +1684,7 @@ impl std::fmt::Debug for StoredIssuanceClaimProvenance {
             .field("canonical_purpose", &self.canonical_purpose)
             .field("consultation_id", &"[REDACTED]")
             .field("execution_binding", &self.execution_binding)
+            .field("result_content_binding", &self.result_content_binding)
             .finish()
     }
 }
@@ -2054,6 +2109,27 @@ mod tests {
         assert_eq!(versioned.version.as_deref(), Some("2026-05"));
     }
 
+    #[test]
+    fn private_issuance_target_binding_is_backward_readable_and_debug_redacted() {
+        let legacy: StoredIssuanceProvenance = serde_json::from_value(json!({
+            "claims": [],
+            "consultations": [],
+        }))
+        .expect("legacy private provenance remains readable");
+        assert!(legacy.authorization_target_binding.is_empty());
+
+        let stored = StoredIssuanceProvenance {
+            claims: Vec::new(),
+            consultations: Vec::new(),
+            authorization_target_binding:
+                "hmac-sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+                    .to_string(),
+        };
+        let debug = format!("{stored:?}");
+        assert!(!debug.contains("hmac-sha256"));
+        assert!(!debug.contains("aaaaaaaa"));
+    }
+
     #[test]
     fn evaluate_request_deserializes_identity_bundle_target() {
         let request: EvaluateRequest = serde_json::from_value(json!({
diff --git a/crates/registry-notary-server/src/api.rs b/crates/registry-notary-server/src/api.rs
index fb0e1eb0ec..9b75144453 100644
--- a/crates/registry-notary-server/src/api.rs
+++ b/crates/registry-notary-server/src/api.rs
@@ -57,17 +57,18 @@ use registry_notary_core::tokens::{
 use registry_notary_core::RegistryNotaryCelConfig;
 use registry_notary_core::{
     signing_key_uses_local_software_custody, AccessMode, BatchEvaluateItemRequest,
-    BatchEvaluateRequest, BoundedClaimId, BoundedCorrelationId, ClaimRef, ClaimResultView,
-    ClaimSet, ConfigMetadata, CredentialIssueRequest, CredentialProfileConfig, DeploymentProfile,
-    EvaluateRequest, EvaluationCapability, EvidenceActor, EvidenceAuditEvent,
-    EvidenceBatchItemAuditEvent, EvidenceConfig, EvidenceEntity, EvidenceEntityReference,
-    EvidenceError, EvidenceOnBehalfOf, EvidencePrincipal, EvidenceRelationship, FederationConfig,
-    Hashed, HolderRequest, Oid4vciConfig, Oid4vciCredentialClaimMode,
-    Oid4vciCredentialConfigurationConfig, Oid4vciDisplayImageConfig, Oid4vciIssuerDisplayConfig,
-    PolicyIdentifier, RateLimitBucket, RegistryNotaryAdminListenerMode, RenderEvaluationRequest,
-    StandaloneRegistryNotaryConfig, StoredSubjectAccessMetadata, SubjectAccessConfig,
-    SubjectAccessDelegatedRelationshipConfig, SubjectAccessDenialCode, SubjectAccessScopePolicy,
-    SubjectRequest, VerifiedClaimValue, FORMAT_CLAIM_RESULT_JSON, FORMAT_SD_JWT_VC,
+    BatchEvaluateRequest, BoundedClaimId, BoundedCorrelationId, ClaimEvidenceMode, ClaimRef,
+    ClaimResultView, ClaimSet, ConfigMetadata, CredentialIssueRequest, CredentialProfileConfig,
+    DeploymentProfile, DisclosureProfile, EvaluateRequest, EvaluationCapability, EvidenceActor,
+    EvidenceAuditEvent, EvidenceBatchItemAuditEvent, EvidenceConfig, EvidenceEntity,
+    EvidenceEntityReference, EvidenceError, EvidenceOnBehalfOf, EvidencePrincipal,
+    EvidenceRelationship, FederationConfig, Hashed, HolderRequest, Oid4vciConfig,
+    Oid4vciCredentialClaimMode, Oid4vciCredentialConfigurationConfig, Oid4vciDisplayImageConfig,
+    Oid4vciIssuerDisplayConfig, PolicyIdentifier, RateLimitBucket, RegistryNotaryAdminListenerMode,
+    RenderEvaluationRequest, RuleConfig, StandaloneRegistryNotaryConfig,
+    StoredSubjectAccessMetadata, SubjectAccessConfig, SubjectAccessDelegatedRelationshipConfig,
+    SubjectAccessDenialCode, SubjectAccessScopePolicy, SubjectRequest, TargetRefView,
+    VerifiedClaimValue, FORMAT_CLAIM_RESULT_JSON, FORMAT_SD_JWT_VC,
 };
 use registry_platform_audit::AuditKeyHasher;
 use registry_platform_crypto::KeyReadiness;
@@ -90,7 +91,7 @@ use registry_platform_pdp::{
 };
 use registry_platform_replay::{ReplayKey, ReplayScope, RequiredReplayError};
 use registry_platform_sdjwt::{validate_holder_proof, HolderProofBindings, HolderProofPolicy};
-use serde::Deserialize;
+use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
 use sha2::{Digest, Sha256};
 use time::format_description::well_known::Rfc3339;
@@ -106,15 +107,20 @@ use crate::{
         CredentialStatusStore, CredentialStatusStoreError,
     },
     format_time,
+    machine_quota::{MachineQuotaOperationOutcome, OPERATION_LEASE_SECONDS},
     metrics::AppMetrics,
     openapi_document,
     posture::{posture_document, PostureContext, PostureDocumentError},
     preauth_state::{
-        CredentialMaterialization, IssuanceTransaction, LoginState, PreauthorizationStateError,
+        CredentialMaterialization, IssuanceAuthority, IssuanceTransaction, LoginState,
+        PreauthorizationStateError, RegistryClientOfferPreflightOutcome,
+        RegistryClientOfferReservation, RegistryClientOfferReservationOutcome,
+        RegistryClientOfferResponse, RegistryClientTransactionCode,
     },
     replay::{require_replay_insert, ReplayReadiness, ReplayStores},
     runtime::{
-        build_claim_levels, claim_ids, claim_semantics_metadata, requested_claim_versions,
+        build_claim_levels, claim_ids, claim_semantics_metadata,
+        issuance_authorization_target_binding, requested_claim_versions,
         require_issuable_evaluation_provenance, require_registry_backed_credential_claims,
         validate_batch_subject_limit, EvaluationAuditSnapshot,
     },
@@ -138,6 +144,7 @@ const IDEMPOTENCY_KEY_HEADER: &str = "idempotency-key";
 pub(crate) const ADMIN_SCOPE: &str = "registry_notary:admin";
 pub(crate) const METRICS_SCOPE: &str = "registry_notary:metrics_read";
 pub(crate) const OPS_READ_SCOPE: &str = "registry_notary:ops_read";
+pub(crate) const REGISTRY_OFFER_CREATE_SCOPE: &str = "registry_notary:credential_offer_create";
 const OID4VCI_CREDENTIAL_PATH: &str = "/oid4vci/credential";
 // SD-JWT VC Type Metadata well-known prefix inserted between host and vct path.
 const WELL_KNOWN_VCT_PREFIX: &str = "/.well-known/vct";
@@ -185,6 +192,7 @@ where
         )
         .route("/oid4vci/offer/start", get(oid4vci_offer_start))
         .route("/oid4vci/offer/callback", get(oid4vci_offer_callback))
+        .route("/oid4vci/offers", post(oid4vci_create_registry_offer))
         .route("/oid4vci/token", post(oid4vci_token))
         .route("/oid4vci/credential", post(oid4vci_credential))
         .route("/v1/claims", get(list_claims))
diff --git a/crates/registry-notary-server/src/api/attestation_policy.rs b/crates/registry-notary-server/src/api/attestation_policy.rs
index 3c4d4d8ce6..a569d65258 100644
--- a/crates/registry-notary-server/src/api/attestation_policy.rs
+++ b/crates/registry-notary-server/src/api/attestation_policy.rs
@@ -36,6 +36,26 @@ pub(super) fn classify_subject_access_principal(
         return Ok(principal.clone());
     }
 
+    // A locally verified transaction-scoped token minted from a
+    // registry-client offer remains machine authority. Its opaque `sub` lets
+    // the wallet present the token, but must never reclassify the wallet as the
+    // civil subject. The encrypted issuance transaction is the authority.
+    if principal.auth_profile_id == registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken
+        && principal.verified_claims.is_some()
+        && principal
+            .authorization_details
+            .as_ref()
+            .is_some_and(|details| {
+                details.access_mode == Some(AccessMode::MachineClient)
+                    && details.actions.as_slice() == ["issue_credential"]
+                    && crate::authz_details::has_transaction_scope(details)
+            })
+    {
+        let mut classified = principal.clone();
+        classified.access_mode = AccessMode::MachineClient;
+        return Ok(classified);
+    }
+
     let citizen_scope_signal = config
         .required_scopes
         .iter()
diff --git a/crates/registry-notary-server/src/api/audit.rs b/crates/registry-notary-server/src/api/audit.rs
index 4a68d153b6..35bea7d087 100644
--- a/crates/registry-notary-server/src/api/audit.rs
+++ b/crates/registry-notary-server/src/api/audit.rs
@@ -550,6 +550,47 @@ pub(super) fn attach_subject_access_credential_audit(
     Ok(())
 }
 
+#[allow(clippy::too_many_arguments)]
+pub(super) fn attach_registry_client_offer_audit(
+    response: &mut Response,
+    keys: &SubjectAccessRateLimitKeys,
+    decision: &str,
+    evaluation_id: &str,
+    evaluation: &registry_notary_core::StoredEvaluation,
+    credential_configuration_id: &str,
+    profile_id: &str,
+    holder_binding_mode: &str,
+    target_ref: &TargetRefView,
+) -> Result<(), EvidenceError> {
+    let target_ref_hash = hash_audit_handle(
+        keys,
+        "target",
+        target_ref.entity_type.as_str(),
+        Some(evaluation.purpose.as_str()),
+        &target_ref.handle,
+    )?;
+    response.extensions_mut().insert(EvidenceAuditContext {
+        verification_id: Some(evaluation_id.to_string()),
+        verification_decision: Some(decision.to_string()),
+        claim_hash: (!evaluation.claim_ids.is_empty())
+            .then(|| evidence_claim_hash(&evaluation.claim_ids)),
+        purposes: Some(vec![evaluation.purpose.clone()]),
+        row_count: Some(evaluation.results.len() as u64),
+        relay_consultation_count: Some(0),
+        forwarded: Some(false),
+        access_mode: Some(AccessMode::MachineClient),
+        credential_profile: ConfigMetadata::new(profile_id).ok(),
+        protocol: ConfigMetadata::new("openid4vci").ok(),
+        credential_configuration_id: ConfigMetadata::new(credential_configuration_id).ok(),
+        holder_binding_mode: ConfigMetadata::new(holder_binding_mode).ok(),
+        target_type: Some(target_ref.entity_type.clone())
+            .filter(|entity_type| !entity_type.is_empty()),
+        target_ref_hash: Some(target_ref_hash),
+        ..EvidenceAuditContext::default()
+    });
+    Ok(())
+}
+
 pub(super) fn attach_subject_access_success_audit(
     response: &mut Response,
     decision: &str,
diff --git a/crates/registry-notary-server/src/api/credentials.rs b/crates/registry-notary-server/src/api/credentials.rs
index 44bdf52e91..043367b456 100644
--- a/crates/registry-notary-server/src/api/credentials.rs
+++ b/crates/registry-notary-server/src/api/credentials.rs
@@ -423,6 +423,48 @@ pub(super) async fn issue_credential(
         }
         state.metrics.record_replay("holder_proof", "accepted");
     }
+    if !principal.is_subject_access() {
+        if let Some(preauth) = preauth_runtime(&state) {
+            let evaluation_expires_at =
+                match OffsetDateTime::parse(&evaluation.expires_at, &Rfc3339) {
+                    Ok(expires_at) if expires_at > OffsetDateTime::now_utc() => expires_at,
+                    _ => {
+                        return credential_denial_response_for_evaluation(
+                            &state,
+                            EvidenceError::EvaluationNotFound,
+                            &request.evaluation_id,
+                            &evaluation,
+                            &principal,
+                            Some((profile_id, profile)),
+                        )
+                    }
+                };
+            if let Err(error) = preauth
+                .preauthorization_state()
+                .reserve_evaluation_issuance(
+                    &request.evaluation_id,
+                    &evaluation.client_id,
+                    evaluation_expires_at,
+                )
+                .await
+            {
+                let error = match error {
+                    PreauthorizationStateError::EvaluationConsumed => {
+                        EvidenceError::EvidenceNotAvailable
+                    }
+                    _ => EvidenceError::CredentialIssuanceFailed,
+                };
+                return credential_denial_response_for_evaluation(
+                    &state,
+                    error,
+                    &request.evaluation_id,
+                    &evaluation,
+                    &principal,
+                    Some((profile_id, profile)),
+                );
+            }
+        }
+    }
     let credential_id = state
         .credential_status
         .is_enabled()
diff --git a/crates/registry-notary-server/src/api/oid4vci/credential.rs b/crates/registry-notary-server/src/api/oid4vci/credential.rs
index 1009338042..452a790c2f 100644
--- a/crates/registry-notary-server/src/api/oid4vci/credential.rs
+++ b/crates/registry-notary-server/src/api/oid4vci/credential.rs
@@ -3,6 +3,9 @@
 
 use super::super::*;
 
+const CREDENTIAL_SIGNING_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(25);
+const CREDENTIAL_COMPLETION_MARGIN: time::Duration = time::Duration::seconds(5);
+
 pub(in crate::api) async fn oid4vci_credential(
     state: Option<Extension<Arc<RegistryNotaryApiState>>>,
     principal: Option<Extension<EvidencePrincipal>>,
@@ -26,7 +29,14 @@ pub(in crate::api) async fn oid4vci_credential(
         return StatusCode::NOT_FOUND.into_response();
     };
     let principal = match classify_subject_access_principal(&state.subject_access, &principal) {
-        Ok(principal) if principal.is_subject_access() => principal,
+        Ok(principal)
+            if principal.is_subject_access()
+                || (principal.access_mode() == AccessMode::MachineClient
+                    && principal.auth_profile_id
+                        == registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken) =>
+        {
+            principal
+        }
         _ => return oid4vci_error_response(Oid4vciWireError::InvalidToken),
     };
     if let Err(error) = require_oid4vci_token_audience(&state.oid4vci, &principal) {
@@ -71,28 +81,30 @@ pub(in crate::api) async fn oid4vci_credential(
         );
         return response;
     }
-    if let Err(error) = require_oid4vci_issuance_authorization_details(
-        evidence,
-        &state.subject_access,
-        configuration,
-        &principal,
-        oid4vci_requires_authorization_details(
+    if principal.is_subject_access() {
+        if let Err(error) = require_oid4vci_issuance_authorization_details(
+            evidence,
+            &state.subject_access,
+            configuration,
             &principal,
-            state.runtime_config().as_deref(),
-            Some(preauth.as_ref()),
-        ),
-    ) {
-        let denial_code = denial_code_from_error(&error);
-        let mut response = oid4vci_error_response(oid4vci_error_from_evidence(&error));
-        attach_oid4vci_subject_access_denial_audit(
-            &mut response,
-            "oid4vci_credential_denied",
-            &configuration_claim_ids,
-            configuration_id,
-            denial_code,
-            Some(state.subject_access.subject_binding.token_claim.as_str()),
-        );
-        return response;
+            oid4vci_requires_authorization_details(
+                &principal,
+                state.runtime_config().as_deref(),
+                Some(preauth.as_ref()),
+            ),
+        ) {
+            let denial_code = denial_code_from_error(&error);
+            let mut response = oid4vci_error_response(oid4vci_error_from_evidence(&error));
+            attach_oid4vci_subject_access_denial_audit(
+                &mut response,
+                "oid4vci_credential_denied",
+                &configuration_claim_ids,
+                configuration_id,
+                denial_code,
+                Some(state.subject_access.subject_binding.token_claim.as_str()),
+            );
+            return response;
+        }
     }
     let Some(claims) = principal.verified_claims.as_ref() else {
         return oid4vci_error_response(Oid4vciWireError::InvalidToken);
@@ -148,7 +160,7 @@ pub(in crate::api) async fn oid4vci_credential(
                 .transaction(transaction_id)
                 .await
             {
-                Ok(Some(transaction)) => transaction,
+                Ok(Some(live)) => live.transaction,
                 _ => return oid4vci_error_response(Oid4vciWireError::ServerError),
             };
             let evaluation = match state
@@ -203,6 +215,9 @@ pub(in crate::api) async fn oid4vci_credential(
     let (response_body, evaluation) = match materialized {
         Ok(materialized) => materialized,
         Err(error) => {
+            // Materialization failures are terminal in both state backends.
+            // Resetting after an ambiguous signer or persistence failure could
+            // produce a second credential for the same transaction.
             let _ = preauth
                 .preauthorization_state()
                 .fail_credential_materialization(transaction_id, &holder_thumbprint)
@@ -281,6 +296,7 @@ pub(in crate::api) fn oid4vci_credential_response_with_audit(
     {
         return Err(Oid4vciWireError::ServerError);
     }
+    override_attestation_audit_access_mode(&mut response, evaluation.access_mode());
     Ok(response)
 }
 
@@ -305,29 +321,6 @@ async fn materialize_oid4vci_transaction(
         transaction,
         nonce,
     } = materialization;
-    let key = state
-        .subject_access_rate_keys
-        .oid4vci_nonce(&state.oid4vci.credential_issuer, configuration_id, nonce)
-        .map_err(|_| Oid4vciWireError::ServerError)?;
-    let replay_scope = oid4vci_nonce_replay_scope(state, configuration_id)?;
-    let replay_key = ReplayKey::new(key).map_err(|_| Oid4vciWireError::ServerError)?;
-    consume_validated_proof_nonce_once(
-        validated_proof,
-        nonce,
-        state.replay.nonce_store().as_ref(),
-        &replay_scope,
-        &replay_key,
-    )
-    .await
-    .map_err(|_| Oid4vciWireError::InvalidProof)?;
-    state.metrics.record_replay("oid4vci_nonce", "consumed");
-    check_oid4vci_subject_access_rate_limit(
-        state,
-        principal,
-        Some(validated_proof.holder_id.as_str()),
-    )
-    .await
-    .map_err(|_| Oid4vciWireError::RateLimited)?;
     let evaluation = state
         .store
         .get(
@@ -337,47 +330,186 @@ async fn materialize_oid4vci_transaction(
         .await
         .map_err(|_| Oid4vciWireError::ServerError)?
         .ok_or(Oid4vciWireError::AccessDenied)?;
-    if evaluation.claim_ids != configuration.credential_claim_ids() {
+    let configuration_claim_ids = configuration.credential_claim_ids();
+    let configuration_claim_refs = oid4vci_credential_claim_refs(configuration);
+    let result_claim_ids = evaluation
+        .results
+        .iter()
+        .map(|result| result.claim_id.clone())
+        .collect::<Vec<_>>();
+    if !crate::authz_details::exact_unique_string_set(
+        &evaluation.claim_ids,
+        &configuration_claim_ids,
+    ) || !crate::authz_details::exact_unique_string_set(
+        &result_claim_ids,
+        &configuration_claim_ids,
+    ) || !crate::authz_details::exact_unique_claim_ref_set(
+        &evaluation.selected_claim_refs(),
+        &configuration_claim_refs,
+    ) {
         return Err(Oid4vciWireError::AccessDenied);
     }
-    require_oid4vci_transaction_stored_access(
-        state,
-        evidence,
-        principal,
-        &evaluation,
-        &evaluation.claim_ids,
-        &evaluation.disclosure,
-        &evaluation.format,
-    )
-    .map_err(|error| oid4vci_error_from_evidence(&error))?;
     let profile = evidence
         .credential_profiles
         .get(&configuration.credential_profile)
         .ok_or(Oid4vciWireError::UnsupportedCredentialType)?;
-    require_subject_access_credential_profile_policy(
-        &state.subject_access,
-        &configuration.credential_profile,
-        profile,
-    )
-    .map_err(|error| oid4vci_error_from_evidence(&error))?;
+    match &transaction.authority {
+        IssuanceAuthority::SubjectAccess if principal.is_subject_access() => {
+            require_oid4vci_transaction_stored_access(
+                state,
+                evidence,
+                principal,
+                &evaluation,
+                &evaluation.claim_ids,
+                &evaluation.disclosure,
+                &evaluation.format,
+            )
+            .map_err(|error| oid4vci_error_from_evidence(&error))?;
+            require_subject_access_credential_profile_policy(
+                &state.subject_access,
+                &configuration.credential_profile,
+                profile,
+            )
+            .map_err(|error| oid4vci_error_from_evidence(&error))?;
+        }
+        IssuanceAuthority::RegistryClient {
+            initiating_client_id,
+            initiating_client_id_hash,
+            auth_profile_id,
+            authorized_scopes,
+            target_ref,
+            service_id,
+            purpose,
+        } if principal.access_mode() == AccessMode::MachineClient
+            && principal.auth_profile_id
+                == registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken =>
+        {
+            let recomputed_client_hash = state
+                .subject_access_rate_keys
+                .principal(initiating_client_id)
+                .map_err(|_| Oid4vciWireError::ServerError)?;
+            if recomputed_client_hash.as_str() != initiating_client_id_hash
+                || transaction.evaluation_client_id != *initiating_client_id
+                || *auth_profile_id
+                    == registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken
+                || service_id != &evidence.service_id
+                || purpose != &evaluation.purpose
+                || evaluation.subject_access.is_some()
+                || evaluation.access_mode() != AccessMode::MachineClient
+                || evaluation.client_id != *initiating_client_id
+                || evaluation.disclosure != DisclosureProfile::Value.as_str()
+                || evaluation.format != FORMAT_CLAIM_RESULT_JSON
+                || !authorized_scopes
+                    .iter()
+                    .any(|scope| scope == REGISTRY_OFFER_CREATE_SCOPE)
+                || !authorized_scopes
+                    .iter()
+                    .any(|scope| scope == &configuration.scope)
+                || evaluation.results.is_empty()
+                || evaluation.results.iter().any(|result| {
+                    !same_target_ref(&result.target_ref, target_ref)
+                        || result.value.as_ref().is_none_or(Value::is_null)
+                        || result.satisfied == Some(false)
+                        || !result.redacted_fields.is_empty()
+                })
+                || !OffsetDateTime::parse(&evaluation.expires_at, &Rfc3339)
+                    .is_ok_and(|expires_at| expires_at > OffsetDateTime::now_utc())
+            {
+                return Err(Oid4vciWireError::AccessDenied);
+            }
+            let registry_principal = EvidencePrincipal {
+                auth_profile_id: *auth_profile_id,
+                principal_id: initiating_client_id.clone(),
+                scopes: authorized_scopes.clone(),
+                access_mode: AccessMode::MachineClient,
+                verified_claims: None,
+                authorization_details: None,
+            };
+            require_evaluation_access(evidence, &registry_principal, &evaluation)
+                .map_err(|error| oid4vci_error_from_evidence(&error))?;
+            require_oid4vci_registry_client_authorization_details(
+                evidence,
+                configuration,
+                purpose,
+                principal,
+            )
+            .map_err(|error| oid4vci_error_from_evidence(&error))?;
+        }
+        IssuanceAuthority::SubjectAccess | IssuanceAuthority::RegistryClient { .. } => {
+            return Err(Oid4vciWireError::AccessDenied);
+        }
+    }
     require_issuable_evaluation_provenance(evidence, &transaction.evaluation_id, &evaluation)
         .map_err(|error| oid4vci_error_from_evidence(&error))?;
     let configuration_fingerprint =
         oid4vci_configuration_fingerprint(evidence, configuration_id, configuration)
             .map_err(|_| Oid4vciWireError::ServerError)?;
-    let commitment = oid4vci_issuance_transaction_commitment(
-        &transaction.transaction_id,
-        evidence,
-        configuration_id,
-        configuration,
-        &configuration_fingerprint,
-        &transaction.evaluation_id,
-        &evaluation,
-    )
+    let commitment = match &transaction.authority {
+        IssuanceAuthority::SubjectAccess => oid4vci_issuance_transaction_commitment(
+            &transaction.transaction_id,
+            evidence,
+            configuration_id,
+            configuration,
+            &configuration_fingerprint,
+            &transaction.evaluation_id,
+            &evaluation,
+        ),
+        IssuanceAuthority::RegistryClient {
+            initiating_client_id_hash,
+            auth_profile_id,
+            authorized_scopes,
+            target_ref,
+            ..
+        } => oid4vci_registry_client_transaction_commitment(
+            &transaction.transaction_id,
+            evidence,
+            configuration_id,
+            configuration,
+            &configuration_fingerprint,
+            &transaction.evaluation_id,
+            &evaluation,
+            initiating_client_id_hash,
+            *auth_profile_id,
+            authorized_scopes,
+            target_ref,
+        ),
+    }
     .map_err(|_| Oid4vciWireError::ServerError)?;
     if commitment != transaction.commitment {
         return Err(Oid4vciWireError::AccessDenied);
     }
+    let iat = earliest_issued_at(&evaluation.results).unwrap_or_else(OffsetDateTime::now_utc);
+    let expires_at = iat
+        .checked_add(time::Duration::seconds(profile.validity_seconds))
+        .ok_or(Oid4vciWireError::ServerError)?;
+    if expires_at <= OffsetDateTime::now_utc() {
+        return Err(Oid4vciWireError::AccessDenied);
+    }
+    let key = state
+        .subject_access_rate_keys
+        .oid4vci_nonce(&state.oid4vci.credential_issuer, configuration_id, nonce)
+        .map_err(|_| Oid4vciWireError::ServerError)?;
+    let replay_scope = oid4vci_nonce_replay_scope(state, configuration_id)?;
+    let replay_key = ReplayKey::new(key).map_err(|_| Oid4vciWireError::ServerError)?;
+    consume_validated_proof_nonce_once(
+        validated_proof,
+        nonce,
+        state.replay.nonce_store().as_ref(),
+        &replay_scope,
+        &replay_key,
+    )
+    .await
+    .map_err(|_| Oid4vciWireError::InvalidProof)?;
+    state.metrics.record_replay("oid4vci_nonce", "consumed");
+    if principal.is_subject_access() {
+        check_oid4vci_subject_access_rate_limit(
+            state,
+            principal,
+            Some(validated_proof.holder_id.as_str()),
+        )
+        .await
+        .map_err(|_| Oid4vciWireError::RateLimited)?;
+    }
     let issuer = state
         .issuer_resolver()
         .issuer(&configuration.credential_profile)
@@ -386,7 +518,6 @@ async fn materialize_oid4vci_transaction(
         return Err(Oid4vciWireError::InvalidProof);
     }
     let holder_id = validated_proof.holder_id.as_str();
-    let iat = earliest_issued_at(&evaluation.results).unwrap_or_else(OffsetDateTime::now_utc);
     let credential_id = state
         .credential_status
         .is_enabled()
@@ -394,24 +525,36 @@ async fn materialize_oid4vci_transaction(
     let status_claim = credential_id
         .as_deref()
         .and_then(|credential_id| state.credential_status.status_claim(credential_id));
-    let signed = sd_jwt::issue(
-        profile,
-        &issuer,
-        &evaluation.results,
-        holder_id,
-        Some(holder_id),
-        iat,
-        sd_jwt::IssueOptions {
-            credential_id,
-            status: status_claim,
-            projection: oid4vci_sd_jwt_projection(configuration),
-        },
+    let signing_budget = std::time::Duration::try_from(
+        expires_at - OffsetDateTime::now_utc() - CREDENTIAL_COMPLETION_MARGIN,
+    )
+    .map_err(|_| Oid4vciWireError::AccessDenied)?
+    .min(CREDENTIAL_SIGNING_TIMEOUT);
+    if signing_budget.is_zero() {
+        return Err(Oid4vciWireError::AccessDenied);
+    }
+    let signed = tokio::time::timeout(
+        signing_budget,
+        sd_jwt::issue(
+            profile,
+            &issuer,
+            &evaluation.results,
+            holder_id,
+            Some(holder_id),
+            iat,
+            sd_jwt::IssueOptions {
+                credential_id,
+                status: status_claim,
+                projection: oid4vci_sd_jwt_projection(configuration),
+            },
+        ),
     )
     .await
+    .map_err(|_| Oid4vciWireError::AccessDenied)?
     .map_err(|_| Oid4vciWireError::ServerError)?;
-    let expires_at = iat
-        .checked_add(time::Duration::seconds(profile.validity_seconds))
-        .ok_or(Oid4vciWireError::ServerError)?;
+    if expires_at <= OffsetDateTime::now_utc() + CREDENTIAL_COMPLETION_MARGIN {
+        return Err(Oid4vciWireError::AccessDenied);
+    }
     if state.credential_status.is_enabled() {
         state
             .credential_status
@@ -565,6 +708,57 @@ pub(in crate::api) fn oid4vci_issuance_authorization_details(
     })
 }
 
+pub(in crate::api) fn oid4vci_registry_client_authorization_details(
+    evidence: &EvidenceConfig,
+    configuration: &Oid4vciCredentialConfigurationConfig,
+    purpose: &str,
+) -> registry_notary_core::EvidenceAuthorizationDetails {
+    registry_notary_core::EvidenceAuthorizationDetails {
+        detail_type: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE.to_string(),
+        schema_version: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION
+            .to_string(),
+        actions: vec!["issue_credential".to_string()],
+        locations: vec![evidence.service_id.clone()],
+        claims: oid4vci_credential_claim_refs(configuration),
+        disclosure: Some(DisclosureProfile::Value.as_str().to_string()),
+        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
+        purpose: Some(purpose.to_string()),
+        access_mode: Some(AccessMode::MachineClient),
+        ..Default::default()
+    }
+}
+
+pub(in crate::api) fn require_oid4vci_registry_client_authorization_details(
+    evidence: &EvidenceConfig,
+    configuration: &Oid4vciCredentialConfigurationConfig,
+    purpose: &str,
+    principal: &EvidencePrincipal,
+) -> Result<(), EvidenceError> {
+    let details = principal
+        .authorization_details
+        .as_ref()
+        .filter(|details| crate::authz_details::has_transaction_scope(details))
+        .ok_or(EvidenceError::EvaluationBindingMismatch)?;
+    let claims = oid4vci_credential_claim_refs(configuration);
+    crate::authz_details::validate_scoped_authorization_details(
+        details,
+        &crate::authz_details::ScopedAuthorizationRequest {
+            service_id: evidence.service_id.as_str(),
+            action: "issue_credential",
+            claims: &claims,
+            disclosure: DisclosureProfile::Value.as_str(),
+            format: FORMAT_CLAIM_RESULT_JSON,
+            purpose,
+            access_mode: AccessMode::MachineClient,
+            subject: None,
+            target: None,
+            allow_subset_claims: false,
+            allowed_claims: None,
+        },
+    )
+    .map_err(|_| EvidenceError::EvaluationBindingMismatch)
+}
+
 pub(in crate::api) fn require_oid4vci_issuance_authorization_details(
     evidence: &EvidenceConfig,
     config: &SubjectAccessConfig,
diff --git a/crates/registry-notary-server/src/api/oid4vci/metadata.rs b/crates/registry-notary-server/src/api/oid4vci/metadata.rs
index 81bf1a3b2b..f5ae3ebdcf 100644
--- a/crates/registry-notary-server/src/api/oid4vci/metadata.rs
+++ b/crates/registry-notary-server/src/api/oid4vci/metadata.rs
@@ -267,6 +267,31 @@ pub(in crate::api) fn oid4vci_type_metadata_claim(
     {
         claim["registry_notary_semantics"] = semantics;
     }
+    if let Some(value_schema) = evidence
+        .claims
+        .iter()
+        .find(|definition| definition.id == claim_id)
+        .and_then(
+            |definition| match (&definition.evidence_mode, &definition.rule) {
+                (
+                    ClaimEvidenceMode::RegistryBacked { consultations },
+                    RuleConfig::ConsultationOutput {
+                        consultation,
+                        output,
+                    },
+                ) => consultations
+                    .get(consultation)
+                    .and_then(|consultation| consultation.outputs.get(output)),
+                _ => None,
+            },
+        )
+        .and_then(|schema| serde_json::to_value(schema).ok())
+    {
+        // SD-JWT VC Type Metadata intentionally has no standard JSON Schema
+        // member. This namespaced extension publishes the exact compiler-pinned
+        // closed Relay value shape without suggesting nested disclosure.
+        claim["registry_notary_value_schema"] = value_schema;
+    }
     claim
 }
 
diff --git a/crates/registry-notary-server/src/api/oid4vci/preauth.rs b/crates/registry-notary-server/src/api/oid4vci/preauth.rs
index 3d2efe3f0b..7e26bd9a31 100644
--- a/crates/registry-notary-server/src/api/oid4vci/preauth.rs
+++ b/crates/registry-notary-server/src/api/oid4vci/preauth.rs
@@ -3,11 +3,958 @@
 
 use super::super::*;
 
+const REGISTRY_OFFER_SIGNER_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(25);
+const REGISTRY_OFFER_LEASE_RENEWAL_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(5);
+const REGISTRY_OFFER_FINAL_RESERVATION_TIMEOUT: std::time::Duration =
+    std::time::Duration::from_secs(45);
+const REGISTRY_OFFER_OPERATION_POLL_INTERVAL: std::time::Duration =
+    std::time::Duration::from_millis(250);
+const REGISTRY_OFFER_OPERATION_MAX_POLL_INTERVAL: std::time::Duration =
+    std::time::Duration::from_secs(2);
+const REGISTRY_OFFER_OPERATION_WAIT: std::time::Duration = std::time::Duration::from_secs(20);
+pub(in crate::api) const REGISTRY_OFFER_OPERATION_RETRY_AFTER_SECONDS: &str = "5";
+const _: () = assert!(
+    REGISTRY_OFFER_LEASE_RENEWAL_TIMEOUT.as_secs()
+        + REGISTRY_OFFER_FINAL_RESERVATION_TIMEOUT.as_secs()
+        < OPERATION_LEASE_SECONDS as u64
+);
+
 #[derive(Debug, Deserialize)]
 pub(in crate::api) struct Oid4vciOfferStartQuery {
     pub(in crate::api) credential_configuration_id: Option<String>,
 }
 
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(in crate::api) struct Oid4vciRegistryOfferRequest {
+    pub(in crate::api) evaluation_id: String,
+    pub(in crate::api) credential_configuration_id: String,
+}
+
+/// `POST /oid4vci/offers` (authenticated): create one registrar-initiated
+/// pre-authorized offer from an already stored machine evaluation.
+///
+/// The request cannot supply facts, target, purpose, profile, or provenance.
+/// Every authority-bearing value is recovered from authenticated configuration
+/// and the immutable stored evaluation.
+pub(in crate::api) async fn oid4vci_create_registry_offer(
+    headers: HeaderMap,
+    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
+    principal: Option<Extension<EvidencePrincipal>>,
+    request: Result<Json<Oid4vciRegistryOfferRequest>, JsonRejection>,
+) -> Response {
+    let mut response =
+        oid4vci_create_registry_offer_inner(headers, state, principal, request).await;
+    response
+        .headers_mut()
+        .insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
+    response
+        .headers_mut()
+        .insert(header::PRAGMA, HeaderValue::from_static("no-cache"));
+    response
+}
+
+async fn oid4vci_create_registry_offer_inner(
+    headers: HeaderMap,
+    state: Option<Extension<Arc<RegistryNotaryApiState>>>,
+    principal: Option<Extension<EvidencePrincipal>>,
+    request: Result<Json<Oid4vciRegistryOfferRequest>, JsonRejection>,
+) -> Response {
+    let request = match parse_json_body(request) {
+        Ok(request) => request,
+        Err(error) => return evidence_error_response(error),
+    };
+    let Some(Extension(state)) = state else {
+        return evidence_error_response(EvidenceError::ServerDisabled);
+    };
+    let Some(preauth) = preauth_runtime(&state) else {
+        return StatusCode::NOT_FOUND.into_response();
+    };
+    let Some(Extension(principal)) = principal else {
+        return evidence_error_response(EvidenceError::MissingCredential);
+    };
+    let principal = match classify_subject_access_principal(&state.subject_access, &principal) {
+        Ok(principal)
+            if principal.access_mode() == AccessMode::MachineClient
+                && principal.auth_profile_id
+                    != registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken
+                && principal.has_scope(REGISTRY_OFFER_CREATE_SCOPE) =>
+        {
+            principal
+        }
+        Ok(_) => {
+            return evidence_error_response(EvidenceError::ScopeDenied {
+                required: REGISTRY_OFFER_CREATE_SCOPE.to_string(),
+            })
+        }
+        Err(error) => return evidence_error_response(error),
+    };
+    let Some(idempotency_key) = idempotency_key(&headers).filter(|key| {
+        !key.is_empty()
+            && key.len() <= 256
+            && key
+                .bytes()
+                .all(|byte| matches!(byte, b'!' | b'#'..=b'[' | b']'..=b'~'))
+    }) else {
+        return evidence_error_response(EvidenceError::InvalidRequest);
+    };
+    let evidence = match state.enabled_evidence() {
+        Ok(evidence) => evidence,
+        Err(error) => return evidence_error_response(error),
+    };
+    let Some((configuration_id, configuration)) = state
+        .oid4vci
+        .credential_configurations
+        .get_key_value(&request.credential_configuration_id)
+    else {
+        return evidence_error_response(EvidenceError::EvaluationNotFound);
+    };
+    if !principal.has_scope(&configuration.scope) {
+        return evidence_error_response(EvidenceError::ScopeDenied {
+            required: configuration.scope.clone(),
+        });
+    }
+    let evaluation = match state
+        .store
+        .get(&request.evaluation_id, &principal.principal_id)
+        .await
+    {
+        Ok(Some(evaluation))
+            if evaluation.subject_access.is_none()
+                && evaluation.client_id == principal.principal_id
+                && evaluation.access_mode() == AccessMode::MachineClient =>
+        {
+            evaluation
+        }
+        Ok(Some(_)) | Ok(None) => {
+            return evidence_error_response(EvidenceError::EvaluationNotFound);
+        }
+        Err(error) => return evidence_error_response(error),
+    };
+    let now = OffsetDateTime::now_utc();
+    let evaluation_expires_at = match OffsetDateTime::parse(&evaluation.expires_at, &Rfc3339) {
+        Ok(expires_at) if expires_at > now => expires_at,
+        _ => return evidence_error_response(EvidenceError::EvaluationNotFound),
+    };
+    let configuration_claim_ids = configuration.credential_claim_ids();
+    let configuration_claim_refs = oid4vci_credential_claim_refs(configuration);
+    let result_claim_ids = evaluation
+        .results
+        .iter()
+        .map(|result| result.claim_id.clone())
+        .collect::<Vec<_>>();
+    if !crate::authz_details::exact_unique_string_set(
+        &evaluation.claim_ids,
+        &configuration_claim_ids,
+    ) || !crate::authz_details::exact_unique_string_set(
+        &result_claim_ids,
+        &configuration_claim_ids,
+    ) || !crate::authz_details::exact_unique_claim_ref_set(
+        &evaluation.selected_claim_refs(),
+        &configuration_claim_refs,
+    ) || evaluation.disclosure != DisclosureProfile::Value.as_str()
+        || evaluation.format != FORMAT_CLAIM_RESULT_JSON
+        || evaluation.results.is_empty()
+        || evaluation.results.iter().any(|result| {
+            result.value.as_ref().is_none_or(Value::is_null)
+                || result.satisfied == Some(false)
+                || !result.redacted_fields.is_empty()
+        })
+    {
+        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
+    }
+    let Some(target_ref) = evaluation.results.first().map(|result| &result.target_ref) else {
+        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
+    };
+    if evaluation
+        .results
+        .iter()
+        .any(|result| !same_target_ref(&result.target_ref, target_ref))
+    {
+        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
+    }
+    if let Err(error) = require_evaluation_access(evidence, &principal, &evaluation) {
+        return evidence_error_response(error);
+    }
+    let selected = evaluation.selected_claim_refs();
+    let configured_purpose = match common_subject_access_purpose(evidence, &selected) {
+        Ok(purpose) => purpose,
+        Err(error) => return evidence_error_response(error),
+    };
+    if configured_purpose != evaluation.purpose
+        || (!evidence.allowed_purposes.is_empty()
+            && !evidence
+                .allowed_purposes
+                .iter()
+                .any(|purpose| purpose == &evaluation.purpose))
+    {
+        return evidence_error_response(EvidenceError::PurposeNotAllowed);
+    }
+    if let Err(error) =
+        require_registry_backed_credential_claims(evidence, &configuration_claim_ids)
+    {
+        return evidence_error_response(error);
+    }
+    let (profile_id, profile) = match credential_profile_for(
+        evidence,
+        &evaluation,
+        Some(&configuration.credential_profile),
+    ) {
+        Ok(profile) => profile,
+        Err(error) => return evidence_error_response(error),
+    };
+    if profile_id != configuration.credential_profile
+        || (!profile.disclosure.allowed.is_empty()
+            && !profile
+                .disclosure
+                .allowed
+                .iter()
+                .any(|allowed| allowed == &evaluation.disclosure))
+    {
+        return evidence_error_response(EvidenceError::DisclosureNotAllowed);
+    }
+    let credential_issued_at = earliest_issued_at(&evaluation.results).unwrap_or(now);
+    let credential_expires_at =
+        match credential_issued_at.checked_add(time::Duration::seconds(profile.validity_seconds)) {
+            Some(expires_at) if expires_at > now => expires_at,
+            Some(_) => return evidence_error_response(EvidenceError::EvaluationNotFound),
+            None => return evidence_error_response(EvidenceError::CredentialIssuanceFailed),
+        };
+    let offer_expires_at = evaluation_expires_at.min(credential_expires_at);
+    if let Err(error) =
+        require_issuable_evaluation_provenance(evidence, &request.evaluation_id, &evaluation)
+    {
+        return evidence_error_response(error);
+    }
+    let Some(details) = principal.authorization_details.as_ref() else {
+        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
+    };
+    let Some(authorized_target) = details.target.as_ref() else {
+        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
+    };
+    let Some(stored_target_binding) = evaluation
+        .issuance_provenance
+        .as_ref()
+        .map(|provenance| provenance.authorization_target_binding.as_str())
+        .filter(|binding| !binding.is_empty())
+    else {
+        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
+    };
+    let authorized_target_binding = match issuance_authorization_target_binding(
+        &state.subject_access_rate_keys,
+        target_ref,
+        &authorized_target.id_type,
+        &authorized_target.id,
+    ) {
+        Ok(binding) => binding,
+        Err(error) => return evidence_error_response(error),
+    };
+    if authorized_target_binding != stored_target_binding
+        || crate::authz_details::validate_scoped_authorization_details(
+            details,
+            &crate::authz_details::ScopedAuthorizationRequest {
+                service_id: evidence.service_id.as_str(),
+                action: "create_credential_offer",
+                claims: &selected,
+                disclosure: DisclosureProfile::Value.as_str(),
+                format: FORMAT_CLAIM_RESULT_JSON,
+                purpose: evaluation.purpose.as_str(),
+                access_mode: AccessMode::MachineClient,
+                subject: None,
+                target: Some(crate::authz_details::ScopedAuthorizationTarget {
+                    id_type: authorized_target.id_type.clone(),
+                    id: authorized_target.id.clone(),
+                }),
+                allow_subset_claims: false,
+                allowed_claims: None,
+            },
+        )
+        .is_err()
+    {
+        return evidence_error_response(EvidenceError::EvaluationBindingMismatch);
+    }
+    let configuration_fingerprint =
+        match oid4vci_configuration_fingerprint(evidence, configuration_id, configuration) {
+            Ok(fingerprint) => fingerprint,
+            Err(error) => return evidence_error_response(error),
+        };
+    let initiating_client_id_hash = match state
+        .subject_access_rate_keys
+        .principal(&principal.principal_id)
+    {
+        Ok(hash) => hash.as_str().to_string(),
+        Err(error) => return evidence_error_response(error.evidence_error()),
+    };
+    let canonical_idempotency_input = format!(
+        "client\0{}\0{}\0key\0{}\0{}",
+        initiating_client_id_hash.len(),
+        initiating_client_id_hash,
+        idempotency_key.len(),
+        idempotency_key
+    );
+    let idempotency_key_hash = match state.subject_access_rate_keys.audit_pseudonym_ref(
+        "oid4vci-registry-offer-idempotency-v1",
+        &canonical_idempotency_input,
+    ) {
+        Ok(hash) => hash.as_str().to_string(),
+        Err(error) => return evidence_error_response(error.evidence_error()),
+    };
+    let mut canonical_authorized_scopes = principal.scopes.clone();
+    canonical_authorized_scopes.sort();
+    canonical_authorized_scopes.dedup();
+    let canonical_authorization_details = canonical_registry_offer_authorization_details(details);
+    let canonical_request_hash = match sha256_canonical_json(&json!({
+        "schema": "registry.notary.registry-client-offer-request/v1",
+        "request": request,
+        "configuration_fingerprint": configuration_fingerprint,
+        "evaluation": evaluation,
+        "initiating_client_id_hash": initiating_client_id_hash,
+        "auth_profile_id": principal.auth_profile_id,
+        "authorized_scopes": canonical_authorized_scopes,
+        "authorization_details": canonical_authorization_details,
+    })) {
+        Ok(hash) => hash,
+        Err(error) => return evidence_error_response(error),
+    };
+    match preauth
+        .preauthorization_state()
+        .registry_client_offer_preflight(
+            &request.evaluation_id,
+            &principal.principal_id,
+            &idempotency_key_hash,
+            &canonical_request_hash,
+        )
+        .await
+    {
+        Ok(RegistryClientOfferPreflightOutcome::Available) => {}
+        Ok(RegistryClientOfferPreflightOutcome::Replayed(response)) => {
+            state
+                .metrics
+                .record_credential("openid4vci_registry_offer", "replayed");
+            return registry_client_offer_success_response(
+                response,
+                &state.subject_access_rate_keys,
+                "registry_offer_replayed",
+                &request.evaluation_id,
+                &evaluation,
+                configuration_id,
+                profile_id,
+                &profile.holder_binding.mode,
+                target_ref,
+            );
+        }
+        Ok(RegistryClientOfferPreflightOutcome::IdempotencyConflict)
+        | Ok(RegistryClientOfferPreflightOutcome::EvaluationConsumed) => {
+            return registry_offer_problem(StatusCode::CONFLICT, "offer_conflict");
+        }
+        Err(_) => {
+            return registry_offer_problem(StatusCode::SERVICE_UNAVAILABLE, "offer_unavailable");
+        }
+    }
+    let quota_operation_id = format!(
+        "idempotency\0{}\0{}",
+        idempotency_key_hash.len(),
+        idempotency_key_hash,
+    );
+    let transaction_id = match generate_opaque_token() {
+        Ok(transaction_id) => transaction_id,
+        Err(_) => return evidence_error_response(EvidenceError::CredentialIssuanceFailed),
+    };
+    let quota_wait_deadline = tokio::time::Instant::now() + REGISTRY_OFFER_OPERATION_WAIT;
+    let quota_poll_jitter = std::time::Duration::from_millis(
+        transaction_id.bytes().fold(0_u64, |accumulator, byte| {
+            accumulator.wrapping_mul(33).wrapping_add(u64::from(byte))
+        }) % 101,
+    );
+    let mut quota_poll_interval = REGISTRY_OFFER_OPERATION_POLL_INTERVAL;
+    let _initial_quota_operation_fence = loop {
+        let quota_outcome = match tokio::time::timeout_at(
+            quota_wait_deadline,
+            state.machine_quota_limiter.check_and_consume_once(
+                &principal.principal_id,
+                1,
+                &quota_operation_id,
+                &canonical_request_hash,
+                &transaction_id,
+                offer_expires_at,
+            ),
+        )
+        .await
+        {
+            Ok(outcome) => outcome,
+            Err(_) => {
+                return registry_offer_problem(
+                    StatusCode::SERVICE_UNAVAILABLE,
+                    "offer_unavailable",
+                );
+            }
+        };
+        match quota_outcome {
+            Ok(MachineQuotaOperationOutcome::Acquired(fence)) => break fence,
+            Ok(MachineQuotaOperationOutcome::Conflict) => {
+                return registry_offer_problem(StatusCode::CONFLICT, "offer_conflict");
+            }
+            Ok(MachineQuotaOperationOutcome::Existing) => {
+                // A concurrent exact request owns the charged lease. Only
+                // that owner may sign. Contenders wait for its authoritative
+                // reservation, or take over an expired/released lease without
+                // spending quota again.
+                let preflight = match tokio::time::timeout_at(
+                    quota_wait_deadline,
+                    preauth
+                        .preauthorization_state()
+                        .registry_client_offer_preflight(
+                            &request.evaluation_id,
+                            &principal.principal_id,
+                            &idempotency_key_hash,
+                            &canonical_request_hash,
+                        ),
+                )
+                .await
+                {
+                    Ok(preflight) => preflight,
+                    Err(_) => {
+                        return registry_offer_problem(
+                            StatusCode::SERVICE_UNAVAILABLE,
+                            "offer_unavailable",
+                        );
+                    }
+                };
+                match preflight {
+                    Ok(RegistryClientOfferPreflightOutcome::Replayed(response)) => {
+                        state
+                            .metrics
+                            .record_credential("openid4vci_registry_offer", "replayed");
+                        return registry_client_offer_success_response(
+                            response,
+                            &state.subject_access_rate_keys,
+                            "registry_offer_replayed",
+                            &request.evaluation_id,
+                            &evaluation,
+                            configuration_id,
+                            profile_id,
+                            &profile.holder_binding.mode,
+                            target_ref,
+                        );
+                    }
+                    Ok(RegistryClientOfferPreflightOutcome::IdempotencyConflict)
+                    | Ok(RegistryClientOfferPreflightOutcome::EvaluationConsumed) => {
+                        return registry_offer_problem(StatusCode::CONFLICT, "offer_conflict");
+                    }
+                    Ok(RegistryClientOfferPreflightOutcome::Available) => {}
+                    Err(_) => {
+                        return registry_offer_problem(
+                            StatusCode::SERVICE_UNAVAILABLE,
+                            "offer_unavailable",
+                        );
+                    }
+                }
+                let now = tokio::time::Instant::now();
+                if now >= quota_wait_deadline {
+                    return registry_offer_problem(
+                        StatusCode::SERVICE_UNAVAILABLE,
+                        "offer_unavailable",
+                    );
+                }
+                tokio::time::sleep_until(std::cmp::min(
+                    now + quota_poll_interval + quota_poll_jitter,
+                    quota_wait_deadline,
+                ))
+                .await;
+                quota_poll_interval = std::cmp::min(
+                    quota_poll_interval.saturating_mul(2),
+                    REGISTRY_OFFER_OPERATION_MAX_POLL_INTERVAL,
+                );
+            }
+            Err(error) => {
+                return evidence_error_response(EvidenceError::MachineQuotaExceeded {
+                    retry_after_seconds: error.retry_after_seconds,
+                });
+            }
+        }
+    };
+    let (quota_principal_hash, _quota_limit, quota_cost) = match state
+        .machine_quota_limiter
+        .batch_reservation_parameters(&principal.principal_id, 1)
+    {
+        Ok(parameters) => parameters,
+        Err(error) => {
+            release_registry_offer_quota_operation(
+                &state,
+                &principal.principal_id,
+                &quota_operation_id,
+                &transaction_id,
+            )
+            .await;
+            return evidence_error_response(EvidenceError::MachineQuotaExceeded {
+                retry_after_seconds: error.retry_after_seconds,
+            });
+        }
+    };
+    let commitment = match oid4vci_registry_client_transaction_commitment(
+        &transaction_id,
+        evidence,
+        configuration_id,
+        configuration,
+        &configuration_fingerprint,
+        &request.evaluation_id,
+        &evaluation,
+        &initiating_client_id_hash,
+        principal.auth_profile_id,
+        &principal.scopes,
+        target_ref,
+    ) {
+        Ok(commitment) => commitment,
+        Err(error) => {
+            release_registry_offer_quota_operation(
+                &state,
+                &principal.principal_id,
+                &quota_operation_id,
+                &transaction_id,
+            )
+            .await;
+            return evidence_error_response(error);
+        }
+    };
+    let authority = IssuanceAuthority::RegistryClient {
+        initiating_client_id: principal.principal_id.clone(),
+        initiating_client_id_hash,
+        auth_profile_id: principal.auth_profile_id,
+        authorized_scopes: principal.scopes.clone(),
+        target_ref: target_ref.clone(),
+        service_id: evidence.service_id.clone(),
+        purpose: evaluation.purpose.clone(),
+    };
+    let transaction = IssuanceTransaction {
+        transaction_id: transaction_id.clone(),
+        evaluation_id: request.evaluation_id.clone(),
+        evaluation_client_id: principal.principal_id.clone(),
+        credential_configuration_id: configuration_id.clone(),
+        commitment: commitment.clone(),
+        authority,
+    };
+    let now_unix = now.unix_timestamp();
+    let code_exp = (now_unix + preauth.pre_authorized_code_ttl_seconds() as i64)
+        .min(offer_expires_at.unix_timestamp());
+    if code_exp <= now_unix {
+        release_registry_offer_quota_operation(
+            &state,
+            &principal.principal_id,
+            &quota_operation_id,
+            &transaction_id,
+        )
+        .await;
+        return evidence_error_response(EvidenceError::EvaluationNotFound);
+    }
+    let code_expires_at = match OffsetDateTime::from_unix_timestamp(code_exp) {
+        Ok(expires_at) => expires_at,
+        Err(_) => {
+            release_registry_offer_quota_operation(
+                &state,
+                &principal.principal_id,
+                &quota_operation_id,
+                &transaction_id,
+            )
+            .await;
+            return evidence_error_response(EvidenceError::CredentialIssuanceFailed);
+        }
+    };
+    let transaction_expires_at = offer_expires_at
+        .min(code_expires_at + time::Duration::seconds(preauth.access_token_ttl_seconds() as i64));
+    let wallet_authority = BoundSubject {
+        subject: transaction_id.clone(),
+        subject_binding_claim: state.subject_access.subject_binding.token_claim.clone(),
+        subject_binding_value: transaction_id.clone(),
+        client_id: "registry-notary-wallet-transaction".to_string(),
+        scopes: vec![configuration.scope.clone()],
+        acr: None,
+        auth_time: None,
+    };
+    let code_claims = PreAuthorizedCodeClaims {
+        issuer: preauth.notary_issuer().to_string(),
+        jti: transaction_id.clone(),
+        credential_configuration_id: configuration_id.clone(),
+        issuance_transaction_id: transaction_id.clone(),
+        issuance_transaction_commitment: commitment,
+        // Registrar-initiated offers always require a separately presented
+        // transaction code, independent of the citizen self-service setting.
+        tx_code_required: true,
+        subject: wallet_authority,
+        iat: now_unix,
+        exp: code_exp,
+    };
+    let Some(signing_timeout) =
+        registry_offer_completion_timeout(code_expires_at, REGISTRY_OFFER_SIGNER_TIMEOUT)
+    else {
+        release_registry_offer_quota_operation(
+            &state,
+            &principal.principal_id,
+            &quota_operation_id,
+            &transaction_id,
+        )
+        .await;
+        return evidence_error_response(EvidenceError::EvaluationNotFound);
+    };
+    let signed_code = match tokio::time::timeout(
+        signing_timeout,
+        mint_pre_authorized_code(
+            preauth.access_token_signer(),
+            PRE_AUTHORIZED_CODE_JWT_TYP,
+            &code_claims,
+        ),
+    )
+    .await
+    {
+        Ok(Ok(code)) => code,
+        Ok(Err(error)) => {
+            release_registry_offer_quota_operation(
+                &state,
+                &principal.principal_id,
+                &quota_operation_id,
+                &transaction_id,
+            )
+            .await;
+            return evidence_error_response(error);
+        }
+        Err(_) => {
+            release_registry_offer_quota_operation(
+                &state,
+                &principal.principal_id,
+                &quota_operation_id,
+                &transaction_id,
+            )
+            .await;
+            return evidence_error_response(EvidenceError::CredentialIssuanceFailed);
+        }
+    };
+    let Some(lease_renewal_timeout) =
+        registry_offer_completion_timeout(code_expires_at, REGISTRY_OFFER_LEASE_RENEWAL_TIMEOUT)
+    else {
+        release_registry_offer_quota_operation(
+            &state,
+            &principal.principal_id,
+            &quota_operation_id,
+            &transaction_id,
+        )
+        .await;
+        return evidence_error_response(EvidenceError::EvaluationNotFound);
+    };
+    // The initial 60-second owner lease safely contains the 25-second signer
+    // deadline. Renew immediately after signing, then bound the authoritative
+    // reservation to 45 seconds. The 5-second renewal deadline leaves at
+    // least ten seconds before takeover is possible. PostgreSQL and the
+    // in-memory path both fence final completion on this returned owner token.
+    let quota_operation_fence = match tokio::time::timeout(
+        lease_renewal_timeout,
+        state.machine_quota_limiter.check_and_consume_once(
+            &principal.principal_id,
+            1,
+            &quota_operation_id,
+            &canonical_request_hash,
+            &transaction_id,
+            offer_expires_at,
+        ),
+    )
+    .await
+    {
+        Ok(Ok(MachineQuotaOperationOutcome::Acquired(fence))) => fence,
+        Ok(Ok(MachineQuotaOperationOutcome::Conflict)) => {
+            release_registry_offer_quota_operation(
+                &state,
+                &principal.principal_id,
+                &quota_operation_id,
+                &transaction_id,
+            )
+            .await;
+            return registry_offer_problem(StatusCode::CONFLICT, "offer_conflict");
+        }
+        Ok(Ok(MachineQuotaOperationOutcome::Existing)) | Ok(Err(_)) | Err(_) => {
+            release_registry_offer_quota_operation(
+                &state,
+                &principal.principal_id,
+                &quota_operation_id,
+                &transaction_id,
+            )
+            .await;
+            return registry_offer_problem(StatusCode::SERVICE_UNAVAILABLE, "offer_unavailable");
+        }
+    };
+    let tx_code = match generate_numeric_tx_code(preauth.tx_code_length()) {
+        Ok(code) => code,
+        Err(_) => {
+            release_registry_offer_quota_operation(
+                &state,
+                &principal.principal_id,
+                &quota_operation_id,
+                &transaction_id,
+            )
+            .await;
+            return evidence_error_response(EvidenceError::CredentialIssuanceFailed);
+        }
+    };
+    let offer = CredentialOffer::pre_authorized_code(
+        state.oid4vci.credential_issuer.clone(),
+        vec![configuration_id.clone()],
+        signed_code.compact,
+        Some(TxCode::new(
+            preauth.tx_code_length(),
+            Some("Enter the PIN delivered separately by the registrar".to_string()),
+        )),
+    );
+    let credential_offer_uri = match offer_request_uri(&offer) {
+        Ok(uri) => uri,
+        Err(()) => {
+            release_registry_offer_quota_operation(
+                &state,
+                &principal.principal_id,
+                &quota_operation_id,
+                &transaction_id,
+            )
+            .await;
+            return evidence_error_response(EvidenceError::CredentialIssuanceFailed);
+        }
+    };
+    let response = RegistryClientOfferResponse {
+        credential_offer_uri,
+        tx_code: Some(tx_code.clone()),
+        expires_at: format_time(code_expires_at),
+    };
+    let audit_evaluation_id = request.evaluation_id.clone();
+    let quota_lease_owner_id = transaction_id.clone();
+    let reservation = RegistryClientOfferReservation {
+        transaction_id,
+        evaluation_id: request.evaluation_id,
+        evaluation_expires_at,
+        idempotency_key_hash,
+        canonical_request_hash,
+        transaction,
+        transaction_code: Some(RegistryClientTransactionCode {
+            pin: tx_code,
+            pin_length: preauth.tx_code_length(),
+        }),
+        code_expires_at,
+        transaction_expires_at,
+        response,
+        // Replays must stop when the signed code does. Evaluation consumption
+        // remains independently retained through evaluation_expires_at.
+        retention_expires_at: code_expires_at,
+        quota_principal_hash,
+        // Quota was charged before signer work. The atomic final reservation
+        // must not debit the same request a second time.
+        quota_limit: None,
+        quota_cost,
+    };
+    let Some(final_reservation_timeout) = registry_offer_completion_timeout(
+        code_expires_at,
+        REGISTRY_OFFER_FINAL_RESERVATION_TIMEOUT,
+    ) else {
+        release_registry_offer_quota_operation(
+            &state,
+            &principal.principal_id,
+            &quota_operation_id,
+            &quota_lease_owner_id,
+        )
+        .await;
+        return evidence_error_response(EvidenceError::EvaluationNotFound);
+    };
+    let reservation_result = tokio::time::timeout(
+        final_reservation_timeout,
+        preauth
+            .preauthorization_state()
+            .reserve_registry_client_offer_fenced(reservation, &quota_operation_fence),
+    )
+    .await;
+    let (response, audit_decision) = match reservation_result {
+        Ok(Ok(RegistryClientOfferReservationOutcome::Created(response))) => {
+            state
+                .metrics
+                .record_credential("openid4vci_registry_offer", "created");
+            (response, "registry_offer_created")
+        }
+        Ok(Ok(RegistryClientOfferReservationOutcome::Replayed(response))) => {
+            state
+                .metrics
+                .record_credential("openid4vci_registry_offer", "replayed");
+            (response, "registry_offer_replayed")
+        }
+        Ok(Err(PreauthorizationStateError::IdempotencyConflict))
+        | Ok(Err(PreauthorizationStateError::EvaluationConsumed)) => {
+            release_registry_offer_quota_operation(
+                &state,
+                &principal.principal_id,
+                &quota_operation_id,
+                &quota_lease_owner_id,
+            )
+            .await;
+            return registry_offer_problem(StatusCode::CONFLICT, "offer_conflict");
+        }
+        Ok(Err(PreauthorizationStateError::IssuanceTransactionCapacity)) => {
+            release_registry_offer_quota_operation(
+                &state,
+                &principal.principal_id,
+                &quota_operation_id,
+                &quota_lease_owner_id,
+            )
+            .await;
+            return registry_offer_problem(StatusCode::TOO_MANY_REQUESTS, "offer_rate_limited");
+        }
+        Ok(Err(PreauthorizationStateError::MachineQuotaExceeded {
+            retry_after_seconds,
+        })) => {
+            release_registry_offer_quota_operation(
+                &state,
+                &principal.principal_id,
+                &quota_operation_id,
+                &quota_lease_owner_id,
+            )
+            .await;
+            return evidence_error_response(EvidenceError::MachineQuotaExceeded {
+                retry_after_seconds,
+            });
+        }
+        Ok(Err(_)) => {
+            release_registry_offer_quota_operation(
+                &state,
+                &principal.principal_id,
+                &quota_operation_id,
+                &quota_lease_owner_id,
+            )
+            .await;
+            return registry_offer_problem(StatusCode::SERVICE_UNAVAILABLE, "offer_unavailable");
+        }
+        Err(_) => {
+            // Do not release early: the dropped PostgreSQL request is poisoned
+            // and canceled, but retaining the renewed lease until its bounded
+            // expiry prevents a contender from signing while cancellation is
+            // still propagating. A later request may take over safely.
+            return registry_offer_problem(StatusCode::SERVICE_UNAVAILABLE, "offer_unavailable");
+        }
+    };
+    registry_client_offer_success_response(
+        response,
+        &state.subject_access_rate_keys,
+        audit_decision,
+        &audit_evaluation_id,
+        &evaluation,
+        configuration_id,
+        profile_id,
+        &profile.holder_binding.mode,
+        target_ref,
+    )
+}
+
+/// Match authorization's exact claim-set semantics: order carries no
+/// authority, while multiplicity and version do. Every other signed field
+/// remains unchanged in the request identity.
+fn canonical_registry_offer_authorization_details(
+    details: &registry_notary_core::EvidenceAuthorizationDetails,
+) -> registry_notary_core::EvidenceAuthorizationDetails {
+    let mut canonical = details.clone();
+    canonical.claims.sort_by(|left, right| {
+        left.id
+            .cmp(&right.id)
+            .then_with(|| left.version.cmp(&right.version))
+    });
+    canonical
+}
+
+pub(in crate::api) fn same_target_ref(left: &TargetRefView, right: &TargetRefView) -> bool {
+    left.entity_type == right.entity_type
+        && left.handle == right.handle
+        && left.identifier_schemes == right.identifier_schemes
+        && left.profile == right.profile
+}
+
+async fn release_registry_offer_quota_operation(
+    state: &RegistryNotaryApiState,
+    principal_id: &str,
+    operation_id: &str,
+    lease_owner_id: &str,
+) {
+    let _ = state
+        .machine_quota_limiter
+        .release_operation(principal_id, operation_id, lease_owner_id)
+        .await;
+}
+
+fn registry_offer_completion_timeout(
+    code_expires_at: OffsetDateTime,
+    maximum: std::time::Duration,
+) -> Option<std::time::Duration> {
+    std::time::Duration::try_from(code_expires_at - OffsetDateTime::now_utc())
+        .ok()
+        .filter(|remaining| !remaining.is_zero())
+        .map(|remaining| remaining.min(maximum))
+}
+
+pub(in crate::api) fn registry_offer_problem(status: StatusCode, code: &'static str) -> Response {
+    let request_id = crate::standalone::current_request_correlation_id();
+    let mut body = json!({
+        "type": format!("{}/{}", crate::PROBLEM_TYPE_BASE_URL, code.replace('_', "/")),
+        "title": "Credential offer was not created",
+        "status": status.as_u16(),
+        "detail": "the registrar-initiated credential offer could not be created",
+        "code": code,
+    });
+    if let Some(request_id) = request_id.as_ref() {
+        body["request_id"] = json!(request_id.as_str());
+    }
+    let mut response = (status, Json(body)).into_response();
+    response.headers_mut().insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_static("application/problem+json"),
+    );
+    if status == StatusCode::SERVICE_UNAVAILABLE {
+        response.headers_mut().insert(
+            header::RETRY_AFTER,
+            HeaderValue::from_static(REGISTRY_OFFER_OPERATION_RETRY_AFTER_SECONDS),
+        );
+    }
+    response
+        .extensions_mut()
+        .insert(EvidenceErrorCodeContext(code.to_string()));
+    if let Some(request_id) = request_id {
+        if let Ok(value) = HeaderValue::from_str(request_id.as_str()) {
+            response.headers_mut().insert("x-request-id", value);
+        }
+    }
+    response
+}
+
+#[allow(clippy::too_many_arguments)]
+fn registry_client_offer_success_response(
+    response: RegistryClientOfferResponse,
+    keys: &SubjectAccessRateLimitKeys,
+    audit_decision: &str,
+    evaluation_id: &str,
+    evaluation: &registry_notary_core::StoredEvaluation,
+    configuration_id: &str,
+    profile_id: &str,
+    holder_binding_mode: &str,
+    target_ref: &TargetRefView,
+) -> Response {
+    let response_is_fresh = OffsetDateTime::parse(&response.expires_at, &Rfc3339)
+        .is_ok_and(|expires_at| expires_at > OffsetDateTime::now_utc());
+    if !response_is_fresh {
+        return evidence_error_response(EvidenceError::EvaluationNotFound);
+    }
+    let mut response = Json(response).into_response();
+    if let Err(error) = attach_registry_client_offer_audit(
+        &mut response,
+        keys,
+        audit_decision,
+        evaluation_id,
+        evaluation,
+        configuration_id,
+        profile_id,
+        holder_binding_mode,
+        target_ref,
+    ) {
+        return evidence_error_response(error);
+    }
+    response
+}
+
 /// `GET /oid4vci/offer/start` (public): begin the eSignet authorization-code
 /// login as the confidential RP and redirect the citizen browser to eSignet.
 ///
@@ -64,6 +1011,10 @@ pub(in crate::api) async fn oid4vci_offer_start(
             PreauthorizationStateError::DuplicateLoginState
             | PreauthorizationStateError::DuplicateIssuanceTransaction
             | PreauthorizationStateError::IssuanceTransactionCapacity
+            | PreauthorizationStateError::IdempotencyConflict
+            | PreauthorizationStateError::EvaluationConsumed
+            | PreauthorizationStateError::MachineQuotaExceeded { .. }
+            | PreauthorizationStateError::OperationLeaseLost
             | PreauthorizationStateError::Unavailable
             | PreauthorizationStateError::IncompatibleTransactionCodeProof
             | PreauthorizationStateError::InvalidExpiry
@@ -198,6 +1149,7 @@ pub(in crate::api) async fn prepare_registry_backed_issuance_transaction(
         evaluation_client_id,
         credential_configuration_id: configuration_id.clone(),
         commitment,
+        authority: crate::preauth_state::IssuanceAuthority::SubjectAccess,
     })
 }
 
@@ -222,6 +1174,21 @@ pub(in crate::api) fn oid4vci_configuration_fingerprint(
         "credential_configuration",
         serde_json::to_value(configuration).map_err(|_| EvidenceError::InvalidRequest)?,
     );
+    let claim_definitions = configuration
+        .credential_claim_ids()
+        .into_iter()
+        .map(|claim_id| {
+            let definition = evidence
+                .claims
+                .iter()
+                .find(|claim| claim.id == claim_id)
+                .ok_or(EvidenceError::InvalidRequest)?;
+            serde_json::to_value(definition)
+                .map(|definition| (claim_id, definition))
+                .map_err(|_| EvidenceError::InvalidRequest)
+        })
+        .collect::<Result<BTreeMap<_, _>, _>>()?;
+    normalized.insert("claim_definitions", json!(claim_definitions));
     normalized.insert(
         "credential_profile",
         json!({
@@ -321,6 +1288,89 @@ pub(in crate::api) fn oid4vci_issuance_transaction_commitment(
     )
 }
 
+#[allow(clippy::too_many_arguments)]
+pub(in crate::api) fn oid4vci_registry_client_transaction_commitment(
+    transaction_id: &str,
+    evidence: &EvidenceConfig,
+    configuration_id: &str,
+    configuration: &Oid4vciCredentialConfigurationConfig,
+    configuration_fingerprint: &str,
+    evaluation_id: &str,
+    evaluation: &registry_notary_core::StoredEvaluation,
+    initiating_client_id_hash: &str,
+    auth_profile_id: registry_notary_core::EvidenceAuthProfileId,
+    authorized_scopes: &[String],
+    target_ref: &TargetRefView,
+) -> Result<String, EvidenceError> {
+    if evaluation.subject_access.is_some()
+        || evaluation.client_id.is_empty()
+        || !initiating_client_id_hash.starts_with("hmac-sha256:")
+        || evaluation.results.is_empty()
+        || evaluation
+            .results
+            .iter()
+            .any(|result| !same_target_ref(&result.target_ref, target_ref))
+    {
+        return Err(EvidenceError::EvaluationBindingMismatch);
+    }
+    let provenance = evaluation
+        .issuance_provenance
+        .as_ref()
+        .ok_or(EvidenceError::EvaluationBindingMismatch)?;
+    let issuance_material_binding = sha256_canonical_json(&json!({
+        "schema": "registry.notary.oid4vci-issuance-material/v1",
+        "evaluation_id": evaluation_id,
+        "purpose": evaluation.purpose,
+        "claim_references": evaluation.selected_claim_refs(),
+        "disclosure": evaluation.disclosure,
+        "format": evaluation.format,
+        "results": evaluation.results,
+        "created_at": evaluation.created_at,
+        "expires_at": evaluation.expires_at,
+        "request_hash": evaluation.request_hash,
+        "issuance_provenance": provenance,
+    }))?;
+    let mut authorized_scopes = authorized_scopes.to_vec();
+    authorized_scopes.sort();
+    authorized_scopes.dedup();
+    let mut normalized = BTreeMap::new();
+    normalized.insert(
+        "schema_version",
+        json!("registry-notary-oid4vci-registry-client-transaction/v1"),
+    );
+    normalized.insert("transaction_id", json!(transaction_id));
+    normalized.insert(
+        "initiating_client_id_hash",
+        json!(initiating_client_id_hash),
+    );
+    normalized.insert("auth_profile_id", json!(auth_profile_id));
+    normalized.insert("authorized_scopes", json!(authorized_scopes));
+    normalized.insert("target_ref", json!(target_ref));
+    normalized.insert("service", json!(evidence.service_id));
+    normalized.insert("purpose", json!(evaluation.purpose));
+    normalized.insert(
+        "canonical_claim_references",
+        json!(evaluation.selected_claim_refs()),
+    );
+    normalized.insert("credential_configuration_id", json!(configuration_id));
+    normalized.insert(
+        "credential_profile",
+        json!(configuration.credential_profile),
+    );
+    normalized.insert(
+        "configuration_fingerprint",
+        json!(configuration_fingerprint),
+    );
+    normalized.insert("stored_evaluation_id", json!(evaluation_id));
+    normalized.insert(
+        "issuance_material_binding",
+        json!(issuance_material_binding),
+    );
+    sha256_canonical_json(
+        &serde_json::to_value(normalized).map_err(|_| EvidenceError::InvalidRequest)?,
+    )
+}
+
 /// `GET /oid4vci/offer/callback` (public): consume the login state, exchange the
 /// eSignet code via `private_key_jwt`, validate the `id_token`, mint a single-use
 /// `pre-authorized_code`, and render the offer page.
@@ -727,63 +1777,6 @@ pub(in crate::api) async fn oid4vci_token(
         )
         .await;
     };
-    let transaction_code = if tx_code_required {
-        // Cap wrong-PIN attempts per code (brute-force guard). A locked code
-        // (attempts over the cap) is rejected before the PIN compare.
-        if check_tx_code_attempt(&state, code).await.is_err() {
-            return token_error_after_invalid_attempt(
-                &state,
-                &preauth,
-                path,
-                &client_address,
-                configuration_id.as_deref(),
-                TokenWireError::SlowDown,
-            )
-            .await;
-        }
-        let tx_code = request.tx_code.as_deref().unwrap_or("");
-        match preauth
-            .preauthorization_state()
-            .verify_transaction_code(&jti, tx_code)
-            .await
-        {
-            Ok(Some(proof)) => Some(proof),
-            Ok(None) => {
-                return token_error_after_invalid_attempt(
-                    &state,
-                    &preauth,
-                    path,
-                    &client_address,
-                    configuration_id.as_deref(),
-                    TokenWireError::InvalidGrant,
-                )
-                .await;
-            }
-            Err(_) => {
-                return token_error_with_audit(
-                    &preauth,
-                    path,
-                    configuration_id.as_deref(),
-                    SubjectAccessDenialCode::OperationDenied,
-                    TokenWireError::ServerError,
-                )
-                .await;
-            }
-        }
-    } else {
-        None
-    };
-    let Some(bound_subject) = bound_subject_from_code(&verified, &state) else {
-        return token_error_after_invalid_attempt(
-            &state,
-            &preauth,
-            path,
-            &client_address,
-            configuration_id.as_deref(),
-            TokenWireError::InvalidGrant,
-        )
-        .await;
-    };
     let Some(configuration_id) = configuration_id else {
         return token_error_after_invalid_attempt(
             &state,
@@ -832,57 +1825,192 @@ pub(in crate::api) async fn oid4vci_token(
         )
         .await;
     };
+    let live_transaction = match preauth
+        .preauthorization_state()
+        .transaction(transaction_id)
+        .await
+    {
+        Ok(Some(live))
+            if live.transaction.commitment == transaction_commitment
+                && live.transaction.credential_configuration_id == *configuration_id =>
+        {
+            Some(live)
+        }
+        _ => None,
+    };
+    let transaction_access_mode = live_transaction
+        .as_ref()
+        .map(|live| issuance_authority_access_mode(&live.transaction.authority))
+        .unwrap_or(AccessMode::SubjectBound);
+    // Enforce the signed code's PIN-attempt policy even when its transaction
+    // binding is absent or invalid. This prevents a forged transaction ID from
+    // bypassing the per-code brute-force guard.
+    if tx_code_required && check_tx_code_attempt(&state, code).await.is_err() {
+        return token_error_after_invalid_attempt_with_access_mode(
+            &state,
+            &preauth,
+            path,
+            &client_address,
+            Some(configuration_id),
+            transaction_access_mode,
+            TokenWireError::SlowDown,
+        )
+        .await;
+    }
     if transaction_id != jti {
-        return token_error_after_invalid_attempt(
+        return token_error_after_invalid_attempt_with_access_mode(
             &state,
             &preauth,
             path,
             &client_address,
             Some(configuration_id),
+            transaction_access_mode,
             TokenWireError::InvalidGrant,
         )
         .await;
     }
-    let transaction = match preauth
-        .preauthorization_state()
-        .transaction(transaction_id)
-        .await
-    {
-        Ok(Some(transaction))
-            if transaction.commitment == transaction_commitment
-                && transaction.credential_configuration_id == *configuration_id =>
+    let Some(live_transaction) = live_transaction else {
+        return token_error_after_invalid_attempt_with_access_mode(
+            &state,
+            &preauth,
+            path,
+            &client_address,
+            Some(configuration_id),
+            transaction_access_mode,
+            TokenWireError::InvalidGrant,
+        )
+        .await;
+    };
+    let access_token_exp = (now + preauth.access_token_ttl_seconds() as i64)
+        .min(live_transaction.expires_at.unix_timestamp());
+    let Ok(access_token_expires_in) = u64::try_from(access_token_exp - now) else {
+        return token_error_after_invalid_attempt_with_access_mode(
+            &state,
+            &preauth,
+            path,
+            &client_address,
+            Some(configuration_id),
+            transaction_access_mode,
+            TokenWireError::InvalidGrant,
+        )
+        .await;
+    };
+    if access_token_expires_in == 0 {
+        return token_error_after_invalid_attempt_with_access_mode(
+            &state,
+            &preauth,
+            path,
+            &client_address,
+            Some(configuration_id),
+            transaction_access_mode,
+            TokenWireError::InvalidGrant,
+        )
+        .await;
+    }
+    let transaction = live_transaction.transaction;
+    let transaction_code = if tx_code_required {
+        let tx_code = request.tx_code.as_deref().unwrap_or("");
+        match preauth
+            .preauthorization_state()
+            .verify_transaction_code(&jti, tx_code)
+            .await
         {
-            transaction
+            Ok(Some(proof)) => Some(proof),
+            Ok(None) => {
+                return token_error_after_invalid_attempt_with_access_mode(
+                    &state,
+                    &preauth,
+                    path,
+                    &client_address,
+                    Some(configuration_id),
+                    transaction_access_mode,
+                    TokenWireError::InvalidGrant,
+                )
+                .await;
+            }
+            Err(_) => {
+                return token_error_with_audit_access_mode(
+                    &preauth,
+                    path,
+                    Some(configuration_id),
+                    SubjectAccessDenialCode::OperationDenied,
+                    transaction_access_mode,
+                    TokenWireError::ServerError,
+                )
+                .await;
+            }
         }
-        _ => {
-            return token_error_after_invalid_attempt(
-                &state,
+    } else {
+        None
+    };
+    let Some(bound_subject) = bound_subject_from_code(&verified, &state) else {
+        return token_error_after_invalid_attempt_with_access_mode(
+            &state,
+            &preauth,
+            path,
+            &client_address,
+            Some(configuration_id),
+            transaction_access_mode,
+            TokenWireError::InvalidGrant,
+        )
+        .await;
+    };
+    let mut bound_subject = bound_subject;
+    add_scope_if_missing(&mut bound_subject.scopes, &configuration.scope);
+    let (authorization_detail, actor) = match &transaction.authority {
+        IssuanceAuthority::SubjectAccess => (
+            oid4vci_issuance_authorization_details(
+                &state.evidence,
+                &state.subject_access,
+                configuration,
+            ),
+            None,
+        ),
+        IssuanceAuthority::RegistryClient {
+            initiating_client_id_hash,
+            auth_profile_id,
+            service_id,
+            purpose,
+            ..
+        } if service_id == &state.evidence.service_id
+            && initiating_client_id_hash.starts_with("hmac-sha256:") =>
+        {
+            (
+                Ok(oid4vci_registry_client_authorization_details(
+                    &state.evidence,
+                    configuration,
+                    purpose,
+                )),
+                Some(json!({
+                    "type": "registry_client",
+                    "client_id_hash": initiating_client_id_hash,
+                    "auth_profile_id": auth_profile_id,
+                })),
+            )
+        }
+        IssuanceAuthority::RegistryClient { .. } => {
+            return token_error_with_audit_access_mode(
                 &preauth,
                 path,
-                &client_address,
                 Some(configuration_id),
+                SubjectAccessDenialCode::OperationDenied,
+                transaction_access_mode,
                 TokenWireError::InvalidGrant,
             )
             .await;
         }
     };
-    let mut bound_subject = bound_subject;
-    add_scope_if_missing(&mut bound_subject.scopes, &configuration.scope);
-    let authorization_details = match oid4vci_issuance_authorization_details(
-        &state.evidence,
-        &state.subject_access,
-        configuration,
-    )
-    .and_then(|details| {
+    let authorization_details = match authorization_detail.and_then(|details| {
         serde_json::to_value(details).map_err(|_| EvidenceError::CredentialIssuanceFailed)
     }) {
         Ok(details) => vec![details],
         Err(_) => {
-            return token_error_with_audit(
+            return token_error_with_audit_access_mode(
                 &preauth,
                 path,
                 Some(configuration_id),
                 SubjectAccessDenialCode::OperationDenied,
+                transaction_access_mode,
                 TokenWireError::ServerError,
             )
             .await;
@@ -894,11 +2022,12 @@ pub(in crate::api) async fn oid4vci_token(
     {
         Some(scope) => scope,
         None => {
-            return token_error_with_audit(
+            return token_error_with_audit_access_mode(
                 &preauth,
                 path,
                 Some(configuration_id),
                 SubjectAccessDenialCode::OperationDenied,
+                transaction_access_mode,
                 TokenWireError::ServerError,
             )
             .await;
@@ -917,22 +2046,24 @@ pub(in crate::api) async fn oid4vci_token(
     {
         Ok(true) => {}
         Ok(false) => {
-            return token_error_after_invalid_attempt(
+            return token_error_after_invalid_attempt_with_access_mode(
                 &state,
                 &preauth,
                 path,
                 &client_address,
                 Some(configuration_id),
+                transaction_access_mode,
                 TokenWireError::InvalidGrant,
             )
             .await;
         }
         Err(_) => {
-            return token_error_with_audit(
+            return token_error_with_audit_access_mode(
                 &preauth,
                 path,
                 Some(configuration_id),
                 SubjectAccessDenialCode::OperationDenied,
+                transaction_access_mode,
                 TokenWireError::ServerError,
             )
             .await;
@@ -942,11 +2073,12 @@ pub(in crate::api) async fn oid4vci_token(
     let c_nonce = match issue_c_nonce(&state, configuration_id).await {
         Some(c_nonce) => c_nonce,
         None => {
-            return token_error_with_audit(
+            return token_error_with_audit_access_mode(
                 &preauth,
                 path,
                 Some(configuration_id),
                 SubjectAccessDenialCode::OperationDenied,
+                transaction_access_mode,
                 TokenWireError::ServerError,
             )
             .await;
@@ -959,11 +2091,12 @@ pub(in crate::api) async fn oid4vci_token(
             .await,
         Ok(true)
     ) {
-        return token_error_with_audit(
+        return token_error_with_audit_access_mode(
             &preauth,
             path,
             Some(configuration_id),
             SubjectAccessDenialCode::OperationDenied,
+            transaction_access_mode,
             TokenWireError::ServerError,
         )
         .await;
@@ -979,9 +2112,9 @@ pub(in crate::api) async fn oid4vci_token(
         subject: bound_subject,
         authorization_details,
         confirmation: None,
-        actor: None,
+        actor,
         iat: now,
-        exp: now + preauth.access_token_ttl_seconds() as i64,
+        exp: access_token_exp,
     };
     let access_token = match mint_access_token(
         preauth.access_token_signer(),
@@ -992,17 +2125,18 @@ pub(in crate::api) async fn oid4vci_token(
     {
         Ok(token) => token,
         Err(_) => {
-            return token_error_with_audit(
+            return token_error_with_audit_access_mode(
                 &preauth,
                 path,
                 Some(configuration_id),
                 SubjectAccessDenialCode::OperationDenied,
+                transaction_access_mode,
                 TokenWireError::ServerError,
             )
             .await;
         }
     };
-    let audit = pre_auth_audit_event(
+    let mut audit = pre_auth_audit_event(
         "POST",
         path,
         StatusCode::OK.as_u16(),
@@ -1015,6 +2149,7 @@ pub(in crate::api) async fn oid4vci_token(
             ..PreAuthAuditFields::default()
         },
     );
+    audit.access_mode = Some(issuance_authority_access_mode(&transaction.authority));
     if preauth.emit_audit(&audit).await.is_err() {
         return token_error_response(TokenWireError::ServerError);
     }
@@ -1024,7 +2159,7 @@ pub(in crate::api) async fn oid4vci_token(
     Json(Oid4vciTokenResponse {
         access_token: access_token.compact,
         token_type: "Bearer".to_string(),
-        expires_in: Some(preauth.access_token_ttl_seconds()),
+        expires_in: Some(access_token_expires_in),
         c_nonce: Some(c_nonce),
         c_nonce_expires_in: state
             .oid4vci
@@ -1035,6 +2170,15 @@ pub(in crate::api) async fn oid4vci_token(
     .into_response()
 }
 
+pub(in crate::api) const fn issuance_authority_access_mode(
+    authority: &IssuanceAuthority,
+) -> AccessMode {
+    match authority {
+        IssuanceAuthority::SubjectAccess => AccessMode::SubjectBound,
+        IssuanceAuthority::RegistryClient { .. } => AccessMode::MachineClient,
+    }
+}
+
 /// The pre-auth runtime, present only when the flow is enabled and configured.
 pub(in crate::api) fn preauth_runtime(
     state: &RegistryNotaryApiState,
@@ -1352,6 +2496,27 @@ pub(in crate::api) async fn token_error_after_invalid_attempt(
     client_address: &str,
     credential_configuration_id: Option<&str>,
     error: TokenWireError,
+) -> Response {
+    token_error_after_invalid_attempt_with_access_mode(
+        state,
+        preauth,
+        path,
+        client_address,
+        credential_configuration_id,
+        AccessMode::SubjectBound,
+        error,
+    )
+    .await
+}
+
+async fn token_error_after_invalid_attempt_with_access_mode(
+    state: &RegistryNotaryApiState,
+    preauth: &PreAuthRuntime,
+    path: &str,
+    client_address: &str,
+    credential_configuration_id: Option<&str>,
+    access_mode: AccessMode,
+    error: TokenWireError,
 ) -> Response {
     if let Ok(hashed) = state
         .subject_access_rate_keys
@@ -1362,11 +2527,12 @@ pub(in crate::api) async fn token_error_after_invalid_attempt(
             .check_invalid_token_for_client_address(&hashed)
             .await;
     }
-    token_error_with_audit(
+    token_error_with_audit_access_mode(
         preauth,
         path,
         credential_configuration_id,
         SubjectAccessDenialCode::InvalidToken,
+        access_mode,
         error,
     )
     .await
@@ -1378,13 +2544,33 @@ pub(in crate::api) async fn token_error_with_audit(
     credential_configuration_id: Option<&str>,
     denial_code: SubjectAccessDenialCode,
     error: TokenWireError,
+) -> Response {
+    token_error_with_audit_access_mode(
+        preauth,
+        path,
+        credential_configuration_id,
+        denial_code,
+        AccessMode::SubjectBound,
+        error,
+    )
+    .await
+}
+
+async fn token_error_with_audit_access_mode(
+    preauth: &PreAuthRuntime,
+    path: &str,
+    credential_configuration_id: Option<&str>,
+    denial_code: SubjectAccessDenialCode,
+    access_mode: AccessMode,
+    error: TokenWireError,
 ) -> Response {
     let response = token_error_response(error);
-    let audit = token_error_audit_event(
+    let audit = token_error_audit_event_with_access_mode(
         path,
         response.status().as_u16(),
         credential_configuration_id,
         denial_code,
+        access_mode,
     );
     if preauth.emit_audit(&audit).await.is_err() {
         return token_error_after_audit_result(response, true);
@@ -1403,6 +2589,18 @@ pub(in crate::api) fn token_error_after_audit_result(
     }
 }
 
+pub(in crate::api) fn token_error_audit_event_with_access_mode(
+    path: &str,
+    status: u16,
+    credential_configuration_id: Option<&str>,
+    denial_code: SubjectAccessDenialCode,
+    access_mode: AccessMode,
+) -> EvidenceAuditEvent {
+    let mut audit = token_error_audit_event(path, status, credential_configuration_id, denial_code);
+    audit.access_mode = Some(access_mode);
+    audit
+}
+
 pub(in crate::api) fn token_error_audit_event(
     path: &str,
     status: u16,
diff --git a/crates/registry-notary-server/src/api/tests/credentials.rs b/crates/registry-notary-server/src/api/tests/credentials.rs
index 3d5eda4e8f..d986509542 100644
--- a/crates/registry-notary-server/src/api/tests/credentials.rs
+++ b/crates/registry-notary-server/src/api/tests/credentials.rs
@@ -58,6 +58,326 @@ impl CacheStore for UnavailableCredentialStatusStore {
     }
 }
 
+fn structured_direct_credential_evidence() -> EvidenceConfig {
+    let mut evidence = credential_issue_evidence_config();
+    let claim = evidence
+        .claims
+        .iter_mut()
+        .find(|claim| claim.id == "person-is-alive")
+        .expect("credential claim exists");
+    claim.value = registry_notary_core::ClaimValueConfig {
+        value_type: "object".to_string(),
+        nullable: true,
+        max_bytes: None,
+        unit: None,
+    };
+    claim.disclosure.default = "value".to_string();
+    claim.disclosure.allowed = vec!["value".to_string()];
+    claim.disclosure.downgrade = "deny".to_string();
+    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
+        panic!("credential claim is registry backed");
+    };
+    let consultation = consultations
+        .get_mut("person_status")
+        .expect("credential consultation exists");
+    consultation.outputs = BTreeMap::from([(
+        "record".to_string(),
+        registry_notary_core::RelayOutputContract::Object {
+            nullable: false,
+            max_bytes: 4_096,
+            fields: BTreeMap::from([
+                (
+                    "name".to_string(),
+                    registry_notary_core::RelayOutputObjectFieldContract {
+                        required: true,
+                        schema: Box::new(registry_notary_core::RelayOutputContract::String {
+                            nullable: false,
+                            max_bytes: 128,
+                        }),
+                    },
+                ),
+                (
+                    "parents".to_string(),
+                    registry_notary_core::RelayOutputObjectFieldContract {
+                        required: true,
+                        schema: Box::new(registry_notary_core::RelayOutputContract::Array {
+                            nullable: false,
+                            max_bytes: 2_048,
+                            max_items: 4,
+                            items: Box::new(registry_notary_core::RelayOutputContract::Object {
+                                nullable: false,
+                                max_bytes: 512,
+                                fields: BTreeMap::from([
+                                    (
+                                        "identifier".to_string(),
+                                        registry_notary_core::RelayOutputObjectFieldContract {
+                                            required: true,
+                                            schema: Box::new(
+                                                registry_notary_core::RelayOutputContract::String {
+                                                    nullable: false,
+                                                    max_bytes: 64,
+                                                },
+                                            ),
+                                        },
+                                    ),
+                                    (
+                                        "name".to_string(),
+                                        registry_notary_core::RelayOutputObjectFieldContract {
+                                            required: true,
+                                            schema: Box::new(
+                                                registry_notary_core::RelayOutputContract::String {
+                                                    nullable: false,
+                                                    max_bytes: 128,
+                                                },
+                                            ),
+                                        },
+                                    ),
+                                ]),
+                            }),
+                        }),
+                    },
+                ),
+            ]),
+        },
+    )]);
+    claim.rule = RuleConfig::ConsultationOutput {
+        consultation: "person_status".to_string(),
+        output: "record".to_string(),
+    };
+    evidence
+        .credential_profiles
+        .get_mut("civil_status_sd_jwt")
+        .expect("credential profile exists")
+        .disclosure
+        .allowed = vec!["value".to_string()];
+    evidence
+}
+
+fn bind_exact_stored_result(evaluation: &mut registry_notary_core::StoredEvaluation) {
+    let result_content_binding =
+        crate::runtime::issuance_result_content_binding(&evaluation.results[0])
+            .expect("structured result content binding hashes");
+    let issuance = evaluation
+        .issuance_provenance
+        .as_mut()
+        .expect("private issuance provenance exists");
+    let claim = issuance
+        .claims
+        .iter_mut()
+        .find(|claim| claim.claim_id == evaluation.results[0].claim_id)
+        .expect("selected claim provenance exists");
+    claim.result_content_binding = result_content_binding;
+    let consultation = issuance
+        .consultations
+        .iter()
+        .find(|consultation| consultation.consultation_id == claim.consultation_id)
+        .expect("selected consultation provenance exists");
+    claim.execution_binding = crate::runtime::issuance_execution_binding(
+        claim,
+        consultation,
+        &evaluation.results[0].evaluation_id,
+        &evaluation.results[0].issued_at,
+        &evaluation.results[0].provenance,
+    )
+    .expect("structured execution binding hashes");
+}
+
+#[tokio::test]
+async fn structured_result_issues_as_one_verifiable_direct_sd_jwt_disclosure() {
+    let evidence = Arc::new(structured_direct_credential_evidence());
+    let store = Arc::new(EvidenceStore::default());
+    let sign_count = Arc::new(AtomicUsize::new(0));
+    let evaluation_id = "eval-structured-direct";
+    let structured_value = json!({
+        "name": "Ada",
+        "parents": [
+            { "identifier": "PARENT-2", "name": "Grace" },
+            { "identifier": "PARENT-1", "name": "Charles" }
+        ]
+    });
+    let mut result = claim_result_view(evaluation_id, "person-is-alive");
+    result.value = Some(structured_value.clone());
+    result.satisfied = None;
+    result.disclosure = "value".to_string();
+    let mut evaluation = registry_notary_core::StoredEvaluation {
+        client_id: "caseworker".to_string(),
+        purpose: "test".to_string(),
+        claim_ids: vec!["person-is-alive".to_string()],
+        claim_refs: Vec::new(),
+        disclosure: "value".to_string(),
+        format: FORMAT_CLAIM_RESULT_JSON.to_string(),
+        results: vec![result],
+        created_at: "2026-05-23T00:00:00Z".to_string(),
+        expires_at: "2999-01-01T00:00:00Z".to_string(),
+        request_hash: "request-hash".to_string(),
+        issuance_provenance: Some(issuance_provenance(
+            "person-is-alive",
+            "test",
+            evaluation_id,
+        )),
+        subject_access: None,
+    };
+    bind_exact_stored_result(&mut evaluation);
+    store
+        .insert(evaluation.clone())
+        .await
+        .expect("structured evaluation inserts");
+    let state = Arc::new(
+        RegistryNotaryApiState::new_with_federation(
+            Arc::clone(&evidence),
+            Arc::new(SubjectAccessConfig::default()),
+            Arc::new(Oid4vciConfig::default()),
+            Arc::new(FederationConfig::default()),
+            AuditKeyHasher::unkeyed_dev_only(),
+            None,
+            ReplayStores::memory(),
+            CredentialStatusStore::disabled(),
+            Arc::new(AppMetrics::default()),
+            Arc::clone(&store),
+            Arc::new(CountingIssuerResolver {
+                sign_count: Arc::clone(&sign_count),
+            }),
+            None,
+        )
+        .expect("state builds"),
+    );
+    let principal = EvidencePrincipal {
+        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
+        principal_id: "caseworker".to_string(),
+        scopes: vec!["civil_registry:evidence_verification".to_string()],
+        access_mode: AccessMode::MachineClient,
+        verified_claims: None,
+        authorization_details: None,
+    };
+    let request = CredentialIssueRequest {
+        evaluation_id: evaluation_id.to_string(),
+        credential_profile: Some("civil_status_sd_jwt".to_string()),
+        format: Some(FORMAT_SD_JWT_VC.to_string()),
+        claims: Some(vec!["person-is-alive".to_string()]),
+        disclosure: Some("value".to_string()),
+        purpose: Some("test".to_string()),
+        holder: Some(HolderRequest {
+            binding: Some("did".to_string()),
+            id: Some(holder_did_jwk()),
+            proof: None,
+        }),
+    };
+
+    let response = issue_credential(
+        HeaderMap::new(),
+        Some(Extension(Arc::clone(&state))),
+        Some(Extension(principal.clone())),
+        Ok(Json(request.clone())),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let audit = response
+        .extensions()
+        .get::<EvidenceAuditContext>()
+        .expect("credential response carries value-free audit context");
+    let audit_debug = format!("{audit:?}");
+    for secret in ["Ada", "Grace", "Charles", "PARENT-1", "PARENT-2"] {
+        assert!(
+            !audit_debug.contains(secret),
+            "credential audit Debug must not expose {secret}"
+        );
+    }
+    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
+        .await
+        .expect("credential body reads");
+    let body: Value = serde_json::from_slice(&body).expect("credential response parses");
+    let disclosures = body["disclosures"]
+        .as_array()
+        .expect("response disclosures are an array");
+    assert_eq!(
+        disclosures.len(),
+        1,
+        "the complete structured claim is one top-level disclosure unit"
+    );
+    let encoded_disclosure = disclosures[0]
+        .as_str()
+        .expect("encoded disclosure is a string");
+    let decoded_disclosure: Value = serde_json::from_slice(
+        &URL_SAFE_NO_PAD
+            .decode(encoded_disclosure)
+            .expect("disclosure is base64url"),
+    )
+    .expect("disclosure is JSON");
+    assert_eq!(decoded_disclosure[1], json!("person-is-alive"));
+    assert_eq!(decoded_disclosure[2]["value"], structured_value);
+
+    let issuer_signed_jwt = body["issuer_signed_jwt"]
+        .as_str()
+        .expect("issuer-signed JWT exists");
+    let payload = decode_jwt_payload(issuer_signed_jwt);
+    let disclosure_digest = URL_SAFE_NO_PAD.encode(Sha256::digest(encoded_disclosure.as_bytes()));
+    assert!(
+        payload["_sd"]
+            .as_array()
+            .is_some_and(|digests| digests.contains(&json!(disclosure_digest))),
+        "the disclosed recursive value verifies against the issuer-signed _sd digest"
+    );
+    let withheld_presentation = format!("{issuer_signed_jwt}~");
+    assert!(!withheld_presentation.contains(encoded_disclosure));
+    assert!(!withheld_presentation.contains("Ada"));
+    let disclosed_presentation = format!("{issuer_signed_jwt}~{encoded_disclosure}~");
+    assert_eq!(
+        disclosed_presentation
+            .split('~')
+            .filter(|part| !part.is_empty())
+            .count(),
+        2,
+        "presenting the claim adds exactly one complete disclosure"
+    );
+    assert_eq!(sign_count.load(Ordering::SeqCst), 1);
+
+    evaluation.results[0].value.as_mut().unwrap()["parents"][0]["name"] = json!("Mallory");
+    store
+        .insert(evaluation)
+        .await
+        .expect("tampered structured evaluation inserts");
+    let tampered_status_store = CredentialStatusStore::with_test_store(
+        &CredentialStatusConfig {
+            enabled: true,
+            base_url: "https://issuer.example".to_string(),
+            retention_seconds: 60,
+        },
+        Arc::new(UnavailableCredentialStatusStore),
+    );
+    let tamper_state = Arc::new(
+        RegistryNotaryApiState::new_with_federation(
+            evidence,
+            Arc::new(SubjectAccessConfig::default()),
+            Arc::new(Oid4vciConfig::default()),
+            Arc::new(FederationConfig::default()),
+            AuditKeyHasher::unkeyed_dev_only(),
+            None,
+            ReplayStores::memory(),
+            tampered_status_store,
+            Arc::new(AppMetrics::default()),
+            store,
+            Arc::new(CountingIssuerResolver {
+                sign_count: Arc::clone(&sign_count),
+            }),
+            None,
+        )
+        .expect("tamper-check state builds"),
+    );
+    let denied = issue_credential(
+        HeaderMap::new(),
+        Some(Extension(tamper_state)),
+        Some(Extension(principal)),
+        Ok(Json(request)),
+    )
+    .await;
+    assert_eq!(denied.status(), StatusCode::FORBIDDEN);
+    assert_eq!(
+        sign_count.load(Ordering::SeqCst),
+        1,
+        "altered nested stored values are rejected before signing or the unavailable status store"
+    );
+}
+
 #[tokio::test]
 async fn registry_backed_evaluation_with_exact_provenance_issues_directly() {
     let evidence = credential_issue_evidence_with_dependency();
@@ -709,6 +1029,137 @@ async fn issuance_provenance_denial_precedes_signer_status_and_holder_replay() {
     assert_eq!(sign_count.load(Ordering::SeqCst), 1);
 }
 
+#[tokio::test]
+async fn replayed_holder_proof_does_not_consume_machine_evaluation_lineage() {
+    let mut evidence = credential_issue_evidence_config();
+    evidence
+        .credential_profiles
+        .get_mut("civil_status_sd_jwt")
+        .expect("credential profile exists")
+        .holder_binding = holder_required_profile().holder_binding;
+    let store = Arc::new(EvidenceStore::default());
+    let evaluation_id = "eval-replayed-proof";
+    let evaluation_expires_at = OffsetDateTime::now_utc() + time::Duration::hours(1);
+    let evaluation = registry_notary_core::StoredEvaluation {
+        client_id: "caseworker".to_string(),
+        purpose: "test".to_string(),
+        claim_ids: vec!["person-is-alive".to_string()],
+        claim_refs: Vec::new(),
+        disclosure: "predicate".to_string(),
+        format: FORMAT_CLAIM_RESULT_JSON.to_string(),
+        results: vec![claim_result_view(evaluation_id, "person-is-alive")],
+        created_at: format_time(OffsetDateTime::now_utc()),
+        expires_at: format_time(evaluation_expires_at),
+        request_hash: "request-hash".to_string(),
+        issuance_provenance: Some(issuance_provenance(
+            "person-is-alive",
+            "test",
+            evaluation_id,
+        )),
+        subject_access: None,
+    };
+    store
+        .insert(evaluation.clone())
+        .await
+        .expect("evaluation inserts");
+    let replay = ReplayStores::memory();
+    let preauth =
+        oid4vci_test_preauth_runtime(registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP);
+    let oid4vci = Oid4vciConfig {
+        enabled: true,
+        ..Oid4vciConfig::default()
+    };
+    let state = Arc::new(
+        RegistryNotaryApiState::new_with_federation(
+            Arc::new(evidence),
+            Arc::new(SubjectAccessConfig::default()),
+            Arc::new(oid4vci),
+            Arc::new(FederationConfig::default()),
+            AuditKeyHasher::unkeyed_dev_only(),
+            None,
+            replay.clone(),
+            CredentialStatusStore::disabled(),
+            Arc::new(AppMetrics::default()),
+            Arc::clone(&store),
+            Arc::new(CountingIssuerResolver {
+                sign_count: Arc::new(AtomicUsize::new(0)),
+            }),
+            None,
+        )
+        .expect("state builds")
+        .with_preauth_runtime(Some(Arc::clone(&preauth))),
+    );
+    let principal = EvidencePrincipal {
+        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
+        principal_id: "caseworker".to_string(),
+        scopes: vec!["civil_registry:evidence_verification".to_string()],
+        access_mode: AccessMode::MachineClient,
+        verified_claims: None,
+        authorization_details: None,
+    };
+    let holder_id = holder_did_jwk();
+    let now = OffsetDateTime::now_utc().unix_timestamp();
+    let proof = sign_holder_proof(
+        &holder_id,
+        json!({
+            "sub": holder_id,
+            "aud": "registry-notary",
+            "iat": now,
+            "exp": now + 60,
+            "jti": "already-used-holder-proof",
+            "evaluation_id": evaluation_id,
+            "credential_profile": "civil_status_sd_jwt",
+            "disclosure": holder_proof_disclosure("predicate"),
+            "claims": ["person-is-alive"],
+        }),
+    );
+    let request = CredentialIssueRequest {
+        evaluation_id: evaluation_id.to_string(),
+        credential_profile: Some("civil_status_sd_jwt".to_string()),
+        format: Some(FORMAT_SD_JWT_VC.to_string()),
+        claims: Some(vec!["person-is-alive".to_string()]),
+        disclosure: Some("predicate".to_string()),
+        purpose: Some("test".to_string()),
+        holder: Some(HolderRequest {
+            binding: Some("did".to_string()),
+            id: Some(holder_id),
+            proof: Some(proof),
+        }),
+    };
+    let binding = validate_holder_request(
+        &state.evidence.credential_profiles["civil_status_sd_jwt"],
+        "civil_status_sd_jwt",
+        &request,
+        &evaluation,
+        request.holder.as_ref(),
+        &state.evidence.service_id,
+    )
+    .expect("holder proof validates")
+    .expect("holder proof has a replay binding");
+    require_replay_insert(
+        replay.store().as_ref(),
+        &binding.scope,
+        &binding.key,
+        binding.expires_at,
+    )
+    .await
+    .expect("test pre-consumes holder proof");
+
+    let denied = issue_credential(
+        HeaderMap::new(),
+        Some(Extension(state)),
+        Some(Extension(principal)),
+        Ok(Json(request)),
+    )
+    .await;
+    assert_eq!(denied.status(), StatusCode::CONFLICT);
+    preauth
+        .preauthorization_state()
+        .reserve_evaluation_issuance(evaluation_id, "caseworker", evaluation_expires_at)
+        .await
+        .expect("proof replay denial must leave evaluation lineage available");
+}
+
 #[test]
 fn strict_credential_issue_rejects_oid4vci_proof_shape() {
     let holder_id = holder_did_jwk();
diff --git a/crates/registry-notary-server/src/api/tests/oid4vci.rs b/crates/registry-notary-server/src/api/tests/oid4vci.rs
index b29134728e..ead60826d3 100644
--- a/crates/registry-notary-server/src/api/tests/oid4vci.rs
+++ b/crates/registry-notary-server/src/api/tests/oid4vci.rs
@@ -689,6 +689,278 @@ async fn oid4vci_token_error_fails_closed_when_denial_audit_fails() {
     assert_eq!(body["error"], "server_error");
 }
 
+#[cfg(feature = "registry-notary-cel")]
+#[derive(Debug, Default)]
+struct StructuredRegistryCredentialRelay {
+    calls: AtomicUsize,
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[async_trait::async_trait]
+impl crate::runtime::ActivatedRelayConsultations for StructuredRegistryCredentialRelay {
+    async fn check_ready(&self) -> Result<(), crate::relay_client::RelayClientError> {
+        Ok(())
+    }
+
+    fn validate(
+        &self,
+        _key: &crate::runtime::consultation::ConsultationGroupKeyV1,
+    ) -> Result<(), crate::relay_client::RelayClientError> {
+        Ok(())
+    }
+
+    async fn execute(
+        &self,
+        _key: &crate::runtime::consultation::ConsultationGroupKeyV1,
+    ) -> Result<
+        crate::runtime::consultation::RuntimeRelayConsultationResult,
+        crate::relay_client::RelayClientError,
+    > {
+        self.calls.fetch_add(1, Ordering::SeqCst);
+        let outputs =
+            crate::runtime::consultation::RuntimeRelayOutputMap::from_json(BTreeMap::from([(
+                "record".to_string(),
+                json!({
+                    "name": "Ada",
+                    "parents": [
+                        { "identifier": "PARENT-2", "name": "Grace" },
+                        { "identifier": "PARENT-1", "name": "Charles" }
+                    ]
+                }),
+            )]))?;
+        crate::runtime::consultation::RuntimeRelayConsultationResult::new(
+            ulid::Ulid::new(),
+            crate::runtime::consultation::RuntimeRelayOutcome::Match,
+            Some(crate::runtime::consultation::RuntimeRelayMatchData::OutputMap(outputs)),
+            OffsetDateTime::now_utc(),
+        )
+    }
+}
+
+#[cfg(feature = "registry-notary-cel")]
+fn structured_oid4vci_configs() -> (SubjectAccessConfig, EvidenceConfig, Oid4vciConfig) {
+    let mut subject_access = subject_access_config();
+    subject_access.allowed_disclosures = vec!["value".to_string()];
+
+    let mut evidence = registry_backed_oid4vci_evidence_config();
+    let claim = evidence
+        .claims
+        .iter_mut()
+        .find(|claim| claim.id == "person-is-alive")
+        .expect("OID4VCI claim exists");
+    claim.value = registry_notary_core::ClaimValueConfig {
+        value_type: "object".to_string(),
+        nullable: true,
+        max_bytes: None,
+        unit: None,
+    };
+    claim.disclosure.default = "value".to_string();
+    claim.disclosure.allowed = vec!["value".to_string()];
+    claim.disclosure.downgrade = "deny".to_string();
+    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
+        panic!("OID4VCI claim is registry backed");
+    };
+    let consultation = consultations
+        .get_mut("person_status")
+        .expect("OID4VCI consultation exists");
+    consultation.outputs = BTreeMap::from([(
+        "record".to_string(),
+        registry_notary_core::RelayOutputContract::Object {
+            nullable: false,
+            max_bytes: 4_096,
+            fields: BTreeMap::from([
+                (
+                    "name".to_string(),
+                    registry_notary_core::RelayOutputObjectFieldContract {
+                        required: true,
+                        schema: Box::new(registry_notary_core::RelayOutputContract::String {
+                            nullable: false,
+                            max_bytes: 128,
+                        }),
+                    },
+                ),
+                (
+                    "parents".to_string(),
+                    registry_notary_core::RelayOutputObjectFieldContract {
+                        required: true,
+                        schema: Box::new(registry_notary_core::RelayOutputContract::Array {
+                            nullable: false,
+                            max_bytes: 2_048,
+                            max_items: 4,
+                            items: Box::new(registry_notary_core::RelayOutputContract::Object {
+                                nullable: false,
+                                max_bytes: 512,
+                                fields: BTreeMap::from([
+                                    (
+                                        "identifier".to_string(),
+                                        registry_notary_core::RelayOutputObjectFieldContract {
+                                            required: true,
+                                            schema: Box::new(
+                                                registry_notary_core::RelayOutputContract::String {
+                                                    nullable: false,
+                                                    max_bytes: 64,
+                                                },
+                                            ),
+                                        },
+                                    ),
+                                    (
+                                        "name".to_string(),
+                                        registry_notary_core::RelayOutputObjectFieldContract {
+                                            required: true,
+                                            schema: Box::new(
+                                                registry_notary_core::RelayOutputContract::String {
+                                                    nullable: false,
+                                                    max_bytes: 128,
+                                                },
+                                            ),
+                                        },
+                                    ),
+                                ]),
+                            }),
+                        }),
+                    },
+                ),
+            ]),
+        },
+    )]);
+    claim.rule = RuleConfig::ConsultationOutput {
+        consultation: "person_status".to_string(),
+        output: "record".to_string(),
+    };
+    evidence
+        .credential_profiles
+        .get_mut("civil_status_sd_jwt")
+        .expect("OID4VCI credential profile exists")
+        .disclosure
+        .allowed = vec!["value".to_string()];
+
+    let mut oid4vci = oid4vci_config();
+    oid4vci.accepted_token_audiences = vec!["registry-notary-citizen".to_string()];
+    let configuration = oid4vci
+        .credential_configurations
+        .get_mut("person_is_alive_sd_jwt")
+        .expect("OID4VCI credential configuration exists");
+    configuration.claim_id = None;
+    configuration.claims = vec![registry_notary_core::Oid4vciCredentialClaimConfig {
+        id: "person-is-alive".to_string(),
+        output_path: vec!["person_record".to_string()],
+        display_name: "Person record".to_string(),
+        sd: "always".to_string(),
+    }];
+    (subject_access, evidence, oid4vci)
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_preserves_structured_result_as_one_verifiable_sd_jwt_disclosure() {
+    let store = Arc::new(EvidenceStore::default());
+    let (subject_access, evidence, oid4vci) = structured_oid4vci_configs();
+    let evidence = Arc::new(evidence);
+    let subject_access = Arc::new(subject_access);
+    let oid4vci = Arc::new(oid4vci);
+    let sign_count = Arc::new(AtomicUsize::new(0));
+    let preauth =
+        oid4vci_test_preauth_runtime(registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP);
+    let state = Arc::new(
+        RegistryNotaryApiState::new_with_subject_access_and_oid4vci(
+            Arc::clone(&evidence),
+            Arc::clone(&subject_access),
+            Arc::clone(&oid4vci),
+            oid4vci_test_audit_hasher(),
+            Arc::clone(&store),
+            Arc::new(CountingIssuerResolver {
+                sign_count: Arc::clone(&sign_count),
+            }),
+        )
+        .with_preauth_runtime(Some(Arc::clone(&preauth))),
+    );
+    let relay = Arc::new(StructuredRegistryCredentialRelay::default());
+    state
+        .install_activated_relay(relay.clone())
+        .expect("structured Registry Relay activates once");
+    let nonce = "structured-oid4vci-nonce";
+    let test_transaction = reserve_registry_backed_oid4vci_test_transaction(
+        &state,
+        &preauth,
+        "person_is_alive_sd_jwt",
+        nonce,
+    )
+    .await;
+    assert_eq!(relay.calls.load(Ordering::SeqCst), 1);
+
+    let stored = store
+        .get(
+            &test_transaction.transaction.evaluation_id,
+            &test_transaction.transaction.evaluation_client_id,
+        )
+        .await
+        .expect("structured evaluation reads")
+        .expect("structured evaluation is stored");
+    let expected_value = json!({
+        "name": "Ada",
+        "parents": [
+            { "identifier": "PARENT-2", "name": "Grace" },
+            { "identifier": "PARENT-1", "name": "Charles" }
+        ]
+    });
+    assert_eq!(stored.results[0].value, Some(expected_value.clone()));
+    assert_eq!(stored.results[0].disclosure, "value");
+
+    let proof = sign_oid4vci_proof(&state.oid4vci.credential_issuer, nonce);
+    let response = oid4vci_credential(
+        Some(Extension(Arc::clone(&state))),
+        Some(Extension(test_transaction.principal)),
+        Some(Extension(validated_oid4vci_proof(
+            &state,
+            &proof,
+            Some(nonce),
+        ))),
+        Json(Oid4vciCredentialRequest {
+            format: SD_JWT_VC_FORMAT.to_string(),
+            credential_identifier: Some("person_is_alive_sd_jwt".to_string()),
+            credential_configuration_id: None,
+            vct: None,
+            proof: registry_platform_oid4vci::CredentialRequestProof {
+                proof_type: PROOF_TYPE_JWT.to_string(),
+                jwt: proof,
+            },
+            proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
+        }),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
+        .await
+        .expect("OID4VCI credential body reads");
+    let body: Value = serde_json::from_slice(&body).expect("OID4VCI credential body parses");
+    let compact = body["credential"]
+        .as_str()
+        .expect("OID4VCI returns compact SD-JWT");
+    let parts = compact
+        .split('~')
+        .filter(|part| !part.is_empty())
+        .collect::<Vec<_>>();
+    assert_eq!(
+        parts.len(),
+        2,
+        "OID4VCI presents the complete structured result as one disclosure"
+    );
+    let decoded: Value = serde_json::from_slice(
+        &URL_SAFE_NO_PAD
+            .decode(parts[1])
+            .expect("OID4VCI disclosure is base64url"),
+    )
+    .expect("OID4VCI disclosure is JSON");
+    assert_eq!(decoded[1], json!("person_record"));
+    assert_eq!(decoded[2], expected_value);
+    let payload = decode_jwt_payload(parts[0]);
+    let digest = URL_SAFE_NO_PAD.encode(Sha256::digest(parts[1].as_bytes()));
+    assert!(payload["_sd"]
+        .as_array()
+        .is_some_and(|digests| digests.contains(&json!(digest))));
+    assert_eq!(sign_count.load(Ordering::SeqCst), 1);
+}
+
 #[cfg(feature = "registry-notary-cel")]
 #[tokio::test]
 async fn oid4vci_projected_registry_credential_issues_and_caches_exact_retry() {
@@ -1554,3 +1826,1695 @@ fn holder_proof_exp_window_is_bounded_below_and_above() {
     )
     .expect("exp = iat + 1 must be accepted");
 }
+
+const REGISTRY_OFFER_CONFIGURATION_ID: &str = "person_is_alive_sd_jwt";
+#[cfg(feature = "registry-notary-cel")]
+const REGISTRY_OFFER_EVALUATE_SCOPE: &str = "registry:evidence";
+#[cfg(feature = "registry-notary-cel")]
+const REGISTRY_OFFER_PRINCIPAL_ID: &str = "registrar-a";
+#[cfg(feature = "registry-notary-cel")]
+const REGISTRY_OFFER_PURPOSE: &str = "citizen_subject_access";
+
+#[cfg(feature = "registry-notary-cel")]
+struct RegistryOfferTestFixture {
+    state: Arc<RegistryNotaryApiState>,
+    preauth: Arc<PreAuthRuntime>,
+    principal: EvidencePrincipal,
+    store: Arc<EvidenceStore>,
+}
+
+#[cfg(feature = "registry-notary-cel")]
+fn registry_offer_test_evidence() -> EvidenceConfig {
+    let mut evidence = registry_backed_oid4vci_evidence_config();
+    evidence.allowed_purposes = vec![REGISTRY_OFFER_PURPOSE.to_string()];
+    let claim = evidence.claims.first_mut().expect("claim exists");
+    claim.required_scopes = vec![REGISTRY_OFFER_EVALUATE_SCOPE.to_string()];
+    claim.disclosure.default = DisclosureProfile::Value.as_str().to_string();
+    claim.disclosure.allowed = vec![DisclosureProfile::Value.as_str().to_string()];
+    evidence
+        .credential_profiles
+        .get_mut("civil_status_sd_jwt")
+        .expect("credential profile exists")
+        .disclosure
+        .allowed = vec![DisclosureProfile::Value.as_str().to_string()];
+    let mut registered = evidence.claims[0].clone();
+    registered.id = "person-is-registered".to_string();
+    registered.title = "Person is registered".to_string();
+    evidence.claims.push(registered);
+    evidence
+        .credential_profiles
+        .get_mut("civil_status_sd_jwt")
+        .expect("credential profile exists")
+        .allowed_claims
+        .push("person-is-registered".to_string());
+    evidence
+}
+
+#[cfg(feature = "registry-notary-cel")]
+fn registry_offer_test_oid4vci() -> Oid4vciConfig {
+    let mut oid4vci = oid4vci_config();
+    oid4vci.pre_authorized_code.enabled = true;
+    oid4vci.accepted_token_audiences = vec!["registry-notary-citizen".to_string()];
+    let configuration = oid4vci
+        .credential_configurations
+        .get_mut(REGISTRY_OFFER_CONFIGURATION_ID)
+        .expect("registry offer credential configuration exists");
+    configuration.claim_id = None;
+    configuration.claims = vec![
+        registry_notary_core::Oid4vciCredentialClaimConfig {
+            id: "person-is-alive".to_string(),
+            output_path: vec!["person_alive".to_string()],
+            display_name: "Person is alive".to_string(),
+            sd: "always".to_string(),
+        },
+        registry_notary_core::Oid4vciCredentialClaimConfig {
+            id: "person-is-registered".to_string(),
+            output_path: vec!["person_registered".to_string()],
+            display_name: "Person is registered".to_string(),
+            sd: "always".to_string(),
+        },
+    ];
+    oid4vci
+}
+
+#[cfg(feature = "registry-notary-cel")]
+fn registry_offer_machine_principal(
+    state: &RegistryNotaryApiState,
+    principal_id: &str,
+) -> EvidencePrincipal {
+    let configuration = &state.oid4vci.credential_configurations[REGISTRY_OFFER_CONFIGURATION_ID];
+    EvidencePrincipal {
+        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
+        principal_id: principal_id.to_string(),
+        scopes: vec![
+            REGISTRY_OFFER_EVALUATE_SCOPE.to_string(),
+            REGISTRY_OFFER_CREATE_SCOPE.to_string(),
+            configuration.scope.clone(),
+        ],
+        access_mode: AccessMode::MachineClient,
+        verified_claims: None,
+        authorization_details: None,
+    }
+}
+
+#[cfg(feature = "registry-notary-cel")]
+fn registry_offer_authorization_details(
+    state: &RegistryNotaryApiState,
+    target_id: &str,
+) -> EvidenceAuthorizationDetails {
+    EvidenceAuthorizationDetails {
+        detail_type: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE.to_string(),
+        schema_version: registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION
+            .to_string(),
+        actions: vec!["create_credential_offer".to_string()],
+        locations: vec![state.evidence.service_id.clone()],
+        // Deliberately reverse configuration order. Authorization is an exact
+        // set; configuration order is authoritative only for projection.
+        claims: vec![
+            ClaimRef::from("person-is-registered"),
+            ClaimRef::from("person-is-alive"),
+        ],
+        disclosure: Some(DisclosureProfile::Value.as_str().to_string()),
+        format: Some(FORMAT_CLAIM_RESULT_JSON.to_string()),
+        purpose: Some(REGISTRY_OFFER_PURPOSE.to_string()),
+        target: Some(registry_notary_core::EvidenceAuthorizationTarget {
+            id_type: "national_id".to_string(),
+            id: target_id.to_string(),
+        }),
+        access_mode: Some(AccessMode::MachineClient),
+        ..Default::default()
+    }
+}
+
+#[cfg(feature = "registry-notary-cel")]
+fn registry_offer_headers(idempotency_key: &str) -> HeaderMap {
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        IDEMPOTENCY_KEY_HEADER,
+        HeaderValue::from_str(idempotency_key).expect("test idempotency key is a valid header"),
+    );
+    headers
+}
+
+#[cfg(feature = "registry-notary-cel")]
+async fn registry_offer_fixture() -> RegistryOfferTestFixture {
+    registry_offer_fixture_with(
+        registry_offer_test_evidence(),
+        oid4vci_test_preauth_runtime(registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP),
+    )
+    .await
+}
+
+#[cfg(feature = "registry-notary-cel")]
+async fn registry_offer_fixture_with(
+    evidence: EvidenceConfig,
+    preauth: Arc<PreAuthRuntime>,
+) -> RegistryOfferTestFixture {
+    let evidence = Arc::new(evidence);
+    let oid4vci = Arc::new(registry_offer_test_oid4vci());
+    let store = Arc::new(EvidenceStore::default());
+    let mut subject_access = subject_access_config();
+    subject_access
+        .rate_limits
+        .tx_code_attempts_per_code_per_minute = 5;
+    let state = Arc::new(
+        RegistryNotaryApiState::new_with_subject_access_and_oid4vci(
+            Arc::clone(&evidence),
+            Arc::new(subject_access),
+            oid4vci,
+            oid4vci_test_audit_hasher(),
+            Arc::clone(&store),
+            Arc::new(TestIssuerResolver),
+        )
+        .with_preauth_runtime(Some(Arc::clone(&preauth))),
+    );
+    state
+        .install_activated_relay(Arc::new(RegistryCredentialRelay::default()))
+        .expect("registry offer test Relay activates once");
+    let principal = registry_offer_machine_principal(&state, REGISTRY_OFFER_PRINCIPAL_ID);
+    RegistryOfferTestFixture {
+        state,
+        preauth,
+        principal,
+        store,
+    }
+}
+
+#[cfg(feature = "registry-notary-cel")]
+async fn registry_offer_evaluate(fixture: &RegistryOfferTestFixture, target_id: &str) -> String {
+    let mut request = evaluate_request(target_id);
+    request.claims = vec![
+        ClaimRef::from("person-is-registered"),
+        ClaimRef::from("person-is-alive"),
+    ];
+    let target = request.target.as_mut().expect("evaluation target exists");
+    target.id = Some(format!("registry-record:{target_id}"));
+    target
+        .identifiers
+        .push(registry_notary_core::EvidenceIdentifier {
+            scheme: "registry_file_number".to_string(),
+            value: format!("FILE-{target_id}"),
+            issuer: Some("civil-registry".to_string()),
+            country: Some("ZZ".to_string()),
+        });
+    target
+        .attributes
+        .insert("registry_region".to_string(), json!("central"));
+    request.disclosure = Some(DisclosureProfile::Value.as_str().to_string());
+    request.purpose = Some(REGISTRY_OFFER_PURPOSE.to_string());
+    let response = evaluate(
+        HeaderMap::new(),
+        Some(Extension(Arc::clone(&fixture.state))),
+        Some(Extension(fixture.principal.clone())),
+        None,
+        Ok(Json(request)),
+    )
+    .await;
+    assert_eq!(
+        response.status(),
+        StatusCode::OK,
+        "registry-client evaluation succeeds"
+    );
+    let body = to_bytes(response.into_body(), 64 * 1024)
+        .await
+        .expect("evaluation body reads");
+    let body: Value = serde_json::from_slice(&body).expect("evaluation body parses");
+    body["results"][0]["evaluation_id"]
+        .as_str()
+        .expect("evaluation id is returned")
+        .to_string()
+}
+
+#[cfg(feature = "registry-notary-cel")]
+async fn registry_offer_create(
+    fixture: &RegistryOfferTestFixture,
+    principal: EvidencePrincipal,
+    evaluation_id: &str,
+    idempotency_key: &str,
+) -> Response {
+    oid4vci_create_registry_offer(
+        registry_offer_headers(idempotency_key),
+        Some(Extension(Arc::clone(&fixture.state))),
+        Some(Extension(principal)),
+        Ok(Json(Oid4vciRegistryOfferRequest {
+            evaluation_id: evaluation_id.to_string(),
+            credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
+        })),
+    )
+    .await
+}
+
+#[cfg(feature = "registry-notary-cel")]
+async fn registry_offer_response_json(response: Response) -> Value {
+    let body = to_bytes(response.into_body(), 64 * 1024)
+        .await
+        .expect("offer body reads");
+    serde_json::from_slice(&body).expect("offer body parses")
+}
+
+#[cfg(feature = "registry-notary-cel")]
+fn percent_decode_query_value(encoded: &str) -> String {
+    fn hex(byte: u8) -> Option<u8> {
+        match byte {
+            b'0'..=b'9' => Some(byte - b'0'),
+            b'a'..=b'f' => Some(byte - b'a' + 10),
+            b'A'..=b'F' => Some(byte - b'A' + 10),
+            _ => None,
+        }
+    }
+
+    let bytes = encoded.as_bytes();
+    let mut decoded = Vec::with_capacity(bytes.len());
+    let mut index = 0;
+    while index < bytes.len() {
+        if bytes[index] == b'%' && index + 2 < bytes.len() {
+            if let (Some(high), Some(low)) = (hex(bytes[index + 1]), hex(bytes[index + 2])) {
+                decoded.push((high << 4) | low);
+                index += 3;
+            } else {
+                decoded.push(bytes[index]);
+                index += 1;
+            }
+        } else {
+            decoded.push(bytes[index]);
+            index += 1;
+        }
+    }
+    String::from_utf8(decoded).expect("offer query is UTF-8")
+}
+
+#[cfg(feature = "registry-notary-cel")]
+fn credential_offer_from_uri(uri: &str) -> Value {
+    let encoded = uri
+        .strip_prefix("openid-credential-offer://?credential_offer=")
+        .expect("credential offer URI uses the registered scheme");
+    serde_json::from_str(&percent_decode_query_value(encoded)).expect("credential offer parses")
+}
+
+#[cfg(feature = "registry-notary-cel")]
+fn form_encoded_token_request(pre_authorized_code: &str, tx_code: &str) -> Bytes {
+    Bytes::from(format!(
+        "grant_type={}&pre-authorized_code={}&tx_code={}",
+        url_percent_encode(PRE_AUTHORIZED_CODE_GRANT_TYPE),
+        url_percent_encode(pre_authorized_code),
+        url_percent_encode(tx_code),
+    ))
+}
+
+#[cfg(feature = "registry-notary-cel")]
+fn principal_from_registry_offer_access_token(
+    fixture: &RegistryOfferTestFixture,
+    access_token: &str,
+) -> EvidencePrincipal {
+    let verified = verify_notary_token(
+        access_token,
+        fixture.preauth.access_token_verification_keys()[0].public_jwk(),
+        fixture.preauth.access_token_typ(),
+        fixture.preauth.notary_issuer(),
+        fixture.preauth.notary_audiences(),
+        OffsetDateTime::now_utc().unix_timestamp(),
+    )
+    .expect("access token verifies");
+    let payload = &verified.payload;
+    let audiences = match &payload["aud"] {
+        Value::String(audience) => vec![bounded(audience)],
+        Value::Array(audiences) => audiences
+            .iter()
+            .map(|audience| bounded(audience.as_str().expect("audience is a string")))
+            .collect(),
+        _ => panic!("access token has a string or array audience"),
+    };
+    let authorization_details = payload["authorization_details"]
+        .as_array()
+        .and_then(|details| details.first())
+        .cloned()
+        .map(serde_json::from_value)
+        .transpose()
+        .expect("authorization details parse");
+    EvidencePrincipal {
+        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken,
+        principal_id: payload["sub"]
+            .as_str()
+            .expect("access token subject")
+            .to_string(),
+        scopes: verified.scopes(),
+        access_mode: AccessMode::MachineClient,
+        verified_claims: Some(BoundedVerifiedClaims {
+            issuer: bounded(payload["iss"].as_str().expect("access token issuer")),
+            audiences,
+            client_id: payload["client_id"]
+                .as_str()
+                .map(|client_id| bounded(&format!("client_id:{client_id}"))),
+            token_type: payload["token_type"].as_str().map(bounded),
+            credential_configuration_id: payload["credential_configuration_id"]
+                .as_str()
+                .map(bounded),
+            issuance_transaction_id: payload["issuance_transaction_id"].as_str().map(bounded),
+            issuance_transaction_commitment: payload["issuance_transaction_commitment"]
+                .as_str()
+                .map(bounded),
+            scopes: verified
+                .scopes()
+                .iter()
+                .map(|scope| bounded(scope))
+                .collect(),
+            subject: payload["sub"].as_str().map(bounded),
+            subject_binding_claim: Some(
+                VerifiedClaimName::new(&fixture.state.subject_access.subject_binding.token_claim)
+                    .expect("subject-binding claim is bounded"),
+            ),
+            subject_binding_value: payload
+                [&fixture.state.subject_access.subject_binding.token_claim]
+                .as_str()
+                .map(bounded),
+            acr: None,
+            auth_time: None,
+            exp: payload["exp"].as_i64(),
+            iat: payload["iat"].as_i64(),
+            nbf: payload["nbf"].as_i64(),
+        }),
+        authorization_details,
+    }
+}
+
+#[test]
+fn oid4vci_registry_offer_request_has_a_closed_minimal_wire_shape() {
+    let valid = json!({
+        "evaluation_id": "01KTEST",
+        "credential_configuration_id": REGISTRY_OFFER_CONFIGURATION_ID,
+    });
+    serde_json::from_value::<Oid4vciRegistryOfferRequest>(valid.clone())
+        .expect("the two-field request parses");
+
+    let mut missing_evaluation = valid.clone();
+    missing_evaluation
+        .as_object_mut()
+        .expect("request is an object")
+        .remove("evaluation_id");
+    assert!(serde_json::from_value::<Oid4vciRegistryOfferRequest>(missing_evaluation).is_err());
+
+    let mut extra_target = valid;
+    extra_target["target_id"] = json!("NAT-SECRET");
+    assert!(serde_json::from_value::<Oid4vciRegistryOfferRequest>(extra_target).is_err());
+}
+
+#[test]
+fn oid4vci_registry_offer_unavailable_response_is_explicitly_retryable() {
+    let response = registry_offer_problem(StatusCode::SERVICE_UNAVAILABLE, "offer_unavailable");
+    assert_eq!(
+        response.headers()[header::RETRY_AFTER],
+        HeaderValue::from_static(REGISTRY_OFFER_OPERATION_RETRY_AFTER_SECONDS)
+    );
+}
+
+#[test]
+fn oid4vci_token_audit_mode_follows_issuance_authority_without_exposing_values() {
+    assert_eq!(
+        issuance_authority_access_mode(&IssuanceAuthority::SubjectAccess),
+        AccessMode::SubjectBound
+    );
+    let authority = IssuanceAuthority::RegistryClient {
+        initiating_client_id: "registrar-audit-secret".to_string(),
+        initiating_client_id_hash: "hmac-sha256:registrar".to_string(),
+        auth_profile_id: registry_notary_core::EvidenceAuthProfileId::StaticApiKey,
+        authorized_scopes: vec![REGISTRY_OFFER_CREATE_SCOPE.to_string()],
+        target_ref: TargetRefView {
+            entity_type: "Person".to_string(),
+            handle: "hmac-sha256:target-secret".to_string(),
+            identifier_schemes: vec!["national_id".to_string()],
+            profile: None,
+        },
+        service_id: "https://notary.example.test".to_string(),
+        purpose: "audit-purpose-secret".to_string(),
+    };
+    assert_eq!(
+        issuance_authority_access_mode(&authority),
+        AccessMode::MachineClient
+    );
+    let debug = format!("{authority:?}");
+    assert!(!debug.contains("registrar-audit-secret"));
+    assert!(!debug.contains("target-secret"));
+    assert!(!debug.contains("audit-purpose-secret"));
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_completes_machine_evaluation_to_wallet_credential() {
+    let fixture = registry_offer_fixture().await;
+    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-REGISTRAR-001").await;
+    let mut short_evaluation = fixture
+        .store
+        .get(&evaluation_id, REGISTRY_OFFER_PRINCIPAL_ID)
+        .await
+        .expect("stored evaluation read succeeds")
+        .expect("stored evaluation exists");
+    short_evaluation.expires_at =
+        format_time(OffsetDateTime::now_utc() + time::Duration::seconds(90));
+    fixture
+        .store
+        .insert(short_evaluation)
+        .await
+        .expect("short evaluation lifetime fixture writes");
+    let mut principal = fixture.principal.clone();
+    principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-REGISTRAR-001",
+    ));
+
+    let offer_response = registry_offer_create(
+        &fixture,
+        principal,
+        &evaluation_id,
+        "registrar-offer-journey",
+    )
+    .await;
+    assert_eq!(offer_response.status(), StatusCode::OK);
+    assert_eq!(
+        offer_response.headers()[header::CACHE_CONTROL],
+        HeaderValue::from_static("no-store")
+    );
+    assert_eq!(
+        offer_response.headers()[header::PRAGMA],
+        HeaderValue::from_static("no-cache")
+    );
+    let offer_body = registry_offer_response_json(offer_response).await;
+    let offer_uri = offer_body["credential_offer_uri"]
+        .as_str()
+        .expect("offer URI is returned");
+    let tx_code = offer_body["tx_code"]
+        .as_str()
+        .expect("transaction code is delivered separately");
+    assert_eq!(tx_code.len(), 6);
+    assert!(tx_code.bytes().all(|byte| byte.is_ascii_digit()));
+    assert!(
+        !offer_uri.contains(tx_code),
+        "out-of-band transaction code must not enter the offer URI"
+    );
+    let offer = credential_offer_from_uri(offer_uri);
+    let grant = &offer["grants"][PRE_AUTHORIZED_CODE_GRANT_TYPE];
+    let pre_authorized_code = grant["pre-authorized_code"]
+        .as_str()
+        .expect("offer carries a pre-authorized code");
+    assert_eq!(grant["tx_code"]["length"], 6);
+    let verified_code = verify_notary_token(
+        pre_authorized_code,
+        fixture.preauth.access_token_verification_keys()[0].public_jwk(),
+        PRE_AUTHORIZED_CODE_JWT_TYP,
+        fixture.preauth.notary_issuer(),
+        &[],
+        OffsetDateTime::now_utc().unix_timestamp(),
+    )
+    .expect("pre-authorized code verifies");
+    assert!(
+        !verified_code.payload.to_string().contains(tx_code),
+        "the signed bearer grant must not disclose its second factor"
+    );
+
+    let mut token_headers = HeaderMap::new();
+    token_headers.insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_static("application/x-www-form-urlencoded"),
+    );
+    let wrong_tx_code = if tx_code == "000000" {
+        "111111"
+    } else {
+        "000000"
+    };
+    let wrong_pin_response = oid4vci_token(
+        Some(Extension(Arc::clone(&fixture.state))),
+        None,
+        token_headers.clone(),
+        form_encoded_token_request(pre_authorized_code, wrong_tx_code),
+    )
+    .await;
+    assert_eq!(wrong_pin_response.status(), StatusCode::BAD_REQUEST);
+    let wrong_pin_body = to_bytes(wrong_pin_response.into_body(), 64 * 1024)
+        .await
+        .expect("wrong-PIN response reads");
+    let wrong_pin_body: Value =
+        serde_json::from_slice(&wrong_pin_body).expect("wrong-PIN response parses");
+    assert_eq!(wrong_pin_body["error"], "invalid_grant");
+    assert!(!wrong_pin_body.to_string().contains(tx_code));
+    assert_eq!(
+        token_error_audit_event_with_access_mode(
+            "/oid4vci/token",
+            StatusCode::BAD_REQUEST.as_u16(),
+            Some(REGISTRY_OFFER_CONFIGURATION_ID),
+            SubjectAccessDenialCode::InvalidToken,
+            AccessMode::MachineClient,
+        )
+        .access_mode,
+        Some(AccessMode::MachineClient),
+        "the wrong-PIN audit path retains the loaded registry transaction mode",
+    );
+
+    let token_response = oid4vci_token(
+        Some(Extension(Arc::clone(&fixture.state))),
+        None,
+        token_headers.clone(),
+        form_encoded_token_request(pre_authorized_code, tx_code),
+    )
+    .await;
+    assert_eq!(token_response.status(), StatusCode::OK);
+    let token_body = to_bytes(token_response.into_body(), 64 * 1024)
+        .await
+        .expect("token response reads");
+    let token_body: Value = serde_json::from_slice(&token_body).expect("token response parses");
+    let expires_in = token_body["expires_in"]
+        .as_u64()
+        .expect("access token lifetime is returned");
+    assert!(
+        (1..=90).contains(&expires_in),
+        "access token lifetime is capped to the authoritative transaction remainder",
+    );
+    let access_token = token_body["access_token"]
+        .as_str()
+        .expect("access token is returned");
+    let nonce = token_body["c_nonce"]
+        .as_str()
+        .expect("credential nonce is returned");
+    let wallet_principal = principal_from_registry_offer_access_token(&fixture, access_token);
+    assert_eq!(wallet_principal.access_mode(), AccessMode::MachineClient);
+    assert_ne!(wallet_principal.principal_id, "NAT-REGISTRAR-001");
+    let verified_access = verify_notary_token(
+        access_token,
+        fixture.preauth.access_token_verification_keys()[0].public_jwk(),
+        fixture.preauth.access_token_typ(),
+        fixture.preauth.notary_issuer(),
+        fixture.preauth.notary_audiences(),
+        OffsetDateTime::now_utc().unix_timestamp(),
+    )
+    .expect("access token verifies");
+    assert_eq!(
+        u64::try_from(
+            verified_access.payload["exp"]
+                .as_i64()
+                .expect("access token exp exists")
+                - verified_access.payload["iat"]
+                    .as_i64()
+                    .expect("access token iat exists"),
+        )
+        .expect("access token lifetime is positive"),
+        expires_in,
+    );
+    let access_payload = verified_access.payload.to_string();
+    assert!(!access_payload.contains(REGISTRY_OFFER_PRINCIPAL_ID));
+    assert!(!access_payload.contains("NAT-REGISTRAR-001"));
+    assert_eq!(
+        verified_access.payload["act"]["type"],
+        json!("registry_client")
+    );
+    let code_replay = oid4vci_token(
+        Some(Extension(Arc::clone(&fixture.state))),
+        None,
+        token_headers,
+        form_encoded_token_request(pre_authorized_code, tx_code),
+    )
+    .await;
+    assert_eq!(code_replay.status(), StatusCode::BAD_REQUEST);
+    let code_replay_body = to_bytes(code_replay.into_body(), 64 * 1024)
+        .await
+        .expect("code replay response reads");
+    let code_replay_body: Value =
+        serde_json::from_slice(&code_replay_body).expect("code replay response parses");
+    assert_eq!(code_replay_body["error"], "invalid_grant");
+    assert!(!code_replay_body.to_string().contains(tx_code));
+
+    let proof = sign_oid4vci_proof(&fixture.state.oid4vci.credential_issuer, nonce);
+    let credential_response = oid4vci_credential(
+        Some(Extension(Arc::clone(&fixture.state))),
+        Some(Extension(wallet_principal)),
+        Some(Extension(validated_oid4vci_proof(
+            &fixture.state,
+            &proof,
+            Some(nonce),
+        ))),
+        Json(Oid4vciCredentialRequest {
+            format: SD_JWT_VC_FORMAT.to_string(),
+            credential_identifier: Some(REGISTRY_OFFER_CONFIGURATION_ID.to_string()),
+            credential_configuration_id: None,
+            vct: None,
+            proof: registry_platform_oid4vci::CredentialRequestProof {
+                proof_type: PROOF_TYPE_JWT.to_string(),
+                jwt: proof,
+            },
+            proofs: registry_platform_oid4vci::CredentialRequestProofs::default(),
+        }),
+    )
+    .await;
+    assert_eq!(credential_response.status(), StatusCode::OK);
+    let audit = credential_response
+        .extensions()
+        .get::<EvidenceAuditContext>()
+        .expect("credential audit context is attached");
+    assert_eq!(audit.access_mode, Some(AccessMode::MachineClient));
+    let audit_debug = format!("{audit:?}");
+    assert!(!audit_debug.contains("NAT-REGISTRAR-001"));
+    assert!(!audit_debug.contains(tx_code));
+    let credential_body = to_bytes(credential_response.into_body(), 256 * 1024)
+        .await
+        .expect("credential response reads");
+    let credential_body: Value =
+        serde_json::from_slice(&credential_body).expect("credential response parses");
+    assert_eq!(credential_body["format"], SD_JWT_VC_FORMAT);
+    assert!(credential_body["credential"]
+        .as_str()
+        .is_some_and(|credential| credential.contains('~')));
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_rejects_elapsed_credential_validity_before_signing() {
+    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
+    let preauth = oid4vci_test_preauth_runtime_with_limited_signer(
+        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
+        Arc::clone(&sign_attempt_count),
+        0,
+    );
+    let fixture = registry_offer_fixture_with(registry_offer_test_evidence(), preauth).await;
+    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-EXPIRED-CREDENTIAL").await;
+    let mut evaluation = fixture
+        .store
+        .get(&evaluation_id, REGISTRY_OFFER_PRINCIPAL_ID)
+        .await
+        .expect("stored evaluation read succeeds")
+        .expect("stored evaluation exists");
+    let expired_issued_at = format_time(OffsetDateTime::now_utc() - time::Duration::days(1));
+    for result in &mut evaluation.results {
+        result.issued_at.clone_from(&expired_issued_at);
+    }
+    fixture
+        .store
+        .insert(evaluation)
+        .await
+        .expect("expired credential-validity fixture writes");
+    let mut principal = fixture.principal.clone();
+    principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-EXPIRED-CREDENTIAL",
+    ));
+
+    let response = registry_offer_create(
+        &fixture,
+        principal,
+        &evaluation_id,
+        "registrar-expired-credential",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::NOT_FOUND);
+    assert_eq!(
+        sign_attempt_count.load(Ordering::SeqCst),
+        0,
+        "elapsed credential validity rejects before quota or signer work"
+    );
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_caps_signer_deadline_to_remaining_validity() {
+    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
+    let preauth = oid4vci_test_preauth_runtime_with_limited_signer(
+        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
+        Arc::clone(&sign_attempt_count),
+        1,
+    );
+    let mut evidence = registry_offer_test_evidence();
+    evidence
+        .credential_profiles
+        .get_mut("civil_status_sd_jwt")
+        .expect("registry offer credential profile exists")
+        .validity_seconds = 20;
+    let fixture = registry_offer_fixture_with(evidence, preauth).await;
+    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-SIGNER-DEADLINE").await;
+    let mut principal = fixture.principal.clone();
+    principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-SIGNER-DEADLINE",
+    ));
+
+    let response = registry_offer_create(
+        &fixture,
+        principal,
+        &evaluation_id,
+        "registrar-signer-deadline",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(
+        sign_attempt_count.load(Ordering::SeqCst),
+        1,
+        "the signer runs with a deadline capped to the remaining validity",
+    );
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_caps_code_and_transaction_to_credential_validity() {
+    const VALIDITY_SECONDS: i64 = 60;
+    let mut evidence = registry_offer_test_evidence();
+    evidence
+        .credential_profiles
+        .get_mut("civil_status_sd_jwt")
+        .expect("registry offer credential profile exists")
+        .validity_seconds = VALIDITY_SECONDS;
+    let fixture = registry_offer_fixture_with(
+        evidence,
+        oid4vci_test_preauth_runtime(registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP),
+    )
+    .await;
+    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-SHORT-CREDENTIAL").await;
+    let evaluation = fixture
+        .store
+        .get(&evaluation_id, REGISTRY_OFFER_PRINCIPAL_ID)
+        .await
+        .expect("stored evaluation read succeeds")
+        .expect("stored evaluation exists");
+    let credential_expires_at = earliest_issued_at(&evaluation.results)
+        .expect("registry results have an issuance time")
+        + time::Duration::seconds(VALIDITY_SECONDS);
+    let mut principal = fixture.principal.clone();
+    principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-SHORT-CREDENTIAL",
+    ));
+
+    let response = registry_offer_create(
+        &fixture,
+        principal,
+        &evaluation_id,
+        "registrar-short-credential",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = registry_offer_response_json(response).await;
+    let response_expires_at = OffsetDateTime::parse(
+        body["expires_at"]
+            .as_str()
+            .expect("offer response has an expiry"),
+        &Rfc3339,
+    )
+    .expect("offer response expiry parses");
+    assert_eq!(
+        response_expires_at.unix_timestamp(),
+        credential_expires_at.unix_timestamp()
+    );
+    let offer = credential_offer_from_uri(
+        body["credential_offer_uri"]
+            .as_str()
+            .expect("offer URI is returned"),
+    );
+    let pre_authorized_code = offer["grants"][PRE_AUTHORIZED_CODE_GRANT_TYPE]
+        ["pre-authorized_code"]
+        .as_str()
+        .expect("offer carries a pre-authorized code");
+    let verified_code = verify_notary_token(
+        pre_authorized_code,
+        fixture.preauth.access_token_verification_keys()[0].public_jwk(),
+        PRE_AUTHORIZED_CODE_JWT_TYP,
+        fixture.preauth.notary_issuer(),
+        &[],
+        OffsetDateTime::now_utc().unix_timestamp(),
+    )
+    .expect("pre-authorized code verifies");
+    assert_eq!(
+        verified_code.payload["exp"].as_i64(),
+        Some(credential_expires_at.unix_timestamp())
+    );
+    let transaction_id = verified_code.payload["jti"]
+        .as_str()
+        .expect("pre-authorized code has a transaction ID");
+    let live_transaction = fixture
+        .preauth
+        .preauthorization_state()
+        .transaction(transaction_id)
+        .await
+        .expect("transaction lookup succeeds")
+        .expect("transaction remains live");
+    assert_eq!(
+        live_transaction.expires_at.unix_timestamp(),
+        credential_expires_at.unix_timestamp()
+    );
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_is_atomic_for_retry_conflict_and_consumption() {
+    let fixture = registry_offer_fixture().await;
+    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-IDEMPOTENCY-001").await;
+    let mut principal = fixture.principal.clone();
+    principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-IDEMPOTENCY-001",
+    ));
+
+    let invoke = || {
+        registry_offer_create(
+            &fixture,
+            principal.clone(),
+            &evaluation_id,
+            "registrar-idempotency",
+        )
+    };
+    let (first, second) = tokio::join!(invoke(), invoke());
+    assert_eq!(first.status(), StatusCode::OK);
+    assert_eq!(second.status(), StatusCode::OK);
+    assert_eq!(
+        first.headers()[header::CACHE_CONTROL],
+        HeaderValue::from_static("no-store")
+    );
+    assert_eq!(
+        second.headers()[header::CACHE_CONTROL],
+        HeaderValue::from_static("no-store")
+    );
+    let first_body = registry_offer_response_json(first).await;
+    let second_body = registry_offer_response_json(second).await;
+    assert_eq!(
+        first_body, second_body,
+        "concurrent exact retries return the one persisted offer and PIN"
+    );
+
+    let exact_retry = registry_offer_create(
+        &fixture,
+        principal.clone(),
+        &evaluation_id,
+        "registrar-idempotency",
+    )
+    .await;
+    assert_eq!(exact_retry.status(), StatusCode::OK);
+    assert_eq!(
+        registry_offer_response_json(exact_retry).await,
+        first_body,
+        "later exact retry returns byte-for-byte equivalent response data"
+    );
+
+    let consumed = registry_offer_create(
+        &fixture,
+        principal.clone(),
+        &evaluation_id,
+        "registrar-new-operation",
+    )
+    .await;
+    assert_eq!(consumed.status(), StatusCode::CONFLICT);
+    assert_eq!(
+        consumed.headers()[header::CACHE_CONTROL],
+        HeaderValue::from_static("no-store")
+    );
+    let consumed_body = registry_offer_response_json(consumed).await;
+    assert_eq!(consumed_body["code"], "offer_conflict");
+    assert!(!consumed_body.to_string().contains("NAT-IDEMPOTENCY-001"));
+
+    let other_evaluation_id = registry_offer_evaluate(&fixture, "NAT-IDEMPOTENCY-002").await;
+    let mut other_principal = principal;
+    other_principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-IDEMPOTENCY-002",
+    ));
+    let key_reuse = registry_offer_create(
+        &fixture,
+        other_principal,
+        &other_evaluation_id,
+        "registrar-idempotency",
+    )
+    .await;
+    assert_eq!(key_reuse.status(), StatusCode::CONFLICT);
+    assert_eq!(
+        registry_offer_response_json(key_reuse).await["code"],
+        "offer_conflict"
+    );
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_exact_retry_canonicalizes_authorized_claim_order() {
+    let fixture = registry_offer_fixture().await;
+    let target_id = "NAT-IDEMPOTENCY-CLAIM-ORDER";
+    let evaluation_id = registry_offer_evaluate(&fixture, target_id).await;
+    let mut initial_principal = fixture.principal.clone();
+    initial_principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        target_id,
+    ));
+
+    let initial = registry_offer_create(
+        &fixture,
+        initial_principal,
+        &evaluation_id,
+        "registrar-claim-order",
+    )
+    .await;
+    assert_eq!(initial.status(), StatusCode::OK);
+    let initial_body = registry_offer_response_json(initial).await;
+
+    let mut reordered_principal = fixture.principal.clone();
+    let mut reordered_details = registry_offer_authorization_details(&fixture.state, target_id);
+    reordered_details.claims.reverse();
+    reordered_principal.authorization_details = Some(reordered_details);
+    let reordered = registry_offer_create(
+        &fixture,
+        reordered_principal,
+        &evaluation_id,
+        "registrar-claim-order",
+    )
+    .await;
+    assert_eq!(
+        reordered.status(),
+        StatusCode::OK,
+        "claim order does not change the authorized request identity",
+    );
+    assert_eq!(
+        registry_offer_response_json(reordered).await,
+        initial_body,
+        "equivalent claim sets replay the exact persisted offer",
+    );
+
+    let mut version_changed_principal = fixture.principal.clone();
+    let mut version_changed_details =
+        registry_offer_authorization_details(&fixture.state, target_id);
+    version_changed_details.claims[0].version = Some("different-version".to_string());
+    version_changed_principal.authorization_details = Some(version_changed_details);
+    let version_changed = registry_offer_create(
+        &fixture,
+        version_changed_principal,
+        &evaluation_id,
+        "registrar-claim-order",
+    )
+    .await;
+    assert_eq!(
+        version_changed.status(),
+        StatusCode::FORBIDDEN,
+        "claim versions remain authorization-sensitive",
+    );
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_concurrent_exact_retry_debits_last_quota_unit_once() {
+    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
+    let gate = Arc::new(FirstSigningAttemptGate::new());
+    let preauth = oid4vci_test_preauth_runtime_with_first_signing_attempt_gate(
+        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
+        Arc::clone(&sign_attempt_count),
+        Arc::clone(&gate),
+    );
+    let mut evidence = registry_offer_test_evidence();
+    evidence.machine_quota = registry_notary_core::MachineQuotaConfig {
+        enabled: true,
+        // Evaluation consumes the first unit. Both concurrent exact offer
+        // attempts must share the one remaining operation debit.
+        subjects_per_minute: 2,
+    };
+    let fixture = registry_offer_fixture_with(evidence, preauth).await;
+    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-CONCURRENT-QUOTA").await;
+    let mut principal = fixture.principal.clone();
+    principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-CONCURRENT-QUOTA",
+    ));
+
+    let first_state = Arc::clone(&fixture.state);
+    let first_principal = principal.clone();
+    let first_evaluation_id = evaluation_id.clone();
+    let first = tokio::spawn(async move {
+        oid4vci_create_registry_offer(
+            registry_offer_headers("registrar-concurrent-quota"),
+            Some(Extension(first_state)),
+            Some(Extension(first_principal)),
+            Ok(Json(Oid4vciRegistryOfferRequest {
+                evaluation_id: first_evaluation_id,
+                credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
+            })),
+        )
+        .await
+    });
+    gate.wait_until_entered().await;
+
+    let second_state = Arc::clone(&fixture.state);
+    let second_evaluation_id = evaluation_id;
+    let second = tokio::spawn(async move {
+        oid4vci_create_registry_offer(
+            registry_offer_headers("registrar-concurrent-quota"),
+            Some(Extension(second_state)),
+            Some(Extension(principal)),
+            Ok(Json(Oid4vciRegistryOfferRequest {
+                evaluation_id: second_evaluation_id,
+                credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
+            })),
+        )
+        .await
+    });
+    tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+    assert_eq!(
+        sign_attempt_count.load(Ordering::SeqCst),
+        1,
+        "the exact contender must wait without entering the signer"
+    );
+    assert!(
+        !second.is_finished(),
+        "the exact contender waits for the authoritative reservation"
+    );
+    gate.release();
+    let first = first.await.expect("first offer task joins");
+    let second = second.await.expect("second offer task joins");
+
+    assert_eq!(first.status(), StatusCode::OK);
+    assert_eq!(second.status(), StatusCode::OK);
+    assert_eq!(
+        registry_offer_response_json(first).await,
+        registry_offer_response_json(second).await,
+        "both exact attempts replay the one authoritative offer"
+    );
+    assert_eq!(
+        sign_attempt_count.load(Ordering::SeqCst),
+        1,
+        "one leased quota-operation owner performs signer work"
+    );
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_concurrent_exact_retry_is_serialized_when_quota_is_disabled() {
+    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
+    let gate = Arc::new(FirstSigningAttemptGate::new());
+    let preauth = oid4vci_test_preauth_runtime_with_first_signing_attempt_gate(
+        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
+        Arc::clone(&sign_attempt_count),
+        Arc::clone(&gate),
+    );
+    let mut evidence = registry_offer_test_evidence();
+    evidence.machine_quota.enabled = false;
+    let fixture = registry_offer_fixture_with(evidence, preauth).await;
+    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-DISABLED-QUOTA-LEASE").await;
+    let mut principal = fixture.principal.clone();
+    principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-DISABLED-QUOTA-LEASE",
+    ));
+
+    let first_state = Arc::clone(&fixture.state);
+    let first_principal = principal.clone();
+    let first_evaluation_id = evaluation_id.clone();
+    let first = tokio::spawn(async move {
+        oid4vci_create_registry_offer(
+            registry_offer_headers("registrar-disabled-quota-lease"),
+            Some(Extension(first_state)),
+            Some(Extension(first_principal)),
+            Ok(Json(Oid4vciRegistryOfferRequest {
+                evaluation_id: first_evaluation_id,
+                credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
+            })),
+        )
+        .await
+    });
+    gate.wait_until_entered().await;
+
+    let second_state = Arc::clone(&fixture.state);
+    let second = tokio::spawn(async move {
+        oid4vci_create_registry_offer(
+            registry_offer_headers("registrar-disabled-quota-lease"),
+            Some(Extension(second_state)),
+            Some(Extension(principal)),
+            Ok(Json(Oid4vciRegistryOfferRequest {
+                evaluation_id,
+                credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
+            })),
+        )
+        .await
+    });
+    tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+    assert_eq!(sign_attempt_count.load(Ordering::SeqCst), 1);
+    assert!(!second.is_finished());
+    gate.release();
+    let first = first.await.expect("first offer task joins");
+    let second = second.await.expect("second offer task joins");
+    assert_eq!(first.status(), StatusCode::OK);
+    assert_eq!(second.status(), StatusCode::OK);
+    assert_eq!(
+        registry_offer_response_json(first).await,
+        registry_offer_response_json(second).await,
+    );
+    assert_eq!(sign_attempt_count.load(Ordering::SeqCst), 1);
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_concurrent_request_conflict_never_reaches_second_signer() {
+    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
+    let gate = Arc::new(FirstSigningAttemptGate::new());
+    let preauth = oid4vci_test_preauth_runtime_with_first_signing_attempt_gate(
+        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
+        Arc::clone(&sign_attempt_count),
+        Arc::clone(&gate),
+    );
+    let mut evidence = registry_offer_test_evidence();
+    evidence.machine_quota = registry_notary_core::MachineQuotaConfig {
+        enabled: true,
+        subjects_per_minute: 4,
+    };
+    let fixture = registry_offer_fixture_with(evidence, preauth).await;
+    let first_evaluation =
+        registry_offer_evaluate(&fixture, "NAT-CONCURRENT-REQUEST-CONFLICT").await;
+    let second_evaluation =
+        registry_offer_evaluate(&fixture, "NAT-CONCURRENT-REQUEST-CONFLICT").await;
+    let mut principal = fixture.principal.clone();
+    principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-CONCURRENT-REQUEST-CONFLICT",
+    ));
+
+    let first_state = Arc::clone(&fixture.state);
+    let first_principal = principal.clone();
+    let first = tokio::spawn(async move {
+        oid4vci_create_registry_offer(
+            registry_offer_headers("registrar-request-conflict"),
+            Some(Extension(first_state)),
+            Some(Extension(first_principal)),
+            Ok(Json(Oid4vciRegistryOfferRequest {
+                evaluation_id: first_evaluation,
+                credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
+            })),
+        )
+        .await
+    });
+    gate.wait_until_entered().await;
+
+    let conflict = oid4vci_create_registry_offer(
+        registry_offer_headers("registrar-request-conflict"),
+        Some(Extension(Arc::clone(&fixture.state))),
+        Some(Extension(principal)),
+        Ok(Json(Oid4vciRegistryOfferRequest {
+            evaluation_id: second_evaluation,
+            credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
+        })),
+    )
+    .await;
+    assert_eq!(conflict.status(), StatusCode::CONFLICT);
+    assert_eq!(
+        sign_attempt_count.load(Ordering::SeqCst),
+        1,
+        "the different request shape conflicts on the shared idempotency operation",
+    );
+    gate.release();
+    assert_eq!(
+        first.await.expect("first offer task joins").status(),
+        StatusCode::OK,
+    );
+    assert_eq!(sign_attempt_count.load(Ordering::SeqCst), 1);
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_signer_failure_releases_lease_without_refunding_quota() {
+    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
+    let preauth = oid4vci_test_preauth_runtime_with_first_signing_attempt_failure(
+        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
+        Arc::clone(&sign_attempt_count),
+    );
+    let mut evidence = registry_offer_test_evidence();
+    evidence.machine_quota = registry_notary_core::MachineQuotaConfig {
+        enabled: true,
+        subjects_per_minute: 2,
+    };
+    let fixture = registry_offer_fixture_with(evidence, preauth).await;
+    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-QUOTA-TAKEOVER").await;
+    let mut principal = fixture.principal.clone();
+    principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-QUOTA-TAKEOVER",
+    ));
+
+    let failed = registry_offer_create(
+        &fixture,
+        principal.clone(),
+        &evaluation_id,
+        "registrar-quota-takeover",
+    )
+    .await;
+    assert!(failed.status().is_server_error());
+    assert_eq!(sign_attempt_count.load(Ordering::SeqCst), 1);
+
+    let takeover = registry_offer_create(
+        &fixture,
+        principal,
+        &evaluation_id,
+        "registrar-quota-takeover",
+    )
+    .await;
+    assert_eq!(takeover.status(), StatusCode::OK);
+    assert_eq!(
+        sign_attempt_count.load(Ordering::SeqCst),
+        2,
+        "released lease is taken over without a second quota debit"
+    );
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_preflight_skips_signer_for_sequential_denials_and_replay() {
+    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
+    let preauth = oid4vci_test_preauth_runtime_with_limited_signer(
+        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
+        Arc::clone(&sign_attempt_count),
+        1,
+    );
+    let fixture = registry_offer_fixture_with(registry_offer_test_evidence(), preauth).await;
+    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-PREFLIGHT-001").await;
+    let mut principal = fixture.principal.clone();
+    principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-PREFLIGHT-001",
+    ));
+
+    let created = registry_offer_create(
+        &fixture,
+        principal.clone(),
+        &evaluation_id,
+        "registrar-preflight",
+    )
+    .await;
+    assert_eq!(created.status(), StatusCode::OK);
+    let created_body = registry_offer_response_json(created).await;
+    assert_eq!(sign_attempt_count.load(Ordering::SeqCst), 1);
+
+    let exact_replay = registry_offer_create(
+        &fixture,
+        principal.clone(),
+        &evaluation_id,
+        "registrar-preflight",
+    )
+    .await;
+    assert_eq!(exact_replay.status(), StatusCode::OK);
+    assert_eq!(
+        registry_offer_response_json(exact_replay).await,
+        created_body
+    );
+    assert_eq!(
+        sign_attempt_count.load(Ordering::SeqCst),
+        1,
+        "exact replay must return before signer work"
+    );
+
+    let other_evaluation_id = registry_offer_evaluate(&fixture, "NAT-PREFLIGHT-002").await;
+    let mut other_principal = fixture.principal.clone();
+    other_principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-PREFLIGHT-002",
+    ));
+    let idempotency_conflict = registry_offer_create(
+        &fixture,
+        other_principal,
+        &other_evaluation_id,
+        "registrar-preflight",
+    )
+    .await;
+    assert_eq!(idempotency_conflict.status(), StatusCode::CONFLICT);
+    assert_eq!(
+        sign_attempt_count.load(Ordering::SeqCst),
+        1,
+        "idempotency-key conflict must return before signer work"
+    );
+
+    let consumed = registry_offer_create(
+        &fixture,
+        principal,
+        &evaluation_id,
+        "registrar-preflight-new-operation",
+    )
+    .await;
+    assert_eq!(consumed.status(), StatusCode::CONFLICT);
+    assert_eq!(
+        sign_attempt_count.load(Ordering::SeqCst),
+        1,
+        "consumed evaluation must return before signer work"
+    );
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_charges_quota_before_signer_work() {
+    let sign_attempt_count = Arc::new(AtomicUsize::new(0));
+    let preauth = oid4vci_test_preauth_runtime_with_limited_signer(
+        registry_notary_core::tokens::NOTARY_ACCESS_TOKEN_JWT_TYP,
+        Arc::clone(&sign_attempt_count),
+        0,
+    );
+    let mut evidence = registry_offer_test_evidence();
+    evidence.machine_quota = registry_notary_core::MachineQuotaConfig {
+        enabled: true,
+        // The two evaluations consume two units. The first offer consumes the
+        // third before its signer failure, leaving the second offer over quota.
+        subjects_per_minute: 3,
+    };
+    let fixture = registry_offer_fixture_with(evidence, preauth).await;
+    let first_evaluation_id = registry_offer_evaluate(&fixture, "NAT-QUOTA-SIGN-001").await;
+    let second_evaluation_id = registry_offer_evaluate(&fixture, "NAT-QUOTA-SIGN-002").await;
+
+    let mut first_principal = fixture.principal.clone();
+    first_principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-QUOTA-SIGN-001",
+    ));
+    let signer_failure = registry_offer_create(
+        &fixture,
+        first_principal,
+        &first_evaluation_id,
+        "registrar-quota-sign-1",
+    )
+    .await;
+    assert!(signer_failure.status().is_server_error());
+    assert_eq!(sign_attempt_count.load(Ordering::SeqCst), 1);
+
+    let mut second_principal = fixture.principal.clone();
+    second_principal.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-QUOTA-SIGN-002",
+    ));
+    let quota_denial = registry_offer_create(
+        &fixture,
+        second_principal,
+        &second_evaluation_id,
+        "registrar-quota-sign-2",
+    )
+    .await;
+    assert_eq!(quota_denial.status(), StatusCode::TOO_MANY_REQUESTS);
+    assert_eq!(
+        sign_attempt_count.load(Ordering::SeqCst),
+        1,
+        "over-quota offer must return before signer work"
+    );
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_denies_unbound_authority_and_mutated_evidence() {
+    let fixture = registry_offer_fixture().await;
+    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-001").await;
+    let correct_details = registry_offer_authorization_details(&fixture.state, "NAT-BOUNDARY-001");
+
+    let missing_idempotency = oid4vci_create_registry_offer(
+        HeaderMap::new(),
+        Some(Extension(Arc::clone(&fixture.state))),
+        Some(Extension(fixture.principal.clone())),
+        Ok(Json(Oid4vciRegistryOfferRequest {
+            evaluation_id: evaluation_id.clone(),
+            credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
+        })),
+    )
+    .await;
+    assert_eq!(missing_idempotency.status(), StatusCode::BAD_REQUEST);
+
+    let missing_authentication = oid4vci_create_registry_offer(
+        registry_offer_headers("missing-authentication"),
+        Some(Extension(Arc::clone(&fixture.state))),
+        None,
+        Ok(Json(Oid4vciRegistryOfferRequest {
+            evaluation_id: evaluation_id.clone(),
+            credential_configuration_id: REGISTRY_OFFER_CONFIGURATION_ID.to_string(),
+        })),
+    )
+    .await;
+    assert_eq!(missing_authentication.status(), StatusCode::UNAUTHORIZED);
+
+    let mut authorized = fixture.principal.clone();
+    authorized.authorization_details = Some(correct_details.clone());
+    let unknown_configuration = oid4vci_create_registry_offer(
+        registry_offer_headers("unknown-configuration"),
+        Some(Extension(Arc::clone(&fixture.state))),
+        Some(Extension(authorized)),
+        Ok(Json(Oid4vciRegistryOfferRequest {
+            evaluation_id: evaluation_id.clone(),
+            credential_configuration_id: "unknown_configuration".to_string(),
+        })),
+    )
+    .await;
+    assert_eq!(unknown_configuration.status(), StatusCode::NOT_FOUND);
+
+    let mut missing_create_scope = fixture.principal.clone();
+    missing_create_scope
+        .scopes
+        .retain(|scope| scope != REGISTRY_OFFER_CREATE_SCOPE);
+    let response = registry_offer_create(
+        &fixture,
+        missing_create_scope,
+        &evaluation_id,
+        "missing-create-scope",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+
+    let mut missing_configuration_scope = fixture.principal.clone();
+    let configuration_scope = fixture.state.oid4vci.credential_configurations
+        [REGISTRY_OFFER_CONFIGURATION_ID]
+        .scope
+        .clone();
+    missing_configuration_scope
+        .scopes
+        .retain(|scope| scope != &configuration_scope);
+    let response = registry_offer_create(
+        &fixture,
+        missing_configuration_scope,
+        &evaluation_id,
+        "missing-configuration-scope",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+
+    let mut wallet_token_principal = fixture.principal.clone();
+    wallet_token_principal.auth_profile_id =
+        registry_notary_core::EvidenceAuthProfileId::NotaryAccessToken;
+    let response = registry_offer_create(
+        &fixture,
+        wallet_token_principal,
+        &evaluation_id,
+        "wallet-cannot-create",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+
+    let mut wrong_rar = fixture.principal.clone();
+    let mut wrong_details = correct_details.clone();
+    wrong_details.actions = vec!["issue_credential".to_string()];
+    wrong_rar.authorization_details = Some(wrong_details);
+    let response = registry_offer_create(&fixture, wrong_rar, &evaluation_id, "wrong-rar").await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+
+    let mut wrong_target_rar = fixture.principal.clone();
+    let mut wrong_target_details = correct_details.clone();
+    wrong_target_details
+        .target
+        .as_mut()
+        .expect("offer RAR has a target")
+        .id = "NAT-BOUNDARY-OTHER".to_string();
+    wrong_target_rar.authorization_details = Some(wrong_target_details);
+    let response = registry_offer_create(
+        &fixture,
+        wrong_target_rar,
+        &evaluation_id,
+        "wrong-rar-target",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+
+    let mut foreign_principal =
+        registry_offer_machine_principal(&fixture.state, "registrar-foreign");
+    foreign_principal.authorization_details = Some(correct_details.clone());
+    let response = registry_offer_create(
+        &fixture,
+        foreign_principal,
+        &evaluation_id,
+        "foreign-evaluation",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::NOT_FOUND);
+
+    let stale_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-STALE").await;
+    let mut stale = fixture
+        .store
+        .get(&stale_id, REGISTRY_OFFER_PRINCIPAL_ID)
+        .await
+        .expect("stored evaluation read succeeds")
+        .expect("stored evaluation exists");
+    stale.expires_at = "2020-01-01T00:00:00Z".to_string();
+    fixture
+        .store
+        .insert(stale)
+        .await
+        .expect("stale fixture writes");
+    let mut authorized = fixture.principal.clone();
+    authorized.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-BOUNDARY-STALE",
+    ));
+    let response = registry_offer_create(&fixture, authorized, &stale_id, "stale-evaluation").await;
+    assert_eq!(response.status(), StatusCode::NOT_FOUND);
+
+    let wrong_purpose_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-PURPOSE").await;
+    let mut wrong_purpose = fixture
+        .store
+        .get(&wrong_purpose_id, REGISTRY_OFFER_PRINCIPAL_ID)
+        .await
+        .expect("stored evaluation read succeeds")
+        .expect("stored evaluation exists");
+    wrong_purpose.purpose = "different-purpose".to_string();
+    fixture
+        .store
+        .insert(wrong_purpose)
+        .await
+        .expect("purpose mutation fixture writes");
+    let mut authorized = fixture.principal.clone();
+    authorized.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-BOUNDARY-PURPOSE",
+    ));
+    let response =
+        registry_offer_create(&fixture, authorized, &wrong_purpose_id, "wrong-purpose").await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+
+    let value_tamper_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-VALUE").await;
+    fixture.store.tamper_next_read(|evaluation| {
+        evaluation.results[0].value = Some(json!("mutated-after-evaluation"));
+    });
+    let mut authorized = fixture.principal.clone();
+    authorized.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-BOUNDARY-VALUE",
+    ));
+    let response =
+        registry_offer_create(&fixture, authorized, &value_tamper_id, "value-mutated").await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+
+    let provenance_tamper_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-PROVENANCE").await;
+    fixture.store.tamper_next_read(|evaluation| {
+        evaluation
+            .issuance_provenance
+            .as_mut()
+            .expect("issuance provenance exists")
+            .claims[0]
+            .relay_contract_hash =
+            "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc".to_string();
+    });
+    let mut authorized = fixture.principal.clone();
+    authorized.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-BOUNDARY-PROVENANCE",
+    ));
+    let response = registry_offer_create(
+        &fixture,
+        authorized,
+        &provenance_tamper_id,
+        "provenance-mutated",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_rejects_non_exact_claim_and_target_authority() {
+    let fixture = registry_offer_fixture().await;
+    let evaluation_id = registry_offer_evaluate(&fixture, "NAT-EXACT-AUTHORITY").await;
+    let correct_details =
+        registry_offer_authorization_details(&fixture.state, "NAT-EXACT-AUTHORITY");
+
+    let mut wrong_scheme_rar = fixture.principal.clone();
+    let mut wrong_scheme_details = correct_details.clone();
+    wrong_scheme_details
+        .target
+        .as_mut()
+        .expect("offer RAR has a target")
+        .id_type = "registry_file_number".to_string();
+    wrong_scheme_rar.authorization_details = Some(wrong_scheme_details);
+    let response = registry_offer_create(
+        &fixture,
+        wrong_scheme_rar,
+        &evaluation_id,
+        "wrong-rar-target-scheme",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+
+    let mut duplicate_claim_rar = fixture.principal.clone();
+    let mut duplicate_claim_details = correct_details.clone();
+    duplicate_claim_details.claims[1] = duplicate_claim_details.claims[0].clone();
+    duplicate_claim_rar.authorization_details = Some(duplicate_claim_details);
+    let response = registry_offer_create(
+        &fixture,
+        duplicate_claim_rar,
+        &evaluation_id,
+        "duplicate-rar-claim",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+
+    let mut version_substitution_rar = fixture.principal.clone();
+    let mut version_substitution_details = correct_details;
+    version_substitution_details.claims[0].version = Some("1".to_string());
+    version_substitution_rar.authorization_details = Some(version_substitution_details);
+    let response = registry_offer_create(
+        &fixture,
+        version_substitution_rar,
+        &evaluation_id,
+        "version-substitution-rar-claim",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+}
+
+#[cfg(feature = "registry-notary-cel")]
+#[tokio::test]
+async fn oid4vci_registry_offer_rejects_missing_or_cross_evaluation_target_binding() {
+    let fixture = registry_offer_fixture().await;
+    let legacy_binding_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-LEGACY").await;
+    fixture.store.tamper_next_read(|evaluation| {
+        evaluation
+            .issuance_provenance
+            .as_mut()
+            .expect("issuance provenance exists")
+            .authorization_target_binding
+            .clear();
+    });
+    let mut authorized = fixture.principal.clone();
+    authorized.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-BOUNDARY-LEGACY",
+    ));
+    let response = registry_offer_create(
+        &fixture,
+        authorized,
+        &legacy_binding_id,
+        "legacy-target-binding",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+
+    let first_binding_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-BINDING-A").await;
+    let second_binding_id = registry_offer_evaluate(&fixture, "NAT-BOUNDARY-BINDING-B").await;
+    let second_binding = fixture
+        .store
+        .get(&second_binding_id, REGISTRY_OFFER_PRINCIPAL_ID)
+        .await
+        .expect("stored evaluation read succeeds")
+        .expect("stored evaluation exists")
+        .issuance_provenance
+        .expect("issuance provenance exists")
+        .authorization_target_binding;
+    fixture.store.tamper_next_read(move |evaluation| {
+        evaluation
+            .issuance_provenance
+            .as_mut()
+            .expect("issuance provenance exists")
+            .authorization_target_binding = second_binding.clone();
+    });
+    let mut authorized = fixture.principal.clone();
+    authorized.authorization_details = Some(registry_offer_authorization_details(
+        &fixture.state,
+        "NAT-BOUNDARY-BINDING-A",
+    ));
+    let response = registry_offer_create(
+        &fixture,
+        authorized,
+        &first_binding_id,
+        "cross-evaluation-target-binding",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+}
diff --git a/crates/registry-notary-server/src/api/tests/support.rs b/crates/registry-notary-server/src/api/tests/support.rs
index e5ab4d163e..39aebf17b0 100644
--- a/crates/registry-notary-server/src/api/tests/support.rs
+++ b/crates/registry-notary-server/src/api/tests/support.rs
@@ -554,6 +554,247 @@
         Arc::new(PreAuthRuntime::for_api_tests(access_token_typ))
     }
 
+    struct AttemptLimitedAccessTokenSigner {
+        inner: LocalJwkSigner,
+        sign_attempt_count: Arc<AtomicUsize>,
+        allowed_signatures: usize,
+    }
+
+    impl AttemptLimitedAccessTokenSigner {
+        fn new(sign_attempt_count: Arc<AtomicUsize>, allowed_signatures: usize) -> Self {
+            let inner = LocalJwkSigner::new(
+                PrivateJwk::parse(
+                    &json!({
+                        "kty": "OKP",
+                        "crv": "Ed25519",
+                        "d": HOLDER_PRIV_D_B64,
+                        "x": HOLDER_PUB_X_B64,
+                        "alg": "EdDSA",
+                        "kid": "did:web:notary.example#access"
+                    })
+                    .to_string(),
+                )
+                .expect("test access-token JWK parses"),
+            )
+            .expect("test access-token signer builds");
+            Self {
+                inner,
+                sign_attempt_count,
+                allowed_signatures,
+            }
+        }
+    }
+
+    #[async_trait::async_trait]
+    impl SigningProvider for AttemptLimitedAccessTokenSigner {
+        fn algorithm(&self) -> registry_platform_crypto::SigningAlgorithm {
+            self.inner.algorithm()
+        }
+
+        fn key_id(&self) -> &str {
+            self.inner.key_id()
+        }
+
+        fn public_jwk(&self) -> PublicJwk {
+            self.inner.public_jwk()
+        }
+
+        async fn sign(
+            &self,
+            payload: &[u8],
+        ) -> Result<Vec<u8>, registry_platform_crypto::SigningError> {
+            let attempt = self.sign_attempt_count.fetch_add(1, Ordering::SeqCst);
+            if attempt >= self.allowed_signatures {
+                return Err(registry_platform_crypto::SigningError::external(
+                    "test access-token signer capacity exhausted",
+                ));
+            }
+            self.inner.sign(payload).await
+        }
+    }
+
+    fn oid4vci_test_preauth_runtime_with_limited_signer(
+        access_token_typ: &str,
+        sign_attempt_count: Arc<AtomicUsize>,
+        allowed_signatures: usize,
+    ) -> Arc<PreAuthRuntime> {
+        let signer = Arc::new(AttemptLimitedAccessTokenSigner::new(
+            sign_attempt_count,
+            allowed_signatures,
+        ));
+        Arc::new(
+            PreAuthRuntime::for_api_tests(access_token_typ)
+                .with_access_token_signer_for_tests(signer),
+        )
+    }
+
+    struct FirstSigningAttemptGate {
+        entered: tokio::sync::Notify,
+        release: tokio::sync::Notify,
+    }
+
+    impl FirstSigningAttemptGate {
+        fn new() -> Self {
+            Self {
+                entered: tokio::sync::Notify::new(),
+                release: tokio::sync::Notify::new(),
+            }
+        }
+
+        async fn wait_until_entered(&self) {
+            self.entered.notified().await;
+        }
+
+        fn release(&self) {
+            self.release.notify_one();
+        }
+    }
+
+    struct FirstAttemptBlockingAccessTokenSigner {
+        inner: LocalJwkSigner,
+        sign_attempt_count: Arc<AtomicUsize>,
+        gate: Arc<FirstSigningAttemptGate>,
+    }
+
+    impl FirstAttemptBlockingAccessTokenSigner {
+        fn new(
+            sign_attempt_count: Arc<AtomicUsize>,
+            gate: Arc<FirstSigningAttemptGate>,
+        ) -> Self {
+            let inner = LocalJwkSigner::new(
+                PrivateJwk::parse(
+                    &json!({
+                        "kty": "OKP",
+                        "crv": "Ed25519",
+                        "d": HOLDER_PRIV_D_B64,
+                        "x": HOLDER_PUB_X_B64,
+                        "alg": "EdDSA",
+                        "kid": "did:web:notary.example#access"
+                    })
+                    .to_string(),
+                )
+                .expect("test access-token JWK parses"),
+            )
+            .expect("test access-token signer builds");
+            Self {
+                inner,
+                sign_attempt_count,
+                gate,
+            }
+        }
+    }
+
+    #[async_trait::async_trait]
+    impl SigningProvider for FirstAttemptBlockingAccessTokenSigner {
+        fn algorithm(&self) -> registry_platform_crypto::SigningAlgorithm {
+            self.inner.algorithm()
+        }
+
+        fn key_id(&self) -> &str {
+            self.inner.key_id()
+        }
+
+        fn public_jwk(&self) -> PublicJwk {
+            self.inner.public_jwk()
+        }
+
+        async fn sign(
+            &self,
+            payload: &[u8],
+        ) -> Result<Vec<u8>, registry_platform_crypto::SigningError> {
+            let attempt = self.sign_attempt_count.fetch_add(1, Ordering::SeqCst);
+            if attempt == 0 {
+                self.gate.entered.notify_one();
+                self.gate.release.notified().await;
+            }
+            self.inner.sign(payload).await
+        }
+    }
+
+    fn oid4vci_test_preauth_runtime_with_first_signing_attempt_gate(
+        access_token_typ: &str,
+        sign_attempt_count: Arc<AtomicUsize>,
+        gate: Arc<FirstSigningAttemptGate>,
+    ) -> Arc<PreAuthRuntime> {
+        let signer = Arc::new(FirstAttemptBlockingAccessTokenSigner::new(
+            sign_attempt_count,
+            gate,
+        ));
+        Arc::new(
+            PreAuthRuntime::for_api_tests(access_token_typ)
+                .with_access_token_signer_for_tests(signer),
+        )
+    }
+
+    struct FirstAttemptFailingAccessTokenSigner {
+        inner: LocalJwkSigner,
+        sign_attempt_count: Arc<AtomicUsize>,
+    }
+
+    impl FirstAttemptFailingAccessTokenSigner {
+        fn new(sign_attempt_count: Arc<AtomicUsize>) -> Self {
+            let inner = LocalJwkSigner::new(
+                PrivateJwk::parse(
+                    &json!({
+                        "kty": "OKP",
+                        "crv": "Ed25519",
+                        "d": HOLDER_PRIV_D_B64,
+                        "x": HOLDER_PUB_X_B64,
+                        "alg": "EdDSA",
+                        "kid": "did:web:notary.example#access"
+                    })
+                    .to_string(),
+                )
+                .expect("test access-token JWK parses"),
+            )
+            .expect("test access-token signer builds");
+            Self {
+                inner,
+                sign_attempt_count,
+            }
+        }
+    }
+
+    #[async_trait::async_trait]
+    impl SigningProvider for FirstAttemptFailingAccessTokenSigner {
+        fn algorithm(&self) -> registry_platform_crypto::SigningAlgorithm {
+            self.inner.algorithm()
+        }
+
+        fn key_id(&self) -> &str {
+            self.inner.key_id()
+        }
+
+        fn public_jwk(&self) -> PublicJwk {
+            self.inner.public_jwk()
+        }
+
+        async fn sign(
+            &self,
+            payload: &[u8],
+        ) -> Result<Vec<u8>, registry_platform_crypto::SigningError> {
+            if self.sign_attempt_count.fetch_add(1, Ordering::SeqCst) == 0 {
+                return Err(registry_platform_crypto::SigningError::external(
+                    "test first signing attempt failed",
+                ));
+            }
+            self.inner.sign(payload).await
+        }
+    }
+
+    fn oid4vci_test_preauth_runtime_with_first_signing_attempt_failure(
+        access_token_typ: &str,
+        sign_attempt_count: Arc<AtomicUsize>,
+    ) -> Arc<PreAuthRuntime> {
+        let signer = Arc::new(FirstAttemptFailingAccessTokenSigner::new(
+            sign_attempt_count,
+        ));
+        Arc::new(
+            PreAuthRuntime::for_api_tests(access_token_typ)
+                .with_access_token_signer_for_tests(signer),
+        )
+    }
+
     fn oid4vci_test_audit_hasher() -> AuditKeyHasher {
         const ENV: &str = "TEST_OID4VCI_AUDIT_HASH_SECRET";
         std::env::set_var(ENV, "0123456789abcdef0123456789abcdef");
@@ -1028,6 +1269,7 @@ evaluation_profiles:
                 canonical_purpose: purpose.to_string(),
                 consultation_id: "01J00000000000000000000000".to_string(),
                 execution_binding: String::new(),
+                result_content_binding: String::new(),
             }],
             consultations: vec![
                 registry_notary_core::StoredIssuanceConsultationProvenance {
@@ -1035,6 +1277,7 @@ evaluation_profiles:
                     acquired_at: "2026-05-23T00:00:00Z".to_string(),
                 },
             ],
+            authorization_target_binding: String::new(),
         };
         bind_fixture_issuance_claim(&mut stored, 0, evaluation_id, 1);
         stored
@@ -1058,6 +1301,7 @@ evaluation_profiles:
                     canonical_purpose: purpose.to_string(),
                     consultation_id: "01J00000000000000000000001".to_string(),
                     execution_binding: String::new(),
+                    result_content_binding: String::new(),
                 },
                 registry_notary_core::StoredIssuanceClaimProvenance {
                     claim_id: root_claim_id.to_string(),
@@ -1069,6 +1313,7 @@ evaluation_profiles:
                     canonical_purpose: purpose.to_string(),
                     consultation_id: "01J00000000000000000000000".to_string(),
                     execution_binding: String::new(),
+                    result_content_binding: String::new(),
                 },
             ],
             consultations: vec![
@@ -1081,6 +1326,7 @@ evaluation_profiles:
                     acquired_at: "2026-05-23T00:00:00Z".to_string(),
                 },
             ],
+            authorization_target_binding: String::new(),
         };
         bind_fixture_issuance_claim(&mut stored, 0, evaluation_id, 1);
         bind_fixture_issuance_claim(&mut stored, 1, evaluation_id, 2);
@@ -1093,6 +1339,11 @@ evaluation_profiles:
         evaluation_id: &str,
         relay_consultation_count: usize,
     ) {
+        let mut result = claim_result_view(evaluation_id, &stored.claims[claim_index].claim_id);
+        result.provenance.used.relay_consultation_count = relay_consultation_count;
+        stored.claims[claim_index].result_content_binding =
+            crate::runtime::issuance_result_content_binding(&result)
+                .expect("fixture result content binding hashes");
         let claim = &stored.claims[claim_index];
         let consultation = stored
             .consultations
diff --git a/crates/registry-notary-server/src/authz_details.rs b/crates/registry-notary-server/src/authz_details.rs
index c5cbdc0172..68a48ef033 100644
--- a/crates/registry-notary-server/src/authz_details.rs
+++ b/crates/registry-notary-server/src/authz_details.rs
@@ -103,18 +103,21 @@ pub(crate) fn validate_scoped_authorization_details(
         return Err(ScopedAuthorizationError::Location);
     }
     let claims_match = if expected.allow_subset_claims {
-        expected
-            .claims
-            .iter()
-            .all(|expected_claim| details.claims.contains(expected_claim))
+        unique_claim_refs(&details.claims)
+            && unique_claim_refs(expected.claims)
+            && expected
+                .claims
+                .iter()
+                .all(|expected_claim| details.claims.contains(expected_claim))
             && expected.allowed_claims.is_some_and(|allowed_claims| {
-                details
-                    .claims
-                    .iter()
-                    .all(|detail_claim| allowed_claims.contains(detail_claim))
+                unique_claim_refs(allowed_claims)
+                    && details
+                        .claims
+                        .iter()
+                        .all(|detail_claim| allowed_claims.contains(detail_claim))
             })
     } else {
-        details.claims == expected.claims
+        exact_unique_claim_ref_set(&details.claims, expected.claims)
     };
     if !claims_match {
         return Err(ScopedAuthorizationError::Claim);
@@ -140,6 +143,32 @@ pub(crate) fn validate_scoped_authorization_details(
     Ok(())
 }
 
+pub(crate) fn exact_unique_claim_ref_set(left: &[ClaimRef], right: &[ClaimRef]) -> bool {
+    left.len() == right.len()
+        && unique_claim_refs(left)
+        && unique_claim_refs(right)
+        && left.iter().all(|claim| right.contains(claim))
+}
+
+pub(crate) fn exact_unique_string_set(left: &[String], right: &[String]) -> bool {
+    left.len() == right.len()
+        && left
+            .iter()
+            .enumerate()
+            .all(|(position, value)| !left[..position].contains(value) && right.contains(value))
+        && right
+            .iter()
+            .enumerate()
+            .all(|(position, value)| !right[..position].contains(value))
+}
+
+fn unique_claim_refs(claims: &[ClaimRef]) -> bool {
+    claims
+        .iter()
+        .enumerate()
+        .all(|(position, claim)| !claims[..position].contains(claim))
+}
+
 fn exact_single(values: &[String], expected: &str) -> bool {
     values.len() == 1 && values[0] == expected
 }
@@ -356,6 +385,42 @@ mod tests {
         );
     }
 
+    #[test]
+    fn exact_claim_validation_treats_order_as_non_authoritative() {
+        let claim_a = claim("person-is-alive");
+        let claim_b = claim("address-is-current");
+        let token_details = details(vec![claim_b.clone(), claim_a.clone()]);
+        let expected_claims = [claim_a, claim_b];
+
+        validate_scoped_authorization_details(
+            &token_details,
+            &request(&expected_claims, false, None),
+        )
+        .expect("authorization claims are an exact set");
+    }
+
+    #[test]
+    fn exact_claim_validation_rejects_duplicates_and_version_substitution() {
+        let claim_a = claim("person-is-alive");
+        let duplicate = details(vec![claim_a.clone(), claim_a.clone()]);
+        assert_eq!(
+            validate_scoped_authorization_details(
+                &duplicate,
+                &request(&[claim_a.clone(), claim_a.clone()], false, None),
+            ),
+            Err(ScopedAuthorizationError::Claim)
+        );
+
+        let token_details = details(vec![ClaimRef::with_version("person-is-alive", "2")]);
+        assert_eq!(
+            validate_scoped_authorization_details(
+                &token_details,
+                &request(&[claim_a], false, None),
+            ),
+            Err(ScopedAuthorizationError::Claim)
+        );
+    }
+
     #[test]
     fn target_validation_requires_exact_delegated_target() {
         let claim_a = claim("person-is-alive");
diff --git a/crates/registry-notary-server/src/machine_quota.rs b/crates/registry-notary-server/src/machine_quota.rs
index 2f1758ad9c..ee50deffae 100644
--- a/crates/registry-notary-server/src/machine_quota.rs
+++ b/crates/registry-notary-server/src/machine_quota.rs
@@ -30,8 +30,11 @@ const MAX_MACHINE_QUOTA_KEY_LEN: usize = 128;
 /// this many principals are being tracked, adding a new one evicts the
 /// least-recently-started window so the map cannot grow without bound.
 const MAX_TRACKED_PRINCIPALS: usize = 10_000;
+const MAX_TRACKED_OPERATIONS: usize = 65_536;
 
 const WINDOW: Duration = Duration::minutes(1);
+pub(crate) const OPERATION_LEASE_SECONDS: i64 = 60;
+const OPERATION_LEASE: Duration = Duration::seconds(OPERATION_LEASE_SECONDS);
 
 type MachineQuotaKey = Bounded<MAX_MACHINE_QUOTA_KEY_LEN>;
 
@@ -41,12 +44,88 @@ pub struct MachineQuotaExceeded {
     pub retry_after_seconds: u64,
 }
 
+#[derive(Debug, Clone)]
+pub(crate) enum MachineQuotaOperationOutcome {
+    Acquired(MachineQuotaOperationFence),
+    Existing,
+    Conflict,
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct MachineQuotaOperationFence {
+    principal_key: MachineQuotaKey,
+    principal_hash: [u8; 32],
+    operation_hash: [u8; 32],
+    request_hash: [u8; 32],
+    lease_owner_hash: [u8; 32],
+    in_memory: Option<Arc<Mutex<InMemoryQuotaState>>>,
+}
+
 #[derive(Debug)]
 struct Counter {
     window_start: OffsetDateTime,
     used: u32,
 }
 
+#[derive(Debug, Default)]
+struct InMemoryQuotaState {
+    counters: HashMap<MachineQuotaKey, Counter>,
+    operations: HashMap<(MachineQuotaKey, [u8; 32]), QuotaOperation>,
+}
+
+#[derive(Debug)]
+struct QuotaOperation {
+    request_hash: [u8; 32],
+    lease_owner_hash: [u8; 32],
+    lease_expires_at: OffsetDateTime,
+    expires_at: OffsetDateTime,
+}
+
+impl MachineQuotaOperationFence {
+    pub(crate) fn principal_hash(&self) -> &[u8; 32] {
+        &self.principal_hash
+    }
+
+    pub(crate) fn operation_hash(&self) -> &[u8; 32] {
+        &self.operation_hash
+    }
+
+    pub(crate) fn lease_owner_hash(&self) -> &[u8; 32] {
+        &self.lease_owner_hash
+    }
+
+    pub(crate) fn complete_in_memory<T>(&self, operation: impl FnOnce() -> T) -> Result<T, ()> {
+        self.complete_in_memory_at(OffsetDateTime::now_utc(), operation)
+    }
+
+    fn complete_in_memory_at<T>(
+        &self,
+        now: OffsetDateTime,
+        operation: impl FnOnce() -> T,
+    ) -> Result<T, ()> {
+        let Some(in_memory) = self.in_memory.as_ref() else {
+            return Err(());
+        };
+        let state = match in_memory.lock() {
+            Ok(guard) => guard,
+            Err(poisoned) => poisoned.into_inner(),
+        };
+        let Some(stored) = state
+            .operations
+            .get(&(self.principal_key.clone(), self.operation_hash))
+        else {
+            return Err(());
+        };
+        if stored.request_hash != self.request_hash
+            || stored.lease_owner_hash != self.lease_owner_hash
+            || stored.lease_expires_at <= now
+        {
+            return Err(());
+        }
+        Ok(operation())
+    }
+}
+
 impl Counter {
     fn in_window(&self, now: OffsetDateTime) -> bool {
         now < self.window_start + WINDOW
@@ -67,7 +146,7 @@ pub struct MachineQuotaLimiter {
     config: MachineQuotaConfig,
     state_plane: Option<Arc<NotaryStatePlaneHandle>>,
     principal_hasher: AuditKeyHasher,
-    counters: Mutex<HashMap<MachineQuotaKey, Counter>>,
+    in_memory: Arc<Mutex<InMemoryQuotaState>>,
 }
 
 impl MachineQuotaLimiter {
@@ -77,7 +156,7 @@ impl MachineQuotaLimiter {
             config,
             state_plane: None,
             principal_hasher: AuditKeyHasher::unkeyed_dev_only(),
-            counters: Mutex::new(HashMap::new()),
+            in_memory: Arc::new(Mutex::new(InMemoryQuotaState::default())),
         }
     }
 
@@ -91,7 +170,7 @@ impl MachineQuotaLimiter {
             config,
             state_plane: Some(state_plane),
             principal_hasher,
-            counters: Mutex::new(HashMap::new()),
+            in_memory: Arc::new(Mutex::new(InMemoryQuotaState::default())),
         }
     }
 
@@ -120,11 +199,132 @@ impl MachineQuotaLimiter {
             .await
     }
 
+    /// Consume quota once for one canonical operation. Concurrent exact
+    /// retries share the operation hash, so only the first attempt spends
+    /// budget. One leased owner may reach the authoritative reservation;
+    /// contenders wait or take over without another debit.
+    pub(crate) async fn check_and_consume_once(
+        &self,
+        principal_id: &str,
+        cost: u32,
+        operation_id: &str,
+        request_id: &str,
+        lease_owner_id: &str,
+        operation_expires_at: OffsetDateTime,
+    ) -> Result<MachineQuotaOperationOutcome, MachineQuotaExceeded> {
+        validate_principal_id(principal_id)?;
+        if cost == 0 {
+            return Err(quota_failure());
+        }
+        let operation_hash = machine_quota_operation_hash(&self.principal_hasher, operation_id)?;
+        let request_hash = machine_quota_operation_request_hash(request_id)?;
+        let lease_owner_hash =
+            machine_quota_operation_owner_hash(&self.principal_hasher, lease_owner_id)?;
+        if operation_expires_at <= OffsetDateTime::now_utc() {
+            return Err(quota_failure());
+        }
+        let Some(state_plane) = self
+            .state_plane
+            .as_ref()
+            .filter(|state_plane| !state_plane.is_in_memory())
+        else {
+            return self.check_and_consume_once_at(
+                principal_id,
+                cost,
+                Some(operation_hash),
+                Some(request_hash),
+                Some(lease_owner_hash),
+                Some(operation_expires_at),
+                OffsetDateTime::now_utc(),
+            );
+        };
+        self.check_and_consume_once_postgres(
+            state_plane,
+            principal_id,
+            cost,
+            &operation_hash,
+            &request_hash,
+            &lease_owner_hash,
+            operation_expires_at,
+        )
+        .await
+    }
+
+    /// Release only the operation claim after a post-debit failure. The quota
+    /// debit is intentionally retained, so retries cannot turn signer or
+    /// construction failures into free work.
+    pub(crate) async fn release_operation(
+        &self,
+        principal_id: &str,
+        operation_id: &str,
+        lease_owner_id: &str,
+    ) -> Result<(), MachineQuotaExceeded> {
+        validate_principal_id(principal_id)?;
+        let operation_hash = machine_quota_operation_hash(&self.principal_hasher, operation_id)?;
+        let lease_owner_hash =
+            machine_quota_operation_owner_hash(&self.principal_hasher, lease_owner_id)?;
+        let Some(state_plane) = self
+            .state_plane
+            .as_ref()
+            .filter(|state_plane| !state_plane.is_in_memory())
+        else {
+            let key = MachineQuotaKey::new(principal_id).map_err(|_| quota_failure())?;
+            let mut state = match self.in_memory.lock() {
+                Ok(guard) => guard,
+                Err(poisoned) => poisoned.into_inner(),
+            };
+            if let Some(operation) = state.operations.get_mut(&(key, operation_hash)) {
+                if operation.lease_owner_hash == lease_owner_hash {
+                    operation.lease_expires_at = OffsetDateTime::now_utc();
+                }
+            }
+            return Ok(());
+        };
+        let principal_hash = machine_quota_hash(&self.principal_hasher, principal_id)?;
+        let runtime = state_plane.runtime().map_err(|_| quota_failure())?;
+        let session = runtime
+            .open_domain_session()
+            .await
+            .map_err(|_| quota_failure())?;
+        session
+            .run_operation(session.client().query_one(
+                "SELECT registry_notary_api.machine_quota_operation_release_v1($1, $2, $3)",
+                &[
+                    &principal_hash,
+                    &&operation_hash[..],
+                    &&lease_owner_hash[..],
+                ],
+            ))
+            .await
+            .map_err(|_| quota_failure())?;
+        Ok(())
+    }
+
     #[must_use]
     pub(crate) const fn is_enabled(&self) -> bool {
         self.config.enabled
     }
 
+    fn operation_fence(
+        &self,
+        principal_id: &str,
+        operation_hash: [u8; 32],
+        request_hash: [u8; 32],
+        lease_owner_hash: [u8; 32],
+        in_memory: bool,
+    ) -> Result<MachineQuotaOperationFence, MachineQuotaExceeded> {
+        Ok(MachineQuotaOperationFence {
+            principal_key: MachineQuotaKey::new(principal_id).map_err(|_| quota_failure())?,
+            principal_hash: machine_quota_hash(&self.principal_hasher, principal_id)?
+                .try_into()
+                .map_err(|_| quota_failure())?,
+            operation_hash,
+            request_hash,
+            lease_owner_hash,
+            in_memory: in_memory.then(|| Arc::clone(&self.in_memory)),
+        })
+    }
+
     pub(crate) fn batch_reservation_parameters(
         &self,
         principal_id: &str,
@@ -190,6 +390,86 @@ impl MachineQuotaLimiter {
         })
     }
 
+    // Keep each hash explicit at the trust boundary so operation, request,
+    // and owner identities cannot be accidentally substituted or reordered.
+    #[allow(clippy::too_many_arguments)]
+    async fn check_and_consume_once_postgres(
+        &self,
+        state_plane: &NotaryStatePlaneHandle,
+        principal_id: &str,
+        cost: u32,
+        operation_hash: &[u8; 32],
+        request_hash: &[u8; 32],
+        lease_owner_hash: &[u8; 32],
+        operation_expires_at: OffsetDateTime,
+    ) -> Result<MachineQuotaOperationOutcome, MachineQuotaExceeded> {
+        let limit = if self.config.enabled {
+            Some(
+                i32::try_from(self.config.subjects_per_minute)
+                    .ok()
+                    .filter(|limit| *limit > 0)
+                    .ok_or_else(quota_failure)?,
+            )
+        } else {
+            None
+        };
+        let cost = i32::try_from(cost)
+            .ok()
+            .filter(|cost| *cost > 0)
+            .ok_or_else(quota_failure)?;
+        let principal_hash = machine_quota_hash(&self.principal_hasher, principal_id)?;
+        let runtime = state_plane.runtime().map_err(|_| quota_failure())?;
+        let session = runtime
+            .open_domain_session()
+            .await
+            .map_err(|_| quota_failure())?;
+        let row = session
+            .run_operation(session.client().query_one(
+                concat!(
+                    "SELECT allowed, acquired, conflict, retry_after_seconds ",
+                    "FROM registry_notary_api.machine_quota_debit_once_v1(",
+                    "$1, $2, $3, $4, $5, $6, $7, $8)"
+                ),
+                &[
+                    &principal_hash,
+                    &&operation_hash[..],
+                    &&request_hash[..],
+                    &&lease_owner_hash[..],
+                    &limit,
+                    &cost,
+                    &(OPERATION_LEASE.whole_seconds() as i32),
+                    &operation_expires_at,
+                ],
+            ))
+            .await
+            .map_err(|_| quota_failure())?;
+        let allowed: bool = row.try_get("allowed").map_err(|_| quota_failure())?;
+        if allowed {
+            let conflict: bool = row.try_get("conflict").map_err(|_| quota_failure())?;
+            if conflict {
+                return Ok(MachineQuotaOperationOutcome::Conflict);
+            }
+            let acquired: bool = row.try_get("acquired").map_err(|_| quota_failure())?;
+            return Ok(if acquired {
+                MachineQuotaOperationOutcome::Acquired(self.operation_fence(
+                    principal_id,
+                    *operation_hash,
+                    *request_hash,
+                    *lease_owner_hash,
+                    false,
+                )?)
+            } else {
+                MachineQuotaOperationOutcome::Existing
+            });
+        }
+        let retry_after_seconds: i64 = row
+            .try_get("retry_after_seconds")
+            .map_err(|_| quota_failure())?;
+        Err(MachineQuotaExceeded {
+            retry_after_seconds: retry_after_seconds.max(1) as u64,
+        })
+    }
+
     fn check_and_consume_at(
         &self,
         principal_id: &str,
@@ -199,6 +479,26 @@ impl MachineQuotaLimiter {
         if !self.config.enabled || cost == 0 {
             return Ok(());
         }
+        self.check_and_consume_once_at(principal_id, cost, None, None, None, None, now)
+            .map(|_| ())
+    }
+
+    // Tests inject every clock and identity component independently to cover
+    // takeover and stale-owner behavior without wall-clock sleeps.
+    #[allow(clippy::too_many_arguments)]
+    fn check_and_consume_once_at(
+        &self,
+        principal_id: &str,
+        cost: u32,
+        operation_hash: Option<[u8; 32]>,
+        request_hash: Option<[u8; 32]>,
+        lease_owner_hash: Option<[u8; 32]>,
+        operation_expires_at: Option<OffsetDateTime>,
+        now: OffsetDateTime,
+    ) -> Result<MachineQuotaOperationOutcome, MachineQuotaExceeded> {
+        if cost == 0 {
+            return Err(quota_failure());
+        }
 
         // A principal id that does not fit the bounded key is treated as
         // over quota rather than silently bypassing the limiter: this is a
@@ -212,56 +512,131 @@ impl MachineQuotaLimiter {
             }
         };
 
-        let mut counters = match self.counters.lock() {
+        let mut state = match self.in_memory.lock() {
             Ok(guard) => guard,
             Err(poisoned) => poisoned.into_inner(),
         };
-        prune_expired(&mut counters, now);
+        prune_expired(&mut state, now);
 
-        let limit = self.config.subjects_per_minute;
-        let (window_start, used) = match counters.get(&key) {
-            Some(counter) if counter.in_window(now) => (counter.window_start, counter.used),
-            _ => (now, 0),
-        };
+        let operation = operation_hash
+            .zip(request_hash)
+            .zip(lease_owner_hash)
+            .zip(operation_expires_at)
+            .map(
+                |(((operation_hash, request_hash), lease_owner_hash), operation_expires_at)| {
+                    (
+                        (key.clone(), operation_hash),
+                        request_hash,
+                        lease_owner_hash,
+                        operation_expires_at,
+                    )
+                },
+            );
+        if operation_hash.is_some() != operation.is_some()
+            || request_hash.is_some() != operation.is_some()
+            || lease_owner_hash.is_some() != operation.is_some()
+            || operation_expires_at.is_some() != operation.is_some()
+        {
+            return Err(quota_failure());
+        }
+        if let Some((operation_key, request_hash, lease_owner_hash, _)) = operation.as_ref() {
+            if let Some(stored) = state.operations.get_mut(operation_key) {
+                if stored.request_hash != *request_hash {
+                    return Ok(MachineQuotaOperationOutcome::Conflict);
+                }
+                if stored.lease_owner_hash == *lease_owner_hash || stored.lease_expires_at <= now {
+                    stored.lease_owner_hash = *lease_owner_hash;
+                    stored.lease_expires_at =
+                        std::cmp::min(now + OPERATION_LEASE, stored.expires_at);
+                    return Ok(MachineQuotaOperationOutcome::Acquired(
+                        self.operation_fence(
+                            principal_id,
+                            operation_key.1,
+                            *request_hash,
+                            *lease_owner_hash,
+                            true,
+                        )?,
+                    ));
+                }
+                return Ok(MachineQuotaOperationOutcome::Existing);
+            }
+        }
+        if operation.is_some() && state.operations.len() >= MAX_TRACKED_OPERATIONS {
+            return Err(quota_failure());
+        }
 
-        let remaining = limit.saturating_sub(used);
-        if cost > remaining {
-            let retry_after_seconds = match counters.get(&key) {
-                Some(counter) if counter.in_window(now) => counter.retry_after_seconds(now),
-                _ => WINDOW.whole_seconds() as u64,
+        if self.config.enabled {
+            let limit = self.config.subjects_per_minute;
+            let (window_start, used) = match state.counters.get(&key) {
+                Some(counter) if counter.in_window(now) => (counter.window_start, counter.used),
+                _ => (now, 0),
             };
-            return Err(MachineQuotaExceeded {
-                retry_after_seconds,
-            });
-        }
 
-        if !counters.contains_key(&key) {
-            evict_oldest_if_at_capacity(&mut counters);
+            let remaining = limit.saturating_sub(used);
+            if cost > remaining {
+                let retry_after_seconds = match state.counters.get(&key) {
+                    Some(counter) if counter.in_window(now) => counter.retry_after_seconds(now),
+                    _ => WINDOW.whole_seconds() as u64,
+                };
+                return Err(MachineQuotaExceeded {
+                    retry_after_seconds,
+                });
+            }
+
+            if !state.counters.contains_key(&key) {
+                evict_oldest_if_at_capacity(&mut state.counters);
+            }
+            state.counters.insert(
+                key,
+                Counter {
+                    window_start,
+                    used: used + cost,
+                },
+            );
         }
-        counters.insert(
-            key,
-            Counter {
-                window_start,
-                used: used + cost,
-            },
-        );
-        Ok(())
+        if let Some((operation_key, request_hash, lease_owner_hash, operation_expires_at)) =
+            operation
+        {
+            state.operations.insert(
+                operation_key,
+                QuotaOperation {
+                    request_hash,
+                    lease_owner_hash,
+                    lease_expires_at: std::cmp::min(now + OPERATION_LEASE, operation_expires_at),
+                    expires_at: operation_expires_at,
+                },
+            );
+        }
+        let Some(operation_hash) = operation_hash else {
+            return Ok(MachineQuotaOperationOutcome::Existing);
+        };
+        Ok(MachineQuotaOperationOutcome::Acquired(
+            self.operation_fence(
+                principal_id,
+                operation_hash,
+                request_hash.ok_or_else(quota_failure)?,
+                lease_owner_hash.ok_or_else(quota_failure)?,
+                true,
+            )?,
+        ))
     }
 
     #[cfg(test)]
     fn tracked_principal_count(&self) -> usize {
-        self.counters
+        self.in_memory
             .lock()
             .expect("counter mutex is not poisoned")
+            .counters
             .len()
     }
 
     #[cfg(test)]
     fn is_tracked(&self, principal_id: &str) -> bool {
         let key = MachineQuotaKey::new(principal_id).expect("test principal id is bounded");
-        self.counters
+        self.in_memory
             .lock()
             .expect("counter mutex is not poisoned")
+            .counters
             .contains_key(&key)
     }
 }
@@ -292,6 +667,62 @@ fn machine_quota_hash(
     decode_32_byte_hex(digest).ok_or_else(quota_failure)
 }
 
+fn machine_quota_operation_hash(
+    hasher: &AuditKeyHasher,
+    operation_id: &str,
+) -> Result<[u8; 32], MachineQuotaExceeded> {
+    if operation_id.is_empty() || operation_id.len() > 512 {
+        return Err(quota_failure());
+    }
+    let encoded = hasher
+        .audit_reference_hash("notary-machine-quota-operation-v1", "", operation_id)
+        .map_err(|_| quota_failure())?;
+    let digest = encoded
+        .strip_prefix("hmac-sha256:")
+        .or_else(|| encoded.strip_prefix("sha256:"))
+        .ok_or_else(quota_failure)?;
+    decode_32_byte_hex(digest)
+        .ok_or_else(quota_failure)?
+        .try_into()
+        .map_err(|_| quota_failure())
+}
+
+fn machine_quota_operation_request_hash(
+    request_id: &str,
+) -> Result<[u8; 32], MachineQuotaExceeded> {
+    let digest = request_id
+        .strip_prefix("sha256:")
+        .ok_or_else(quota_failure)?;
+    decode_32_byte_hex(digest)
+        .ok_or_else(quota_failure)?
+        .try_into()
+        .map_err(|_| quota_failure())
+}
+
+fn machine_quota_operation_owner_hash(
+    hasher: &AuditKeyHasher,
+    lease_owner_id: &str,
+) -> Result<[u8; 32], MachineQuotaExceeded> {
+    if lease_owner_id.is_empty() || lease_owner_id.len() > 256 {
+        return Err(quota_failure());
+    }
+    let encoded = hasher
+        .audit_reference_hash(
+            "notary-machine-quota-operation-owner-v1",
+            "",
+            lease_owner_id,
+        )
+        .map_err(|_| quota_failure())?;
+    let digest = encoded
+        .strip_prefix("hmac-sha256:")
+        .or_else(|| encoded.strip_prefix("sha256:"))
+        .ok_or_else(quota_failure)?;
+    decode_32_byte_hex(digest)
+        .ok_or_else(quota_failure)?
+        .try_into()
+        .map_err(|_| quota_failure())
+}
+
 fn decode_32_byte_hex(encoded: &str) -> Option<Vec<u8>> {
     if encoded.len() != 64 {
         return None;
@@ -316,8 +747,11 @@ fn hex_nibble(value: u8) -> Option<u8> {
     }
 }
 
-fn prune_expired(counters: &mut HashMap<MachineQuotaKey, Counter>, now: OffsetDateTime) {
-    counters.retain(|_, counter| counter.in_window(now));
+fn prune_expired(state: &mut InMemoryQuotaState, now: OffsetDateTime) {
+    state.counters.retain(|_, counter| counter.in_window(now));
+    state
+        .operations
+        .retain(|_, operation| operation.expires_at > now);
 }
 
 fn evict_oldest_if_at_capacity(counters: &mut HashMap<MachineQuotaKey, Counter>) {
@@ -348,6 +782,15 @@ mod tests {
         }
     }
 
+    fn acquired(
+        outcome: Result<MachineQuotaOperationOutcome, MachineQuotaExceeded>,
+    ) -> MachineQuotaOperationFence {
+        match outcome.expect("operation succeeds") {
+            MachineQuotaOperationOutcome::Acquired(fence) => fence,
+            other => panic!("expected acquired operation, got {other:?}"),
+        }
+    }
+
     #[test]
     fn disabled_quota_never_denies() {
         let limiter = MachineQuotaLimiter::new(config(false, 1));
@@ -370,6 +813,219 @@ mod tests {
         assert_eq!(err.retry_after_seconds, 60);
     }
 
+    #[test]
+    fn exact_operation_retries_consume_quota_once() {
+        let limiter = MachineQuotaLimiter::new(config(true, 1));
+        let exact_operation = [0x11; 32];
+        let distinct_operation = [0x22; 32];
+        let exact_request = [0x21; 32];
+
+        assert!(limiter
+            .check_and_consume_once_at(
+                "machine-a",
+                1,
+                Some(exact_operation),
+                Some(exact_request),
+                Some([0x31; 32]),
+                Some(now() + Duration::minutes(5)),
+                now(),
+            )
+            .is_ok());
+        assert!(matches!(
+            limiter
+                .check_and_consume_once_at(
+                    "machine-a",
+                    1,
+                    Some(exact_operation),
+                    Some(exact_request),
+                    Some([0x32; 32]),
+                    Some(now() + Duration::minutes(5)),
+                    now(),
+                )
+                .unwrap(),
+            MachineQuotaOperationOutcome::Existing
+        ));
+        assert!(matches!(
+            limiter
+                .check_and_consume_once_at(
+                    "machine-a",
+                    1,
+                    Some(exact_operation),
+                    Some([0x23; 32]),
+                    Some([0x32; 32]),
+                    Some(now() + Duration::minutes(5)),
+                    now(),
+                )
+                .unwrap(),
+            MachineQuotaOperationOutcome::Conflict
+        ));
+        assert!(limiter
+            .check_and_consume_once_at(
+                "machine-a",
+                1,
+                Some(distinct_operation),
+                Some([0x24; 32]),
+                Some([0x33; 32]),
+                Some(now() + Duration::minutes(5)),
+                now(),
+            )
+            .is_err());
+        acquired(limiter.check_and_consume_once_at(
+            "machine-a",
+            1,
+            Some(exact_operation),
+            Some(exact_request),
+            Some([0x32; 32]),
+            Some(now() + Duration::minutes(5)),
+            now() + Duration::seconds(61),
+        ));
+    }
+
+    #[test]
+    fn operation_identity_outlives_the_quota_window() {
+        let limiter = MachineQuotaLimiter::new(config(true, 1));
+        let exact_operation = [0x33; 32];
+
+        assert!(limiter
+            .check_and_consume_once_at(
+                "machine-a",
+                1,
+                Some(exact_operation),
+                Some([0x34; 32]),
+                Some([0x41; 32]),
+                Some(now() + Duration::minutes(5)),
+                now(),
+            )
+            .is_ok());
+        let next_window = now() + Duration::seconds(61);
+        acquired(limiter.check_and_consume_once_at(
+            "machine-a",
+            1,
+            Some(exact_operation),
+            Some([0x34; 32]),
+            Some([0x42; 32]),
+            Some(now() + Duration::minutes(5)),
+            next_window,
+        ));
+        assert!(limiter
+            .check_and_consume_once_at(
+                "machine-a",
+                1,
+                Some([0x44; 32]),
+                Some([0x35; 32]),
+                Some([0x43; 32]),
+                Some(now() + Duration::minutes(5)),
+                next_window,
+            )
+            .is_ok());
+    }
+
+    #[test]
+    fn owner_renewal_keeps_contenders_outside_the_completion_window() {
+        let limiter = MachineQuotaLimiter::new(config(true, 1));
+        let operation = [0x51; 32];
+        let request = [0x52; 32];
+        let owner = [0x53; 32];
+        let contender = [0x54; 32];
+        let expires_at = now() + Duration::minutes(5);
+
+        acquired(limiter.check_and_consume_once_at(
+            "machine-a",
+            1,
+            Some(operation),
+            Some(request),
+            Some(owner),
+            Some(expires_at),
+            now(),
+        ));
+        let renewed_fence = acquired(limiter.check_and_consume_once_at(
+            "machine-a",
+            1,
+            Some(operation),
+            Some(request),
+            Some(owner),
+            Some(expires_at),
+            now() + Duration::seconds(25),
+        ));
+        assert!(matches!(
+            limiter
+                .check_and_consume_once_at(
+                    "machine-a",
+                    1,
+                    Some(operation),
+                    Some(request),
+                    Some(contender),
+                    Some(expires_at),
+                    now() + Duration::seconds(61),
+                )
+                .unwrap(),
+            MachineQuotaOperationOutcome::Existing
+        ));
+        let takeover_fence = acquired(limiter.check_and_consume_once_at(
+            "machine-a",
+            1,
+            Some(operation),
+            Some(request),
+            Some(contender),
+            Some(expires_at),
+            now() + Duration::seconds(86),
+        ));
+        assert!(
+            renewed_fence
+                .complete_in_memory_at(now() + Duration::seconds(86), || ())
+                .is_err(),
+            "a stale owner is fenced after crash-style lease takeover",
+        );
+        assert!(takeover_fence
+            .complete_in_memory_at(now() + Duration::seconds(86), || ())
+            .is_ok());
+    }
+
+    #[test]
+    fn disabled_quota_still_serializes_idempotent_operations() {
+        let limiter = MachineQuotaLimiter::new(config(false, 1));
+        let operation = [0x61; 32];
+        let request = [0x62; 32];
+        acquired(limiter.check_and_consume_once_at(
+            "machine-a",
+            1,
+            Some(operation),
+            Some(request),
+            Some([0x63; 32]),
+            Some(now() + Duration::minutes(5)),
+            now(),
+        ));
+        assert!(matches!(
+            limiter
+                .check_and_consume_once_at(
+                    "machine-a",
+                    1,
+                    Some(operation),
+                    Some(request),
+                    Some([0x64; 32]),
+                    Some(now() + Duration::minutes(5)),
+                    now(),
+                )
+                .unwrap(),
+            MachineQuotaOperationOutcome::Existing
+        ));
+        assert!(matches!(
+            limiter
+                .check_and_consume_once_at(
+                    "machine-a",
+                    1,
+                    Some(operation),
+                    Some([0x65; 32]),
+                    Some([0x64; 32]),
+                    Some(now() + Duration::minutes(5)),
+                    now(),
+                )
+                .unwrap(),
+            MachineQuotaOperationOutcome::Conflict
+        ));
+        assert_eq!(limiter.tracked_principal_count(), 0);
+    }
+
     #[test]
     fn window_expiry_resets_budget() {
         let limiter = MachineQuotaLimiter::new(config(true, 10));
diff --git a/crates/registry-notary-server/src/metrics.rs b/crates/registry-notary-server/src/metrics.rs
index 4fd2220e61..ce9402d62f 100644
--- a/crates/registry-notary-server/src/metrics.rs
+++ b/crates/registry-notary-server/src/metrics.rs
@@ -311,6 +311,7 @@ fn endpoint_kind_from_route(route: &str) -> &'static str {
         "/.well-known/vct/{*vct_path}" | "/credentials/{*vct_path}" => "credential_metadata",
         "/oid4vci/offer/start"
         | "/oid4vci/offer/callback"
+        | "/oid4vci/offers"
         | "/oid4vci/token"
         | "/oid4vci/credential" => "oid4vci",
         "/v1/claims" | "/v1/claims/{claim_id}" | "/v1/formats" => "catalog",
diff --git a/crates/registry-notary-server/src/openapi.rs b/crates/registry-notary-server/src/openapi.rs
index 229730e612..e5f9f70f6b 100644
--- a/crates/registry-notary-server/src/openapi.rs
+++ b/crates/registry-notary-server/src/openapi.rs
@@ -316,6 +316,109 @@ fn build_openapi_document() -> Value {
                     }
                 }
             },
+            "/oid4vci/offers": {
+                "post": {
+                    "summary": "Create a registrar-initiated pre-authorized offer",
+                    "operationId": "createOid4vciRegistryOffer",
+                    "description": "Creates one short-lived pre-authorized OID4VCI offer from an existing fresh registry-backed evaluation owned by the authenticated machine client. The client supplies only the evaluation id and credential configuration id. Registry Notary reloads the exact stored values, target, purpose, compiler-pinned Relay provenance, credential profile, and configuration fingerprint. The caller must present an external API-key or OIDC machine credential with registry_notary:credential_offer_create, the selected configuration scope, and exact target-scoped authorization_details for create_credential_offer; a Notary-issued wallet access token is not accepted. Idempotency-Key is required. Reusing one key with the same request returns the exact stored response, while changing the request or attempting to create another offer from the consumed evaluation returns 409. The credential_offer_uri describes the required tx_code but never contains its numeric value. The registrar must deliver that value to the holder through a separate channel. Every response is non-storable.",
+                    "security": [
+                        { "apiKeyAuth": [] },
+                        { "bearerAuth": [] }
+                    ],
+                    "parameters": [
+                        {
+                            "name": "Idempotency-Key",
+                            "in": "header",
+                            "required": true,
+                            "description": "Caller-generated retry key. Use the same key only for an exact retry of the same request.",
+                            "schema": {
+                                "type": "string",
+                                "minLength": 1,
+                                "maxLength": 256,
+                                "pattern": "^[\\x21\\x23-\\x5B\\x5D-\\x7E]{1,256}$"
+                            }
+                        }
+                    ],
+                    "requestBody": {
+                        "required": true,
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "$ref": "#/components/schemas/RegistryClientOfferRequest"
+                                }
+                            }
+                        }
+                    },
+                    "responses": {
+                        "200": {
+                            "description": "New or exactly replayed credential offer response",
+                            "content": {
+                                "application/json": {
+                                    "schema": {
+                                        "$ref": "#/components/schemas/RegistryClientOfferResponse"
+                                    }
+                                }
+                            }
+                        },
+                        "400": {
+                            "description": "Invalid request or idempotency key",
+                            "content": {
+                                "application/problem+json": {
+                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
+                                }
+                            }
+                        },
+                        "401": {
+                            "description": "Missing or invalid machine credential",
+                            "content": {
+                                "application/problem+json": {
+                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
+                                }
+                            }
+                        },
+                        "403": {
+                            "description": "Caller lacks a required scope or exact target-scoped authorization",
+                            "content": {
+                                "application/problem+json": {
+                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
+                                }
+                            }
+                        },
+                        "404": {
+                            "description": "Flow is disabled or the evaluation is unavailable to this caller",
+                            "content": {
+                                "application/problem+json": {
+                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
+                                }
+                            }
+                        },
+                        "409": {
+                            "description": "Idempotency conflict or evaluation already consumed",
+                            "content": {
+                                "application/problem+json": {
+                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
+                                }
+                            }
+                        },
+                        "429": {
+                            "description": "Offer creation is rate limited",
+                            "content": {
+                                "application/problem+json": {
+                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
+                                }
+                            }
+                        },
+                        "503": {
+                            "description": "Offer correctness state or another required dependency is unavailable",
+                            "content": {
+                                "application/problem+json": {
+                                    "schema": { "$ref": "#/components/schemas/ProblemDetails" }
+                                }
+                            }
+                        }
+                    }
+                }
+            },
             "/oid4vci/offer/start": {
                 "get": {
                     "summary": "Begin an authenticated pre-authorized-code offer",
@@ -722,6 +825,8 @@ fn build_openapi_document() -> Value {
                 "SdJwtVcTypeMetadata": sd_jwt_vc_type_metadata_schema(),
                 "CredentialRequest": credential_request_schema(),
                 "CredentialResponse": credential_response_schema(),
+                "RegistryClientOfferRequest": registry_client_offer_request_schema(),
+                "RegistryClientOfferResponse": registry_client_offer_response_schema(),
                 "TokenRequest": token_request_schema(),
                 "TokenResponse": token_response_schema(),
                 "Oid4vciError": oid4vci_error_schema()
@@ -815,10 +920,16 @@ fn build_openapi_document() -> Value {
         ("ProvenanceUsed", provenance_used_schema()),
         ("TargetRefView", target_ref_view_schema()),
         ("EvidenceEntityRef", evidence_entity_ref_schema()),
+        ("RelayOutputContract", relay_output_contract_schema()),
+        (
+            "RelayOutputObjectFieldContract",
+            relay_output_object_field_contract_schema(),
+        ),
     ];
     for (name, schema) in schema_overrides.iter() {
         document_value["components"]["schemas"][*name] = schema.clone();
     }
+    set_registry_offer_no_store_headers(&mut document_value);
     set_json_response_schema(
         &mut document_value,
         "/ready",
@@ -1385,6 +1496,68 @@ fn add_response_examples(document: &mut Value) {
             oid4vci_error_example(code, description),
         );
     }
+    set_json_response(
+        document,
+        "/oid4vci/offers",
+        "post",
+        "200",
+        "New or exactly replayed credential offer response",
+        registry_client_offer_response_example(),
+    );
+    for (status, code, title, detail) in [
+        (
+            "400",
+            "request.invalid",
+            "Invalid evidence request",
+            "the offer request or Idempotency-Key is invalid",
+        ),
+        (
+            "401",
+            "auth.missing_credential",
+            "Missing credential",
+            "missing authentication credential",
+        ),
+        (
+            "403",
+            "auth.scope_denied",
+            "Scope denied",
+            "missing the offer-create or credential-configuration scope",
+        ),
+        (
+            "404",
+            "evaluation.not_found",
+            "Evaluation not found",
+            "the evaluation is unknown, expired, or not owned by this client",
+        ),
+        (
+            "409",
+            "offer_conflict",
+            "Credential offer was not created",
+            "the idempotency key conflicts or the evaluation was already consumed",
+        ),
+        (
+            "429",
+            "evaluation.quota_exceeded",
+            "Machine quota exceeded",
+            "the machine offer quota was exceeded for this principal",
+        ),
+        (
+            "503",
+            "offer_unavailable",
+            "Credential offer was not created",
+            "the offer correctness state is unavailable",
+        ),
+    ] {
+        let status_code = status.parse::<u16>().expect("static status is valid");
+        set_problem_response(
+            document,
+            "/oid4vci/offers",
+            "post",
+            status,
+            title,
+            problem_example(status_code, code, title, detail),
+        );
+    }
     set_json_response(
         document,
         "/oid4vci/token",
@@ -2417,6 +2590,33 @@ fn set_problem_response_schema(
     );
 }
 
+fn set_registry_offer_no_store_headers(document: &mut Value) {
+    let Some(responses) = document
+        .pointer_mut("/paths/~1oid4vci~1offers/post/responses")
+        .and_then(Value::as_object_mut)
+    else {
+        return;
+    };
+    for status in ["200", "400", "401", "403", "404", "409", "429", "503"] {
+        let Some(response) = responses.get_mut(status).and_then(Value::as_object_mut) else {
+            continue;
+        };
+        response.insert(
+            "headers".to_string(),
+            json!({
+                "Cache-Control": {
+                    "description": "Prevents storage of offer, code, and transaction material.",
+                    "schema": { "type": "string", "enum": ["no-store"] }
+                },
+                "Pragma": {
+                    "description": "Compatibility cache directive for sensitive offer responses.",
+                    "schema": { "type": "string", "enum": ["no-cache"] }
+                }
+            }),
+        );
+    }
+}
+
 fn set_response_schema(
     document: &mut Value,
     path: &str,
@@ -2965,11 +3165,15 @@ fn sd_jwt_vc_type_metadata_schema() -> Value {
                         },
                         "sd": {
                             "type": "string",
-                            "enum": ["always"]
+                            "enum": ["always"],
+                            "description": "The complete top-level claim is selectively disclosed as one unit. Nested object fields and array items are not independently disclosable."
                         },
                         "mandatory": { "type": "boolean" },
                         "registry_notary_semantics": {
                             "$ref": "#/components/schemas/ClaimSemantics"
+                        },
+                        "registry_notary_value_schema": {
+                            "$ref": "#/components/schemas/RelayOutputContract"
                         }
                     },
                     "additionalProperties": true
@@ -2980,6 +3184,161 @@ fn sd_jwt_vc_type_metadata_schema() -> Value {
     })
 }
 
+fn registry_client_offer_request_schema() -> Value {
+    json!({
+        "type": "object",
+        "required": ["evaluation_id", "credential_configuration_id"],
+        "properties": {
+            "evaluation_id": {
+                "type": "string",
+                "description": "Identifier of the fresh registry-backed evaluation owned by the authenticated machine client."
+            },
+            "credential_configuration_id": {
+                "type": "string",
+                "description": "Configured credential type authorized for the evaluation's exact claim set, purpose, and target."
+            }
+        },
+        "additionalProperties": false
+    })
+}
+
+fn registry_client_offer_response_schema() -> Value {
+    json!({
+        "type": "object",
+        "required": ["credential_offer_uri", "tx_code", "expires_at"],
+        "properties": {
+            "credential_offer_uri": {
+                "type": "string",
+                "format": "uri",
+                "description": "Sensitive standard credential offer URI. It contains the pre-authorized code and describes the tx_code requirement, but never contains the numeric tx_code value."
+            },
+            "tx_code": {
+                "type": "string",
+                "pattern": "^[0-9]+$",
+                "description": "Required sensitive numeric transaction code. Deliver it to the holder through a channel separate from the credential_offer_uri."
+            },
+            "expires_at": {
+                "type": "string",
+                "format": "date-time",
+                "description": "Expiry of the pre-authorized code, capped by the stored evaluation expiry."
+            }
+        },
+        "additionalProperties": false
+    })
+}
+
+fn relay_output_contract_schema() -> Value {
+    // Keep the published schema aligned with the v1 recursive contract bounds
+    // enforced by registry-notary-core.
+    let max_bytes = 65_536_u32;
+    let max_fields = 32_usize;
+    let max_items = 256_u16;
+    json!({
+        "description": "Recursive, closed compiler-pinned Relay output contract. Runtime validation also enforces maximum depth 8, 256 schema nodes, 4096 expanded nodes, and 128-byte field names.",
+        "oneOf": [
+            {
+                "type": "object",
+                "required": ["type"],
+                "properties": {
+                    "type": { "type": "string", "enum": ["boolean"] },
+                    "nullable": { "type": "boolean", "default": false }
+                },
+                "additionalProperties": false
+            },
+            {
+                "type": "object",
+                "required": ["type", "minimum", "maximum"],
+                "properties": {
+                    "type": { "type": "string", "enum": ["integer"] },
+                    "nullable": { "type": "boolean", "default": false },
+                    "minimum": { "type": "integer", "format": "int64" },
+                    "maximum": { "type": "integer", "format": "int64" }
+                },
+                "additionalProperties": false
+            },
+            {
+                "type": "object",
+                "required": ["type", "max_bytes"],
+                "properties": {
+                    "type": { "type": "string", "enum": ["string"] },
+                    "nullable": { "type": "boolean", "default": false },
+                    "max_bytes": {
+                        "type": "integer",
+                        "minimum": 1,
+                        "maximum": max_bytes
+                    }
+                },
+                "additionalProperties": false
+            },
+            {
+                "type": "object",
+                "required": ["type"],
+                "properties": {
+                    "type": { "type": "string", "enum": ["date"] },
+                    "nullable": { "type": "boolean", "default": false }
+                },
+                "additionalProperties": false
+            },
+            {
+                "type": "object",
+                "required": ["type", "max_bytes", "fields"],
+                "properties": {
+                    "type": { "type": "string", "enum": ["object"] },
+                    "nullable": { "type": "boolean", "default": false },
+                    "max_bytes": {
+                        "type": "integer",
+                        "minimum": 1,
+                        "maximum": max_bytes
+                    },
+                    "fields": {
+                        "type": "object",
+                        "minProperties": 1,
+                        "maxProperties": max_fields,
+                        "additionalProperties": {
+                            "$ref": "#/components/schemas/RelayOutputObjectFieldContract"
+                        }
+                    }
+                },
+                "additionalProperties": false
+            },
+            {
+                "type": "object",
+                "required": ["type", "max_bytes", "max_items", "items"],
+                "properties": {
+                    "type": { "type": "string", "enum": ["array"] },
+                    "nullable": { "type": "boolean", "default": false },
+                    "max_bytes": {
+                        "type": "integer",
+                        "minimum": 1,
+                        "maximum": max_bytes
+                    },
+                    "max_items": {
+                        "type": "integer",
+                        "minimum": 1,
+                        "maximum": max_items
+                    },
+                    "items": {
+                        "$ref": "#/components/schemas/RelayOutputContract"
+                    }
+                },
+                "additionalProperties": false
+            }
+        ]
+    })
+}
+
+fn relay_output_object_field_contract_schema() -> Value {
+    json!({
+        "type": "object",
+        "required": ["required", "schema"],
+        "properties": {
+            "required": { "type": "boolean" },
+            "schema": { "$ref": "#/components/schemas/RelayOutputContract" }
+        },
+        "additionalProperties": false
+    })
+}
+
 fn credential_request_schema() -> Value {
     json!({
         "type": "object",
@@ -3316,6 +3675,10 @@ fn sd_jwt_vc_type_metadata_example() -> Value {
                     "concept": "https://publicschema.org/Person",
                     "predicate": "urn:registry-notary:predicate:person-is-alive",
                     "derived_from": ["https://publicschema.org/date_of_death"]
+                },
+                "registry_notary_value_schema": {
+                    "type": "boolean",
+                    "nullable": false
                 }
             }
         ]
@@ -3329,6 +3692,14 @@ fn oid4vci_credential_response_example() -> Value {
     })
 }
 
+fn registry_client_offer_response_example() -> Value {
+    json!({
+        "credential_offer_uri": "openid-credential-offer://?credential_offer=%7B%22credential_issuer%22%3A%22https%3A%2F%2Fissuer.example.gov%22%2C%22credential_configuration_ids%22%3A%5B%22birth_certificate_sd_jwt%22%5D%2C%22grants%22%3A%7B%22urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Apre-authorized_code%22%3A%7B%22pre-authorized_code%22%3A%22fake-example-code%22%2C%22tx_code%22%3A%7B%22input_mode%22%3A%22numeric%22%2C%22length%22%3A6%7D%7D%7D%7D",
+        "tx_code": "123456",
+        "expires_at": "2026-07-29T12:05:00Z"
+    })
+}
+
 fn oid4vci_token_response_example() -> Value {
     json!({
         "access_token": "eyJhbGciOiJFZERTQSIsInR5cCI6InJlZ2lzdHJ5LW5vdGFyeS1hY2Nlc3MrancifQ.payload.signature",
@@ -3714,6 +4085,7 @@ mod tests {
             "/credentials/{vct_path}",
             "/.well-known/vct/{vct_path}",
             "/oid4vci/credential",
+            "/oid4vci/offers",
             "/oid4vci/offer/start",
             "/oid4vci/offer/callback",
             "/oid4vci/token",
@@ -3974,6 +4346,7 @@ mod tests {
             ("/credentials/{vct_path}", "get", "200"),
             ("/.well-known/vct/{vct_path}", "get", "200"),
             ("/oid4vci/credential", "post", "200"),
+            ("/oid4vci/offers", "post", "200"),
             ("/oid4vci/token", "post", "200"),
             ("/v1/claims", "get", "200"),
             ("/v1/claims/{claim_id}", "get", "200"),
@@ -4296,6 +4669,16 @@ mod tests {
                 ["properties"]["sd"]["enum"],
             json!(["always"])
         );
+        assert_eq!(
+            doc["components"]["schemas"]["SdJwtVcTypeMetadata"]["properties"]["claims"]["items"]
+                ["properties"]["registry_notary_value_schema"]["$ref"],
+            json!("#/components/schemas/RelayOutputContract")
+        );
+        assert_eq!(
+            doc["paths"]["/credentials/{vct_path}"]["get"]["responses"]["200"]["content"]
+                ["application/json"]["example"]["claims"][0]["registry_notary_value_schema"],
+            json!({"type": "boolean", "nullable": false})
+        );
         assert_eq!(
             doc["paths"]["/credentials/{vct_path}"]["get"]["responses"]["200"]["content"]
                 ["application/json"]["schema"]["$ref"],
@@ -4352,6 +4735,117 @@ mod tests {
         );
     }
 
+    #[test]
+    fn registrar_offer_openapi_is_machine_authenticated_idempotent_and_non_storable() {
+        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
+        let operation = &doc["paths"]["/oid4vci/offers"]["post"];
+
+        assert_eq!(
+            operation["security"],
+            json!([{ "apiKeyAuth": [] }, { "bearerAuth": [] }])
+        );
+        assert!(operation["description"]
+            .as_str()
+            .is_some_and(|description| {
+                description.contains("registry_notary:credential_offer_create")
+                    && description.contains("Idempotency-Key")
+                    && description.contains("exact stored values")
+                    && description.contains("exact target-scoped authorization_details")
+                    && description.contains("never contains its numeric value")
+                    && description.contains("separate channel")
+                    && description.contains("non-storable")
+            }));
+        let idempotency_key = operation["parameters"]
+            .as_array()
+            .expect("offer parameters are an array")
+            .iter()
+            .find(|parameter| parameter["name"] == "Idempotency-Key")
+            .expect("Idempotency-Key is documented");
+        assert_eq!(idempotency_key["required"], json!(true));
+        assert_eq!(idempotency_key["schema"]["maxLength"], json!(256));
+        assert_eq!(
+            operation["requestBody"]["content"]["application/json"]["schema"]["$ref"],
+            json!("#/components/schemas/RegistryClientOfferRequest")
+        );
+        assert_eq!(
+            doc["components"]["schemas"]["RegistryClientOfferRequest"]["required"],
+            json!(["evaluation_id", "credential_configuration_id"])
+        );
+        assert_eq!(
+            doc["components"]["schemas"]["RegistryClientOfferRequest"]["additionalProperties"],
+            json!(false)
+        );
+        assert_eq!(
+            operation["responses"]["200"]["content"]["application/json"]["schema"]["$ref"],
+            json!("#/components/schemas/RegistryClientOfferResponse")
+        );
+        assert_eq!(
+            operation["responses"]["200"]["headers"]["Cache-Control"]["schema"]["enum"],
+            json!(["no-store"])
+        );
+        assert_eq!(
+            operation["responses"]["200"]["headers"]["Pragma"]["schema"]["enum"],
+            json!(["no-cache"])
+        );
+        for status in ["400", "401", "403", "404", "409", "429", "503"] {
+            assert_eq!(
+                operation["responses"][status]["content"]["application/problem+json"]["schema"]
+                    ["$ref"],
+                json!("#/components/schemas/ProblemDetails")
+            );
+            assert_eq!(
+                operation["responses"][status]["headers"]["Cache-Control"]["schema"]["enum"],
+                json!(["no-store"])
+            );
+        }
+        let response = &doc["components"]["schemas"]["RegistryClientOfferResponse"];
+        assert_eq!(
+            response["required"],
+            json!(["credential_offer_uri", "tx_code", "expires_at"])
+        );
+        assert!(
+            response["properties"]["credential_offer_uri"]["description"]
+                .as_str()
+                .is_some_and(|description| description.contains("never contains the numeric"))
+        );
+        assert!(response["properties"]["tx_code"]["description"]
+            .as_str()
+            .is_some_and(|description| description.contains("separate")));
+    }
+
+    #[test]
+    fn type_metadata_documents_closed_recursive_claim_value_contract() {
+        let doc = serde_json::to_value(openapi_document()).expect("document serializes");
+        let contract = &doc["components"]["schemas"]["RelayOutputContract"];
+        let variants = contract["oneOf"]
+            .as_array()
+            .expect("Relay output contract variants");
+        assert_eq!(variants.len(), 6);
+
+        let object = variants
+            .iter()
+            .find(|variant| variant["properties"]["type"]["enum"] == json!(["object"]))
+            .expect("object output contract");
+        assert_eq!(object["additionalProperties"], json!(false));
+        assert_eq!(object["properties"]["fields"]["maxProperties"], json!(32));
+        assert_eq!(
+            object["properties"]["fields"]["additionalProperties"]["$ref"],
+            json!("#/components/schemas/RelayOutputObjectFieldContract")
+        );
+
+        let array = variants
+            .iter()
+            .find(|variant| variant["properties"]["type"]["enum"] == json!(["array"]))
+            .expect("array output contract");
+        assert_eq!(array["additionalProperties"], json!(false));
+        assert_eq!(array["properties"]["max_items"]["maximum"], json!(256));
+        assert_eq!(
+            array["properties"]["items"]["$ref"],
+            json!("#/components/schemas/RelayOutputContract")
+        );
+        assert_eq!(array["properties"]["max_bytes"]["maximum"], json!(65_536));
+    }
+
     #[test]
     fn problem_responses_reference_shared_problem_details_schema() {
         let doc = serde_json::to_value(openapi_document()).expect("document serializes");
diff --git a/crates/registry-notary-server/src/preauth_state.rs b/crates/registry-notary-server/src/preauth_state.rs
index 5f26ea0458..703fbb93ae 100644
--- a/crates/registry-notary-server/src/preauth_state.rs
+++ b/crates/registry-notary-server/src/preauth_state.rs
@@ -20,12 +20,54 @@ use time::{Duration, OffsetDateTime};
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
 use crate::{
+    machine_quota::MachineQuotaOperationFence,
     replay::{replay_identifier_hash, replay_scope_hash},
     state_plane::{NotaryStatePlaneHandle, SensitiveStateError, SensitiveStateKeys},
 };
 
 const PREAUTH_LOGIN_STATE_MAX_ENTRIES: usize = 4_096;
 const OID4VCI_ISSUANCE_TRANSACTION_MAX_ENTRIES: usize = 4_096;
+const REGISTRY_CLIENT_OFFER_MAX_ENTRIES: usize = 4_096;
+const EVALUATION_ISSUANCE_MAX_ENTRIES: usize = 4_096;
+const MACHINE_QUOTA_MAX_ENTRIES: usize = 10_000;
+const MACHINE_QUOTA_WINDOW: Duration = Duration::minutes(1);
+const EVALUATION_ISSUANCE_CONTEXT: &[u8] = b"oid4vci-evaluation-issuance";
+
+/// The authority that initiated an immutable issuance transaction.
+///
+/// The registry-client variant is encrypted at rest in PostgreSQL. Its custom
+/// `Debug` implementation deliberately omits the client, target, scopes,
+/// service, and purpose because those values can be identifying.
+#[allow(clippy::large_enum_variant)]
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub(crate) enum IssuanceAuthority {
+    #[default]
+    SubjectAccess,
+    RegistryClient {
+        initiating_client_id: String,
+        initiating_client_id_hash: String,
+        auth_profile_id: registry_notary_core::EvidenceAuthProfileId,
+        authorized_scopes: Vec<String>,
+        target_ref: registry_notary_core::TargetRefView,
+        service_id: String,
+        purpose: String,
+    },
+}
+
+impl std::fmt::Debug for IssuanceAuthority {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::SubjectAccess => formatter.write_str("SubjectAccess"),
+            Self::RegistryClient {
+                auth_profile_id, ..
+            } => formatter
+                .debug_struct("RegistryClient")
+                .field("auth_profile_id", auth_profile_id)
+                .finish_non_exhaustive(),
+        }
+    }
+}
 
 /// Immutable authority-bearing portion of one registry-backed issuance.
 ///
@@ -39,6 +81,24 @@ pub(crate) struct IssuanceTransaction {
     pub(crate) evaluation_client_id: String,
     pub(crate) credential_configuration_id: String,
     pub(crate) commitment: String,
+    #[serde(default)]
+    pub(crate) authority: IssuanceAuthority,
+}
+
+#[derive(Clone)]
+pub(crate) struct LiveIssuanceTransaction {
+    pub(crate) transaction: IssuanceTransaction,
+    pub(crate) expires_at: OffsetDateTime,
+}
+
+impl std::fmt::Debug for LiveIssuanceTransaction {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("LiveIssuanceTransaction")
+            .field("transaction", &self.transaction)
+            .field("expires_at", &self.expires_at)
+            .finish()
+    }
 }
 
 impl std::fmt::Debug for IssuanceTransaction {
@@ -46,17 +106,139 @@ impl std::fmt::Debug for IssuanceTransaction {
         formatter
             .debug_struct("IssuanceTransaction")
             .field("transaction_id", &"[redacted]")
-            .field("evaluation_id", &self.evaluation_id)
+            .field("evaluation_id", &"[redacted]")
             .field("evaluation_client_id", &"[redacted]")
             .field(
                 "credential_configuration_id",
                 &self.credential_configuration_id,
             )
             .field("commitment", &self.commitment)
+            .field("authority", &self.authority)
             .finish()
     }
 }
 
+/// Exact response cached by the atomic registry-client offer operation.
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize, Zeroize, ZeroizeOnDrop)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct RegistryClientOfferResponse {
+    pub(crate) credential_offer_uri: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub(crate) tx_code: Option<String>,
+    pub(crate) expires_at: String,
+}
+
+impl std::fmt::Debug for RegistryClientOfferResponse {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("RegistryClientOfferResponse")
+            .field("credential_offer_uri", &"[redacted]")
+            .field("tx_code", &self.tx_code.as_ref().map(|_| "[redacted]"))
+            .field("expires_at", &self.expires_at)
+            .finish()
+    }
+}
+
+/// Optional out-of-band PIN material consumed by an atomic offer reservation.
+///
+/// The plaintext is accepted only at this typed boundary, converted to a keyed
+/// verifier inside the same state transition, and zeroized on drop.
+#[derive(Zeroize, ZeroizeOnDrop)]
+pub(crate) struct RegistryClientTransactionCode {
+    pub(crate) pin: String,
+    pub(crate) pin_length: u64,
+}
+
+impl std::fmt::Debug for RegistryClientTransactionCode {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("RegistryClientTransactionCode")
+            .field("pin", &"[redacted]")
+            .field("pin_length", &self.pin_length)
+            .finish()
+    }
+}
+
+/// Complete input for one registry-client offer reservation.
+///
+/// The idempotency key must already be represented as
+/// `hmac-sha256:<lowercase hex>`. The request hash is the endpoint's canonical
+/// `sha256:<lowercase hex>` request identity. Neither raw value is rendered by
+/// `Debug`.
+pub(crate) struct RegistryClientOfferReservation {
+    pub(crate) transaction_id: String,
+    pub(crate) evaluation_id: String,
+    pub(crate) evaluation_expires_at: OffsetDateTime,
+    pub(crate) idempotency_key_hash: String,
+    pub(crate) canonical_request_hash: String,
+    pub(crate) transaction: IssuanceTransaction,
+    pub(crate) transaction_code: Option<RegistryClientTransactionCode>,
+    pub(crate) code_expires_at: OffsetDateTime,
+    pub(crate) transaction_expires_at: OffsetDateTime,
+    pub(crate) response: RegistryClientOfferResponse,
+    pub(crate) retention_expires_at: OffsetDateTime,
+    pub(crate) quota_principal_hash: Vec<u8>,
+    pub(crate) quota_limit: Option<i32>,
+    pub(crate) quota_cost: i32,
+}
+
+impl std::fmt::Debug for RegistryClientOfferReservation {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("RegistryClientOfferReservation")
+            .field("transaction_id", &"[redacted]")
+            .field("evaluation_id", &"[redacted]")
+            .field("evaluation_expires_at", &self.evaluation_expires_at)
+            .field("idempotency_key_hash", &"[redacted]")
+            .field("canonical_request_hash", &"[redacted]")
+            .field("transaction", &self.transaction)
+            .field("transaction_code", &self.transaction_code)
+            .field("code_expires_at", &self.code_expires_at)
+            .field("transaction_expires_at", &self.transaction_expires_at)
+            .field("response", &self.response)
+            .field("retention_expires_at", &self.retention_expires_at)
+            .field("quota_principal_hash", &"[redacted]")
+            .field("quota_limit", &self.quota_limit)
+            .field("quota_cost", &self.quota_cost)
+            .finish()
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub(crate) enum RegistryClientOfferReservationOutcome {
+    Created(RegistryClientOfferResponse),
+    Replayed(RegistryClientOfferResponse),
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub(crate) enum RegistryClientOfferPreflightOutcome {
+    Available,
+    Replayed(RegistryClientOfferResponse),
+    IdempotencyConflict,
+    EvaluationConsumed,
+}
+
+impl std::fmt::Debug for RegistryClientOfferPreflightOutcome {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Available => formatter.write_str("Available"),
+            Self::Replayed(_) => formatter.write_str("Replayed([redacted])"),
+            Self::IdempotencyConflict => formatter.write_str("IdempotencyConflict"),
+            Self::EvaluationConsumed => formatter.write_str("EvaluationConsumed"),
+        }
+    }
+}
+
+impl std::fmt::Debug for RegistryClientOfferReservationOutcome {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Created(_) => formatter.write_str("Created([redacted])"),
+            Self::Replayed(_) => formatter.write_str("Replayed([redacted])"),
+        }
+    }
+}
+
+#[allow(clippy::large_enum_variant)]
 #[derive(Debug)]
 pub(crate) enum CredentialMaterialization {
     Acquired(IssuanceTransaction),
@@ -156,6 +338,14 @@ pub(crate) enum PreauthorizationStateError {
     IncompatibleTransactionCodeProof,
     #[error("preauthorization expiry is invalid")]
     InvalidExpiry,
+    #[error("registry-client offer idempotency key conflicts with its original request")]
+    IdempotencyConflict,
+    #[error("evaluation issuance lineage was already consumed")]
+    EvaluationConsumed,
+    #[error("registry-client offer quota was exhausted")]
+    MachineQuotaExceeded { retry_after_seconds: u64 },
+    #[error("registry-client offer operation lease is no longer owned")]
+    OperationLeaseLost,
     #[error(transparent)]
     SensitiveState(#[from] SensitiveStateError),
 }
@@ -165,11 +355,6 @@ pub(crate) enum PreauthorizationStateError {
 /// operations.
 pub(crate) struct PreauthorizationState {
     backend: PreauthorizationBackend,
-    // This store is process-local for the in-memory state profile. PostgreSQL
-    // support is intentionally rejected by the methods below until the fixed
-    // state-plane transaction functions are active, rather than silently
-    // weakening cross-replica correctness.
-    issuance: Arc<Mutex<HashMap<[u8; 32], Stored<StoredIssuanceTransaction>>>>,
 }
 
 enum PreauthorizationBackend {
@@ -186,10 +371,7 @@ impl PreauthorizationState {
         } else {
             PreauthorizationBackend::Postgresql(state_plane)
         };
-        Ok(Self {
-            backend,
-            issuance: Arc::new(Mutex::new(HashMap::new())),
-        })
+        Ok(Self { backend })
     }
 
     pub(crate) async fn reserve_issuance_transaction(
@@ -214,56 +396,127 @@ impl PreauthorizationState {
                 }
             };
         }
-        let now = OffsetDateTime::now_utc();
-        if expires_at <= now {
-            return Err(PreauthorizationStateError::InvalidExpiry);
+        let PreauthorizationBackend::InMemory(state) = &self.backend else {
+            unreachable!("PostgreSQL issuance reservation returned above");
+        };
+        state.reserve_issuance_transaction(transaction_id, transaction, expires_at)
+    }
+
+    /// Atomically reserve the immutable transaction, optional transaction-code
+    /// verifier, evaluation consumption, and exact response for a
+    /// registry-client initiated offer.
+    #[cfg(test)]
+    pub(crate) async fn reserve_registry_client_offer(
+        &self,
+        reservation: RegistryClientOfferReservation,
+    ) -> Result<RegistryClientOfferReservationOutcome, PreauthorizationStateError> {
+        match &self.backend {
+            PreauthorizationBackend::InMemory(state) => {
+                state.reserve_registry_client_offer(reservation)
+            }
+            PreauthorizationBackend::Postgresql(handle) => {
+                handle
+                    .sensitive_state()?
+                    .reserve_registry_client_offer(reservation)
+                    .await
+            }
         }
-        let key = replay_identifier_hash(transaction_id);
-        let mut records = self
-            .issuance
-            .lock()
-            .map_err(|_| PreauthorizationStateError::Unavailable)?;
-        records.retain(|_, record| record.expires_at > now);
-        if records.contains_key(&key) {
-            return Err(PreauthorizationStateError::DuplicateIssuanceTransaction);
+    }
+
+    /// Finalize an offer only while the caller still owns the quota-operation
+    /// lease. In-memory mode holds the operation mutex through the synchronous
+    /// reservation; PostgreSQL verifies and locks the same owner token inside
+    /// the authoritative reservation transaction.
+    pub(crate) async fn reserve_registry_client_offer_fenced(
+        &self,
+        reservation: RegistryClientOfferReservation,
+        fence: &MachineQuotaOperationFence,
+    ) -> Result<RegistryClientOfferReservationOutcome, PreauthorizationStateError> {
+        match &self.backend {
+            PreauthorizationBackend::InMemory(state) => fence
+                .complete_in_memory(|| state.reserve_registry_client_offer(reservation))
+                .map_err(|()| PreauthorizationStateError::OperationLeaseLost)?,
+            PreauthorizationBackend::Postgresql(handle) => {
+                handle
+                    .sensitive_state()?
+                    .reserve_registry_client_offer_fenced(reservation, fence)
+                    .await
+            }
         }
-        if records.len() >= OID4VCI_ISSUANCE_TRANSACTION_MAX_ENTRIES {
-            return Err(PreauthorizationStateError::IssuanceTransactionCapacity);
+    }
+
+    /// Read-only fast path for exact replay/conflict and consumed-evaluation
+    /// decisions. The final reservation remains authoritative for races.
+    pub(crate) async fn registry_client_offer_preflight(
+        &self,
+        evaluation_id: &str,
+        evaluation_client_id: &str,
+        idempotency_key_hash: &str,
+        canonical_request_hash: &str,
+    ) -> Result<RegistryClientOfferPreflightOutcome, PreauthorizationStateError> {
+        match &self.backend {
+            PreauthorizationBackend::InMemory(state) => state.registry_client_offer_preflight(
+                evaluation_id,
+                evaluation_client_id,
+                idempotency_key_hash,
+                canonical_request_hash,
+            ),
+            PreauthorizationBackend::Postgresql(handle) => {
+                handle
+                    .sensitive_state()?
+                    .registry_client_offer_preflight(
+                        evaluation_id,
+                        evaluation_client_id,
+                        idempotency_key_hash,
+                        canonical_request_hash,
+                    )
+                    .await
+            }
+        }
+    }
+
+    /// Terminally consume one evaluation lineage before direct issuance side
+    /// effects. Registry-client offer creation uses the same ledger, so only
+    /// one path can win for an evaluation and its owning client.
+    pub(crate) async fn reserve_evaluation_issuance(
+        &self,
+        evaluation_id: &str,
+        evaluation_client_id: &str,
+        evaluation_expires_at: OffsetDateTime,
+    ) -> Result<(), PreauthorizationStateError> {
+        match &self.backend {
+            PreauthorizationBackend::InMemory(state) => state.reserve_evaluation_issuance(
+                evaluation_id,
+                evaluation_client_id,
+                evaluation_expires_at,
+            ),
+            PreauthorizationBackend::Postgresql(handle) => {
+                handle
+                    .sensitive_state()?
+                    .reserve_evaluation_issuance(
+                        evaluation_id,
+                        evaluation_client_id,
+                        evaluation_expires_at,
+                    )
+                    .await
+            }
         }
-        records.insert(
-            key,
-            Stored {
-                value: StoredIssuanceTransaction {
-                    transaction,
-                    nonce: None,
-                    state: MaterializationState::Ready,
-                },
-                expires_at,
-            },
-        );
-        Ok(())
     }
 
     pub(crate) async fn transaction(
         &self,
         transaction_id: &str,
-    ) -> Result<Option<IssuanceTransaction>, PreauthorizationStateError> {
+    ) -> Result<Option<LiveIssuanceTransaction>, PreauthorizationStateError> {
         if let PreauthorizationBackend::Postgresql(handle) = &self.backend {
             return Ok(handle
                 .sensitive_state()?
                 .issuance_transaction(transaction_id)
                 .await?);
         }
-        let now = OffsetDateTime::now_utc();
-        let key = replay_identifier_hash(transaction_id);
-        let mut records = self
-            .issuance
-            .lock()
-            .map_err(|_| PreauthorizationStateError::Unavailable)?;
-        records.retain(|_, record| record.expires_at > now);
-        Ok(records
-            .get(&key)
-            .map(|record| record.value.transaction.clone()))
+        let PreauthorizationBackend::InMemory(state) = &self.backend else {
+            unreachable!("PostgreSQL issuance lookup returned above");
+        };
+        state.transaction(transaction_id)
     }
 
     pub(crate) async fn bind_transaction_nonce(
@@ -278,21 +531,10 @@ impl PreauthorizationState {
                 .bind_issuance_nonce(transaction_id, commitment, &nonce)
                 .await?);
         }
-        let now = OffsetDateTime::now_utc();
-        let key = replay_identifier_hash(transaction_id);
-        let mut records = self
-            .issuance
-            .lock()
-            .map_err(|_| PreauthorizationStateError::Unavailable)?;
-        records.retain(|_, record| record.expires_at > now);
-        let Some(record) = records.get_mut(&key) else {
-            return Ok(false);
+        let PreauthorizationBackend::InMemory(state) = &self.backend else {
+            unreachable!("PostgreSQL nonce binding returned above");
         };
-        if record.value.transaction.commitment != commitment || record.value.nonce.is_some() {
-            return Ok(false);
-        }
-        record.value.nonce = Some(nonce);
-        Ok(true)
+        state.bind_transaction_nonce(transaction_id, commitment, nonce)
     }
 
     pub(crate) async fn begin_credential_materialization(
@@ -317,49 +559,17 @@ impl PreauthorizationState {
                 )
                 .await?);
         }
-        let now = OffsetDateTime::now_utc();
-        let key = replay_identifier_hash(transaction_id);
-        let mut records = self
-            .issuance
-            .lock()
-            .map_err(|_| PreauthorizationStateError::Unavailable)?;
-        records.retain(|_, record| record.expires_at > now);
-        let Some(record) = records.get_mut(&key) else {
-            return Ok(CredentialMaterialization::Denied);
+        let PreauthorizationBackend::InMemory(state) = &self.backend else {
+            unreachable!("PostgreSQL materialization begin returned above");
         };
-        let transaction = &record.value.transaction;
-        if transaction.commitment != commitment
-            || transaction.credential_configuration_id != configuration_id
-            || record.value.nonce.as_deref() != Some(nonce)
-        {
-            return Ok(CredentialMaterialization::Denied);
-        }
-        match &record.value.state {
-            MaterializationState::Ready => {
-                let transaction = transaction.clone();
-                record.value.state = MaterializationState::Issuing {
-                    holder_thumbprint: holder_thumbprint.to_string(),
-                    request_hash: request_hash.to_string(),
-                };
-                Ok(CredentialMaterialization::Acquired(transaction))
-            }
-            MaterializationState::Issuing {
-                holder_thumbprint: bound,
-                request_hash: bound_request,
-            } if bound == holder_thumbprint && bound_request == request_hash => {
-                Ok(CredentialMaterialization::Busy)
-            }
-            MaterializationState::Completed {
-                holder_thumbprint: bound,
-                request_hash: bound_request,
-                response,
-            } if bound == holder_thumbprint && bound_request == request_hash => {
-                Ok(CredentialMaterialization::Cached(response.clone()))
-            }
-            MaterializationState::Issuing { .. }
-            | MaterializationState::Completed { .. }
-            | MaterializationState::Failed => Ok(CredentialMaterialization::Denied),
-        }
+        state.begin_credential_materialization(
+            transaction_id,
+            commitment,
+            configuration_id,
+            nonce,
+            holder_thumbprint,
+            request_hash,
+        )
     }
 
     pub(crate) async fn complete_credential_materialization(
@@ -380,28 +590,15 @@ impl PreauthorizationState {
                 )
                 .await?);
         }
-        let key = replay_identifier_hash(transaction_id);
-        let mut records = self
-            .issuance
-            .lock()
-            .map_err(|_| PreauthorizationStateError::Unavailable)?;
-        let Some(record) = records.get_mut(&key) else {
-            return Ok(false);
+        let PreauthorizationBackend::InMemory(state) = &self.backend else {
+            unreachable!("PostgreSQL materialization completion returned above");
         };
-        match &record.value.state {
-            MaterializationState::Issuing {
-                holder_thumbprint: bound,
-                request_hash: bound_request,
-            } if bound == holder_thumbprint && bound_request == request_hash => {
-                record.value.state = MaterializationState::Completed {
-                    holder_thumbprint: holder_thumbprint.to_string(),
-                    request_hash: request_hash.to_string(),
-                    response,
-                };
-                Ok(true)
-            }
-            _ => Ok(false),
-        }
+        state.complete_credential_materialization(
+            transaction_id,
+            holder_thumbprint,
+            request_hash,
+            response,
+        )
     }
 
     pub(crate) async fn fail_credential_materialization(
@@ -415,20 +612,10 @@ impl PreauthorizationState {
                 .fail_issuance_materialization(transaction_id, holder_thumbprint)
                 .await?);
         }
-        let key = replay_identifier_hash(transaction_id);
-        let mut records = self
-            .issuance
-            .lock()
-            .map_err(|_| PreauthorizationStateError::Unavailable)?;
-        if let Some(record) = records.get_mut(&key) {
-            if matches!(
-                &record.value.state,
-                MaterializationState::Issuing { holder_thumbprint: bound, .. } if bound == holder_thumbprint
-            ) {
-                record.value.state = MaterializationState::Failed;
-            }
-        }
-        Ok(())
+        let PreauthorizationBackend::InMemory(state) = &self.backend else {
+            unreachable!("PostgreSQL materialization failure returned above");
+        };
+        state.fail_credential_materialization(transaction_id, holder_thumbprint)
     }
 
     pub(crate) async fn reserve_login(
@@ -553,7 +740,6 @@ impl std::fmt::Debug for PreauthorizationState {
                     PreauthorizationBackend::Postgresql(_) => "postgresql",
                 },
             )
-            .field("issuance", &"<redacted>")
             .finish()
     }
 }
@@ -568,6 +754,22 @@ struct InMemoryRecords {
     login: HashMap<[u8; 32], Stored<LoginState>>,
     transaction_codes: HashMap<[u8; 32], Stored<TransactionCodeVerifier>>,
     redeemed: HashMap<([u8; 32], [u8; 32]), OffsetDateTime>,
+    issuance: HashMap<[u8; 32], Stored<StoredIssuanceTransaction>>,
+    registry_client_offers: HashMap<[u8; 32], StoredRegistryClientOffer>,
+    consumed_evaluations: HashMap<[u8; 32], OffsetDateTime>,
+    machine_quota: HashMap<[u8; 32], StoredMachineQuota>,
+}
+
+struct StoredRegistryClientOffer {
+    request_hash: [u8; 32],
+    response: RegistryClientOfferResponse,
+    retention_expires_at: OffsetDateTime,
+    purge_after: OffsetDateTime,
+}
+
+struct StoredMachineQuota {
+    window_expires_at: OffsetDateTime,
+    used: i32,
 }
 
 struct Stored<V> {
@@ -581,12 +783,355 @@ struct TransactionCodeVerifier {
     pin_length: usize,
 }
 
-impl InMemoryPreauthorizationState {
-    fn new() -> Result<Self, PreauthorizationStateError> {
-        Ok(Self {
-            keys: SensitiveStateKeys::random()?,
-            records: Mutex::new(InMemoryRecords::default()),
-        })
+impl InMemoryPreauthorizationState {
+    fn new() -> Result<Self, PreauthorizationStateError> {
+        Ok(Self {
+            keys: SensitiveStateKeys::random()?,
+            records: Mutex::new(InMemoryRecords::default()),
+        })
+    }
+
+    fn reserve_issuance_transaction(
+        &self,
+        transaction_id: &str,
+        transaction: IssuanceTransaction,
+        expires_at: OffsetDateTime,
+    ) -> Result<(), PreauthorizationStateError> {
+        let now = OffsetDateTime::now_utc();
+        if expires_at <= now {
+            return Err(PreauthorizationStateError::InvalidExpiry);
+        }
+        let key = replay_identifier_hash(transaction_id);
+        let mut records = self.lock_records()?;
+        records.issuance.retain(|_, record| record.expires_at > now);
+        if records.issuance.contains_key(&key) {
+            return Err(PreauthorizationStateError::DuplicateIssuanceTransaction);
+        }
+        if records.issuance.len() >= OID4VCI_ISSUANCE_TRANSACTION_MAX_ENTRIES {
+            return Err(PreauthorizationStateError::IssuanceTransactionCapacity);
+        }
+        records.issuance.insert(
+            key,
+            Stored {
+                value: StoredIssuanceTransaction {
+                    transaction,
+                    nonce: None,
+                    state: MaterializationState::Ready,
+                },
+                expires_at,
+            },
+        );
+        Ok(())
+    }
+
+    fn reserve_registry_client_offer(
+        &self,
+        reservation: RegistryClientOfferReservation,
+    ) -> Result<RegistryClientOfferReservationOutcome, PreauthorizationStateError> {
+        validate_registry_client_offer_structure(&reservation)?;
+        let idempotency_hash = decode_hash_uri(&reservation.idempotency_key_hash, "hmac-sha256:")?;
+        let request_hash = decode_hash_uri(&reservation.canonical_request_hash, "sha256:")?;
+        let evaluation_hash = self.evaluation_issuance_hash(
+            &reservation.evaluation_id,
+            &reservation.transaction.evaluation_client_id,
+        );
+        let transaction_hash = replay_identifier_hash(&reservation.transaction_id);
+        let now = OffsetDateTime::now_utc();
+        let mut records = self.lock_records()?;
+        prune_offer_records(&mut records, now);
+
+        if let Some(stored) = records.registry_client_offers.get(&idempotency_hash) {
+            if stored.request_hash != request_hash {
+                return Err(PreauthorizationStateError::IdempotencyConflict);
+            }
+            if stored.retention_expires_at > now {
+                return Ok(RegistryClientOfferReservationOutcome::Replayed(
+                    stored.response.clone(),
+                ));
+            }
+            return Err(PreauthorizationStateError::EvaluationConsumed);
+        }
+
+        validate_registry_client_offer_reservation(&reservation, now)?;
+        if records.consumed_evaluations.contains_key(&evaluation_hash) {
+            return Err(PreauthorizationStateError::EvaluationConsumed);
+        }
+        if records.issuance.contains_key(&transaction_hash)
+            || records.transaction_codes.contains_key(&transaction_hash)
+        {
+            return Err(PreauthorizationStateError::DuplicateIssuanceTransaction);
+        }
+        if records.issuance.len() >= OID4VCI_ISSUANCE_TRANSACTION_MAX_ENTRIES
+            || records.registry_client_offers.len() >= REGISTRY_CLIENT_OFFER_MAX_ENTRIES
+            || records.consumed_evaluations.len() >= EVALUATION_ISSUANCE_MAX_ENTRIES
+        {
+            return Err(PreauthorizationStateError::IssuanceTransactionCapacity);
+        }
+        let transaction_code = reservation
+            .transaction_code
+            .as_ref()
+            .map(|code| {
+                let pin_length = usize::try_from(code.pin_length)
+                    .map_err(|_| PreauthorizationStateError::Unavailable)?;
+                Ok::<TransactionCodeVerifier, PreauthorizationStateError>(TransactionCodeVerifier {
+                    verifier: self.keys.pin_verifier(&transaction_hash, &code.pin),
+                    pin_length,
+                })
+            })
+            .transpose()?;
+        reserve_offer_quota(&mut records, &reservation, now)?;
+        let response = reservation.response.clone();
+        let purge_after = std::cmp::max(
+            reservation.evaluation_expires_at,
+            reservation.retention_expires_at,
+        );
+
+        records.issuance.insert(
+            transaction_hash,
+            Stored {
+                value: StoredIssuanceTransaction {
+                    transaction: reservation.transaction,
+                    nonce: None,
+                    state: MaterializationState::Ready,
+                },
+                expires_at: reservation.transaction_expires_at,
+            },
+        );
+        if let Some(verifier) = transaction_code {
+            records.transaction_codes.insert(
+                transaction_hash,
+                Stored {
+                    value: verifier,
+                    expires_at: reservation.code_expires_at,
+                },
+            );
+        }
+        records
+            .consumed_evaluations
+            .insert(evaluation_hash, reservation.evaluation_expires_at);
+        records.registry_client_offers.insert(
+            idempotency_hash,
+            StoredRegistryClientOffer {
+                request_hash,
+                response: reservation.response,
+                retention_expires_at: reservation.retention_expires_at,
+                purge_after,
+            },
+        );
+        Ok(RegistryClientOfferReservationOutcome::Created(response))
+    }
+
+    fn registry_client_offer_preflight(
+        &self,
+        evaluation_id: &str,
+        evaluation_client_id: &str,
+        idempotency_key_hash: &str,
+        canonical_request_hash: &str,
+    ) -> Result<RegistryClientOfferPreflightOutcome, PreauthorizationStateError> {
+        if evaluation_id.is_empty() || evaluation_client_id.is_empty() {
+            return Err(PreauthorizationStateError::Unavailable);
+        }
+        let idempotency_hash = decode_hash_uri(idempotency_key_hash, "hmac-sha256:")?;
+        let request_hash = decode_hash_uri(canonical_request_hash, "sha256:")?;
+        let evaluation_hash = self.evaluation_issuance_hash(evaluation_id, evaluation_client_id);
+        let now = OffsetDateTime::now_utc();
+        let records = self.lock_records()?;
+        if let Some(stored) = records
+            .registry_client_offers
+            .get(&idempotency_hash)
+            .filter(|stored| stored.purge_after > now)
+        {
+            if stored.request_hash != request_hash {
+                return Ok(RegistryClientOfferPreflightOutcome::IdempotencyConflict);
+            }
+            if stored.retention_expires_at > now {
+                return Ok(RegistryClientOfferPreflightOutcome::Replayed(
+                    stored.response.clone(),
+                ));
+            }
+            return Ok(RegistryClientOfferPreflightOutcome::EvaluationConsumed);
+        }
+        if records
+            .consumed_evaluations
+            .get(&evaluation_hash)
+            .is_some_and(|expires_at| *expires_at > now)
+        {
+            return Ok(RegistryClientOfferPreflightOutcome::EvaluationConsumed);
+        }
+        Ok(RegistryClientOfferPreflightOutcome::Available)
+    }
+
+    fn reserve_evaluation_issuance(
+        &self,
+        evaluation_id: &str,
+        evaluation_client_id: &str,
+        evaluation_expires_at: OffsetDateTime,
+    ) -> Result<(), PreauthorizationStateError> {
+        let now = OffsetDateTime::now_utc();
+        if evaluation_id.is_empty() || evaluation_client_id.is_empty() {
+            return Err(PreauthorizationStateError::Unavailable);
+        }
+        if evaluation_expires_at <= now {
+            return Err(PreauthorizationStateError::InvalidExpiry);
+        }
+        let evaluation_hash = self.evaluation_issuance_hash(evaluation_id, evaluation_client_id);
+        let mut records = self.lock_records()?;
+        prune_offer_records(&mut records, now);
+        if records.consumed_evaluations.contains_key(&evaluation_hash) {
+            return Err(PreauthorizationStateError::EvaluationConsumed);
+        }
+        if records.consumed_evaluations.len() >= EVALUATION_ISSUANCE_MAX_ENTRIES {
+            return Err(PreauthorizationStateError::IssuanceTransactionCapacity);
+        }
+        records
+            .consumed_evaluations
+            .insert(evaluation_hash, evaluation_expires_at);
+        Ok(())
+    }
+
+    fn evaluation_issuance_hash(
+        &self,
+        evaluation_id: &str,
+        evaluation_client_id: &str,
+    ) -> [u8; 32] {
+        self.keys.identifier_hash_fields(
+            EVALUATION_ISSUANCE_CONTEXT,
+            &[evaluation_id.as_bytes(), evaluation_client_id.as_bytes()],
+        )
+    }
+
+    fn transaction(
+        &self,
+        transaction_id: &str,
+    ) -> Result<Option<LiveIssuanceTransaction>, PreauthorizationStateError> {
+        let now = OffsetDateTime::now_utc();
+        let key = replay_identifier_hash(transaction_id);
+        let mut records = self.lock_records()?;
+        records.issuance.retain(|_, record| record.expires_at > now);
+        Ok(records
+            .issuance
+            .get(&key)
+            .map(|record| LiveIssuanceTransaction {
+                transaction: record.value.transaction.clone(),
+                expires_at: record.expires_at,
+            }))
+    }
+
+    fn bind_transaction_nonce(
+        &self,
+        transaction_id: &str,
+        commitment: &str,
+        nonce: String,
+    ) -> Result<bool, PreauthorizationStateError> {
+        let now = OffsetDateTime::now_utc();
+        let key = replay_identifier_hash(transaction_id);
+        let mut records = self.lock_records()?;
+        records.issuance.retain(|_, record| record.expires_at > now);
+        let Some(record) = records.issuance.get_mut(&key) else {
+            return Ok(false);
+        };
+        if record.value.transaction.commitment != commitment || record.value.nonce.is_some() {
+            return Ok(false);
+        }
+        record.value.nonce = Some(nonce);
+        Ok(true)
+    }
+
+    fn begin_credential_materialization(
+        &self,
+        transaction_id: &str,
+        commitment: &str,
+        configuration_id: &str,
+        nonce: &str,
+        holder_thumbprint: &str,
+        request_hash: &str,
+    ) -> Result<CredentialMaterialization, PreauthorizationStateError> {
+        let now = OffsetDateTime::now_utc();
+        let key = replay_identifier_hash(transaction_id);
+        let mut records = self.lock_records()?;
+        records.issuance.retain(|_, record| record.expires_at > now);
+        let Some(record) = records.issuance.get_mut(&key) else {
+            return Ok(CredentialMaterialization::Denied);
+        };
+        let transaction = &record.value.transaction;
+        if transaction.commitment != commitment
+            || transaction.credential_configuration_id != configuration_id
+            || record.value.nonce.as_deref() != Some(nonce)
+        {
+            return Ok(CredentialMaterialization::Denied);
+        }
+        match &record.value.state {
+            MaterializationState::Ready => {
+                let transaction = transaction.clone();
+                record.value.state = MaterializationState::Issuing {
+                    holder_thumbprint: holder_thumbprint.to_string(),
+                    request_hash: request_hash.to_string(),
+                };
+                Ok(CredentialMaterialization::Acquired(transaction))
+            }
+            MaterializationState::Issuing {
+                holder_thumbprint: bound,
+                request_hash: bound_request,
+            } if bound == holder_thumbprint && bound_request == request_hash => {
+                Ok(CredentialMaterialization::Busy)
+            }
+            MaterializationState::Completed {
+                holder_thumbprint: bound,
+                request_hash: bound_request,
+                response,
+            } if bound == holder_thumbprint && bound_request == request_hash => {
+                Ok(CredentialMaterialization::Cached(response.clone()))
+            }
+            MaterializationState::Issuing { .. }
+            | MaterializationState::Completed { .. }
+            | MaterializationState::Failed => Ok(CredentialMaterialization::Denied),
+        }
+    }
+
+    fn complete_credential_materialization(
+        &self,
+        transaction_id: &str,
+        holder_thumbprint: &str,
+        request_hash: &str,
+        response: Value,
+    ) -> Result<bool, PreauthorizationStateError> {
+        let key = replay_identifier_hash(transaction_id);
+        let mut records = self.lock_records()?;
+        let Some(record) = records.issuance.get_mut(&key) else {
+            return Ok(false);
+        };
+        match &record.value.state {
+            MaterializationState::Issuing {
+                holder_thumbprint: bound,
+                request_hash: bound_request,
+            } if bound == holder_thumbprint && bound_request == request_hash => {
+                record.value.state = MaterializationState::Completed {
+                    holder_thumbprint: holder_thumbprint.to_string(),
+                    request_hash: request_hash.to_string(),
+                    response,
+                };
+                Ok(true)
+            }
+            _ => Ok(false),
+        }
+    }
+
+    fn fail_credential_materialization(
+        &self,
+        transaction_id: &str,
+        holder_thumbprint: &str,
+    ) -> Result<(), PreauthorizationStateError> {
+        let key = replay_identifier_hash(transaction_id);
+        let mut records = self.lock_records()?;
+        if let Some(record) = records.issuance.get_mut(&key) {
+            if matches!(
+                &record.value.state,
+                MaterializationState::Issuing { holder_thumbprint: bound, .. } if bound == holder_thumbprint
+            ) {
+                record.value.state = MaterializationState::Failed;
+            }
+        }
+        Ok(())
     }
 
     fn reserve_login(
@@ -738,6 +1283,161 @@ impl InMemoryPreauthorizationState {
     }
 }
 
+fn prune_offer_records(records: &mut InMemoryRecords, now: OffsetDateTime) {
+    records.issuance.retain(|_, stored| stored.expires_at > now);
+    records
+        .transaction_codes
+        .retain(|_, stored| stored.expires_at > now);
+    records
+        .registry_client_offers
+        .retain(|_, stored| stored.purge_after > now);
+    records
+        .consumed_evaluations
+        .retain(|_, expires_at| *expires_at > now);
+    records
+        .machine_quota
+        .retain(|_, quota| quota.window_expires_at > now);
+}
+
+fn reserve_offer_quota(
+    records: &mut InMemoryRecords,
+    reservation: &RegistryClientOfferReservation,
+    now: OffsetDateTime,
+) -> Result<(), PreauthorizationStateError> {
+    let principal_hash: [u8; 32] = reservation
+        .quota_principal_hash
+        .as_slice()
+        .try_into()
+        .map_err(|_| PreauthorizationStateError::Unavailable)?;
+    if reservation.quota_cost <= 0 || reservation.quota_limit.is_some_and(|limit| limit <= 0) {
+        return Err(PreauthorizationStateError::Unavailable);
+    }
+    let Some(limit) = reservation.quota_limit else {
+        return Ok(());
+    };
+    let (window_expires_at, used) = records
+        .machine_quota
+        .get(&principal_hash)
+        .filter(|quota| quota.window_expires_at > now)
+        .map_or((now + MACHINE_QUOTA_WINDOW, 0), |quota| {
+            (quota.window_expires_at, quota.used)
+        });
+    if reservation.quota_cost > limit.saturating_sub(used) {
+        let remaining_millis = (window_expires_at - now).whole_milliseconds().max(1);
+        return Err(PreauthorizationStateError::MachineQuotaExceeded {
+            retry_after_seconds: ((remaining_millis + 999) / 1_000) as u64,
+        });
+    }
+    if !records.machine_quota.contains_key(&principal_hash)
+        && records.machine_quota.len() >= MACHINE_QUOTA_MAX_ENTRIES
+    {
+        if let Some(oldest) = records
+            .machine_quota
+            .iter()
+            .min_by_key(|(_, quota)| quota.window_expires_at)
+            .map(|(principal_hash, _)| *principal_hash)
+        {
+            records.machine_quota.remove(&oldest);
+        }
+    }
+    records.machine_quota.insert(
+        principal_hash,
+        StoredMachineQuota {
+            window_expires_at,
+            used: used + reservation.quota_cost,
+        },
+    );
+    Ok(())
+}
+
+pub(crate) fn validate_registry_client_offer_reservation(
+    reservation: &RegistryClientOfferReservation,
+    now: OffsetDateTime,
+) -> Result<(), PreauthorizationStateError> {
+    validate_registry_client_offer_structure(reservation)?;
+    if reservation.code_expires_at <= now
+        || reservation.transaction_expires_at < reservation.code_expires_at
+        || reservation.evaluation_expires_at <= now
+        || reservation.retention_expires_at < reservation.code_expires_at
+    {
+        return Err(PreauthorizationStateError::InvalidExpiry);
+    }
+    Ok(())
+}
+
+pub(crate) fn validate_registry_client_offer_structure(
+    reservation: &RegistryClientOfferReservation,
+) -> Result<(), PreauthorizationStateError> {
+    if reservation.transaction_id != reservation.transaction.transaction_id
+        || reservation.evaluation_id != reservation.transaction.evaluation_id
+    {
+        return Err(PreauthorizationStateError::Unavailable);
+    }
+    let IssuanceAuthority::RegistryClient {
+        initiating_client_id,
+        initiating_client_id_hash,
+        target_ref,
+        ..
+    } = &reservation.transaction.authority
+    else {
+        return Err(PreauthorizationStateError::Unavailable);
+    };
+    if initiating_client_id.is_empty()
+        || initiating_client_id != &reservation.transaction.evaluation_client_id
+        || decode_hash_uri(initiating_client_id_hash, "hmac-sha256:").is_err()
+        || target_ref.handle.is_empty()
+        || reservation.quota_principal_hash.len() != 32
+        || reservation.quota_cost <= 0
+        || reservation.quota_limit.is_some_and(|limit| limit <= 0)
+    {
+        return Err(PreauthorizationStateError::Unavailable);
+    }
+    match (
+        reservation.transaction_code.as_ref(),
+        reservation.response.tx_code.as_deref(),
+    ) {
+        (None, None) => {}
+        (Some(code), Some(response_code))
+            if (4..=12).contains(&code.pin_length)
+                && usize::try_from(code.pin_length).ok() == Some(code.pin.len())
+                && code.pin.bytes().all(|byte| byte.is_ascii_digit())
+                && response_code
+                    .as_bytes()
+                    .ct_eq(code.pin.as_bytes())
+                    .unwrap_u8()
+                    == 1 => {}
+        _ => return Err(PreauthorizationStateError::Unavailable),
+    }
+    Ok(())
+}
+
+pub(crate) fn decode_hash_uri(
+    value: &str,
+    expected_prefix: &str,
+) -> Result<[u8; 32], PreauthorizationStateError> {
+    let encoded = value
+        .strip_prefix(expected_prefix)
+        .ok_or(PreauthorizationStateError::Unavailable)?;
+    if encoded.len() != 64 {
+        return Err(PreauthorizationStateError::Unavailable);
+    }
+    let mut decoded = [0_u8; 32];
+    for (destination, pair) in decoded.iter_mut().zip(encoded.as_bytes().chunks_exact(2)) {
+        let high = hex_nibble(pair[0]).ok_or(PreauthorizationStateError::Unavailable)?;
+        let low = hex_nibble(pair[1]).ok_or(PreauthorizationStateError::Unavailable)?;
+        *destination = (high << 4) | low;
+    }
+    Ok(decoded)
+}
+
+fn hex_nibble(value: u8) -> Option<u8> {
+    match value {
+        b'0'..=b'9' => Some(value - b'0'),
+        b'a'..=b'f' => Some(value - b'a' + 10),
+        _ => None,
+    }
+}
+
 fn expiry_after(ttl_seconds: u64) -> Result<OffsetDateTime, PreauthorizationStateError> {
     let seconds =
         i64::try_from(ttl_seconds).map_err(|_| PreauthorizationStateError::InvalidExpiry)?;
@@ -763,7 +1463,6 @@ mod tests {
             backend: PreauthorizationBackend::InMemory(Arc::new(
                 InMemoryPreauthorizationState::new().unwrap(),
             )),
-            issuance: Arc::new(Mutex::new(HashMap::new())),
         }
     }
 
@@ -778,6 +1477,65 @@ mod tests {
             evaluation_client_id: "client-1".to_string(),
             credential_configuration_id: "person_is_alive_sd_jwt".to_string(),
             commitment: format!("sha256:{}", "a".repeat(64)),
+            authority: IssuanceAuthority::SubjectAccess,
+        }
+    }
+
+    fn registry_client_offer_reservation(
+        transaction_id: &str,
+        evaluation_id: &str,
+        idempotency_byte: char,
+        request_byte: char,
+    ) -> RegistryClientOfferReservation {
+        let now = OffsetDateTime::now_utc();
+        let pin = "246810".to_string();
+        RegistryClientOfferReservation {
+            transaction_id: transaction_id.to_string(),
+            evaluation_id: evaluation_id.to_string(),
+            evaluation_expires_at: now + Duration::minutes(20),
+            idempotency_key_hash: format!(
+                "hmac-sha256:{}",
+                idempotency_byte.to_string().repeat(64)
+            ),
+            canonical_request_hash: format!("sha256:{}", request_byte.to_string().repeat(64)),
+            transaction: IssuanceTransaction {
+                transaction_id: transaction_id.to_string(),
+                evaluation_id: evaluation_id.to_string(),
+                evaluation_client_id: "registry-client".to_string(),
+                credential_configuration_id: "person_is_alive_sd_jwt".to_string(),
+                commitment: format!("sha256:{}", "a".repeat(64)),
+                authority: IssuanceAuthority::RegistryClient {
+                    initiating_client_id: "registry-client".to_string(),
+                    initiating_client_id_hash: format!("hmac-sha256:{}", "c".repeat(64)),
+                    auth_profile_id: registry_notary_core::EvidenceAuthProfileId::ExternalOidc,
+                    authorized_scopes: vec!["registry:evidence".to_string()],
+                    target_ref: registry_notary_core::TargetRefView {
+                        entity_type: "Person".to_string(),
+                        handle: "opaque-target-handle".to_string(),
+                        identifier_schemes: Vec::new(),
+                        profile: None,
+                    },
+                    service_id: "notary.test".to_string(),
+                    purpose: "civil-registration".to_string(),
+                },
+            },
+            transaction_code: Some(RegistryClientTransactionCode {
+                pin: pin.clone(),
+                pin_length: 6,
+            }),
+            code_expires_at: now + Duration::minutes(5),
+            transaction_expires_at: now + Duration::minutes(15),
+            response: RegistryClientOfferResponse {
+                credential_offer_uri: format!(
+                    "openid-credential-offer://?credential_offer_uri={transaction_id}"
+                ),
+                tx_code: Some(pin),
+                expires_at: "2030-01-01T00:00:00Z".to_string(),
+            },
+            retention_expires_at: now + Duration::minutes(10),
+            quota_principal_hash: vec![0x71; 32],
+            quota_limit: None,
+            quota_cost: 1,
         }
     }
 
@@ -936,6 +1694,435 @@ mod tests {
         ));
     }
 
+    #[tokio::test]
+    async fn registry_client_offer_exact_replay_returns_the_cached_response() {
+        let state = memory_state();
+        let reservation =
+            registry_client_offer_reservation("offer-transaction", "evaluation", '1', 'a');
+        let expected = reservation.response.clone();
+        assert_eq!(
+            state
+                .reserve_registry_client_offer(reservation)
+                .await
+                .unwrap(),
+            RegistryClientOfferReservationOutcome::Created(expected.clone())
+        );
+        assert_eq!(
+            state
+                .reserve_registry_client_offer(registry_client_offer_reservation(
+                    "offer-transaction",
+                    "evaluation",
+                    '1',
+                    'a',
+                ))
+                .await
+                .unwrap(),
+            RegistryClientOfferReservationOutcome::Replayed(expected)
+        );
+    }
+
+    #[tokio::test]
+    async fn registry_client_offer_replay_stops_when_the_signed_code_expires() {
+        let state = memory_state();
+        let mut reservation =
+            registry_client_offer_reservation("expiring-offer", "evaluation", '9', 'f');
+        let code_expires_at = OffsetDateTime::now_utc() + Duration::milliseconds(250);
+        reservation.code_expires_at = code_expires_at;
+        reservation.retention_expires_at = code_expires_at;
+        reservation.response.expires_at = crate::format_time(code_expires_at);
+        state
+            .reserve_registry_client_offer(reservation)
+            .await
+            .expect("live offer reserves");
+
+        tokio::time::sleep(std::time::Duration::from_millis(300)).await;
+
+        assert!(matches!(
+            state
+                .registry_client_offer_preflight(
+                    "evaluation",
+                    "registry-client",
+                    &format!("hmac-sha256:{}", "9".repeat(64)),
+                    &format!("sha256:{}", "f".repeat(64)),
+                )
+                .await
+                .expect("expired replay lookup succeeds"),
+            RegistryClientOfferPreflightOutcome::EvaluationConsumed
+        ));
+    }
+
+    #[tokio::test]
+    async fn registry_client_offer_preflight_is_exact_and_nonmutating() {
+        let state = memory_state();
+        let reservation =
+            registry_client_offer_reservation("offer-transaction", "evaluation", '1', 'a');
+        assert!(matches!(
+            state
+                .registry_client_offer_preflight(
+                    "evaluation",
+                    "registry-client",
+                    &reservation.idempotency_key_hash,
+                    &reservation.canonical_request_hash,
+                )
+                .await
+                .unwrap(),
+            RegistryClientOfferPreflightOutcome::Available
+        ));
+        assert!(state
+            .transaction("offer-transaction")
+            .await
+            .unwrap()
+            .is_none());
+        let expected = reservation.response.clone();
+        state
+            .reserve_registry_client_offer(reservation)
+            .await
+            .unwrap();
+        assert_eq!(
+            state
+                .registry_client_offer_preflight(
+                    "evaluation",
+                    "registry-client",
+                    &format!("hmac-sha256:{}", "1".repeat(64)),
+                    &format!("sha256:{}", "a".repeat(64)),
+                )
+                .await
+                .unwrap(),
+            RegistryClientOfferPreflightOutcome::Replayed(expected)
+        );
+        assert!(matches!(
+            state
+                .registry_client_offer_preflight(
+                    "evaluation",
+                    "registry-client",
+                    &format!("hmac-sha256:{}", "1".repeat(64)),
+                    &format!("sha256:{}", "b".repeat(64)),
+                )
+                .await
+                .unwrap(),
+            RegistryClientOfferPreflightOutcome::IdempotencyConflict
+        ));
+        assert!(matches!(
+            state
+                .registry_client_offer_preflight(
+                    "evaluation",
+                    "registry-client",
+                    &format!("hmac-sha256:{}", "2".repeat(64)),
+                    &format!("sha256:{}", "a".repeat(64)),
+                )
+                .await
+                .unwrap(),
+            RegistryClientOfferPreflightOutcome::EvaluationConsumed
+        ));
+    }
+
+    #[tokio::test]
+    async fn registry_client_offer_conflict_and_consumed_evaluation_are_distinct() {
+        let state = memory_state();
+        state
+            .reserve_registry_client_offer(registry_client_offer_reservation(
+                "offer-transaction",
+                "evaluation",
+                '1',
+                'a',
+            ))
+            .await
+            .unwrap();
+        assert!(matches!(
+            state
+                .reserve_registry_client_offer(registry_client_offer_reservation(
+                    "offer-transaction",
+                    "evaluation",
+                    '1',
+                    'b',
+                ))
+                .await,
+            Err(PreauthorizationStateError::IdempotencyConflict)
+        ));
+        assert!(matches!(
+            state
+                .reserve_registry_client_offer(registry_client_offer_reservation(
+                    "other-transaction",
+                    "evaluation",
+                    '2',
+                    'a',
+                ))
+                .await,
+            Err(PreauthorizationStateError::EvaluationConsumed)
+        ));
+        assert!(state
+            .transaction("other-transaction")
+            .await
+            .unwrap()
+            .is_none());
+    }
+
+    #[tokio::test]
+    async fn concurrent_exact_retries_create_once_and_replay_once() {
+        let state = Arc::new(memory_state());
+        let barrier = Arc::new(tokio::sync::Barrier::new(3));
+        let mut attempts = Vec::new();
+        for _ in 0..2 {
+            let state = Arc::clone(&state);
+            let barrier = Arc::clone(&barrier);
+            attempts.push(tokio::spawn(async move {
+                barrier.wait().await;
+                let mut reservation =
+                    registry_client_offer_reservation("offer-transaction", "evaluation", '1', 'a');
+                reservation.quota_limit = Some(1);
+                state
+                    .reserve_registry_client_offer(reservation)
+                    .await
+                    .unwrap()
+            }));
+        }
+        barrier.wait().await;
+        let outcomes = [
+            attempts.remove(0).await.unwrap(),
+            attempts.remove(0).await.unwrap(),
+        ];
+        assert_eq!(
+            outcomes
+                .iter()
+                .filter(|outcome| matches!(
+                    outcome,
+                    RegistryClientOfferReservationOutcome::Created(_)
+                ))
+                .count(),
+            1
+        );
+        assert_eq!(
+            outcomes
+                .iter()
+                .filter(|outcome| matches!(
+                    outcome,
+                    RegistryClientOfferReservationOutcome::Replayed(_)
+                ))
+                .count(),
+            1
+        );
+    }
+
+    #[tokio::test]
+    async fn concurrent_idempotency_keys_consume_an_evaluation_once() {
+        let state = Arc::new(memory_state());
+        let barrier = Arc::new(tokio::sync::Barrier::new(3));
+        let mut attempts = Vec::new();
+        for (transaction_id, idempotency_byte) in [
+            ("offer-transaction-one", '1'),
+            ("offer-transaction-two", '2'),
+        ] {
+            let state = Arc::clone(&state);
+            let barrier = Arc::clone(&barrier);
+            attempts.push(tokio::spawn(async move {
+                barrier.wait().await;
+                state
+                    .reserve_registry_client_offer(registry_client_offer_reservation(
+                        transaction_id,
+                        "evaluation",
+                        idempotency_byte,
+                        'a',
+                    ))
+                    .await
+            }));
+        }
+        barrier.wait().await;
+        let outcomes = [
+            attempts.remove(0).await.unwrap(),
+            attempts.remove(0).await.unwrap(),
+        ];
+        assert_eq!(
+            outcomes
+                .iter()
+                .filter(|outcome| matches!(
+                    outcome,
+                    Ok(RegistryClientOfferReservationOutcome::Created(_))
+                ))
+                .count(),
+            1
+        );
+        assert_eq!(
+            outcomes
+                .iter()
+                .filter(|outcome| matches!(
+                    outcome,
+                    Err(PreauthorizationStateError::EvaluationConsumed)
+                ))
+                .count(),
+            1
+        );
+    }
+
+    #[tokio::test]
+    async fn direct_and_offer_reservations_share_one_evaluation_lineage() {
+        let state = memory_state();
+        let expires_at = OffsetDateTime::now_utc() + Duration::minutes(20);
+        state
+            .reserve_evaluation_issuance("direct-first", "registry-client", expires_at)
+            .await
+            .unwrap();
+        assert!(matches!(
+            state
+                .reserve_registry_client_offer(registry_client_offer_reservation(
+                    "offer-after-direct",
+                    "direct-first",
+                    '3',
+                    'a',
+                ))
+                .await,
+            Err(PreauthorizationStateError::EvaluationConsumed)
+        ));
+
+        state
+            .reserve_registry_client_offer(registry_client_offer_reservation(
+                "offer-first",
+                "offer-first-evaluation",
+                '4',
+                'a',
+            ))
+            .await
+            .unwrap();
+        assert!(matches!(
+            state
+                .reserve_evaluation_issuance(
+                    "offer-first-evaluation",
+                    "registry-client",
+                    expires_at,
+                )
+                .await,
+            Err(PreauthorizationStateError::EvaluationConsumed)
+        ));
+    }
+
+    #[tokio::test]
+    async fn concurrent_direct_and_offer_reservations_have_exactly_one_winner() {
+        let state = Arc::new(memory_state());
+        let barrier = Arc::new(tokio::sync::Barrier::new(3));
+        let direct_state = Arc::clone(&state);
+        let direct_barrier = Arc::clone(&barrier);
+        let direct = tokio::spawn(async move {
+            direct_barrier.wait().await;
+            direct_state
+                .reserve_evaluation_issuance(
+                    "raced-evaluation",
+                    "registry-client",
+                    OffsetDateTime::now_utc() + Duration::minutes(20),
+                )
+                .await
+                .map(|()| "direct")
+        });
+        let offer_state = Arc::clone(&state);
+        let offer_barrier = Arc::clone(&barrier);
+        let offer = tokio::spawn(async move {
+            offer_barrier.wait().await;
+            offer_state
+                .reserve_registry_client_offer(registry_client_offer_reservation(
+                    "raced-offer",
+                    "raced-evaluation",
+                    '5',
+                    'a',
+                ))
+                .await
+                .map(|_| "offer")
+        });
+        barrier.wait().await;
+        let outcomes = [direct.await.unwrap(), offer.await.unwrap()];
+        assert_eq!(outcomes.iter().filter(|outcome| outcome.is_ok()).count(), 1);
+        assert_eq!(
+            outcomes
+                .iter()
+                .filter(|outcome| matches!(
+                    outcome,
+                    Err(PreauthorizationStateError::EvaluationConsumed)
+                ))
+                .count(),
+            1
+        );
+    }
+
+    #[tokio::test]
+    async fn offer_quota_charges_only_a_new_winning_reservation() {
+        let state = memory_state();
+        let mut first =
+            registry_client_offer_reservation("quota-first", "quota-evaluation-one", '6', 'a');
+        first.quota_limit = Some(1);
+        assert!(matches!(
+            state.reserve_registry_client_offer(first).await,
+            Ok(RegistryClientOfferReservationOutcome::Created(_))
+        ));
+
+        let mut replay =
+            registry_client_offer_reservation("quota-first", "quota-evaluation-one", '6', 'a');
+        replay.quota_limit = Some(1);
+        assert!(matches!(
+            state.reserve_registry_client_offer(replay).await,
+            Ok(RegistryClientOfferReservationOutcome::Replayed(_))
+        ));
+
+        let mut second =
+            registry_client_offer_reservation("quota-second", "quota-evaluation-two", '7', 'a');
+        second.quota_limit = Some(1);
+        assert!(matches!(
+            state.reserve_registry_client_offer(second).await,
+            Err(PreauthorizationStateError::MachineQuotaExceeded {
+                retry_after_seconds: 1..=60
+            })
+        ));
+        state
+            .reserve_evaluation_issuance(
+                "quota-evaluation-two",
+                "registry-client",
+                OffsetDateTime::now_utc() + Duration::minutes(20),
+            )
+            .await
+            .unwrap();
+    }
+
+    #[tokio::test]
+    async fn rejected_registry_client_offer_rolls_back_every_reservation() {
+        let state = memory_state();
+        let mut invalid =
+            registry_client_offer_reservation("offer-transaction", "evaluation", '1', 'a');
+        invalid.retention_expires_at = OffsetDateTime::now_utc() + Duration::minutes(1);
+        assert!(matches!(
+            state.reserve_registry_client_offer(invalid).await,
+            Err(PreauthorizationStateError::InvalidExpiry)
+        ));
+        let valid = registry_client_offer_reservation("offer-transaction", "evaluation", '1', 'a');
+        assert!(matches!(
+            state.reserve_registry_client_offer(valid).await,
+            Ok(RegistryClientOfferReservationOutcome::Created(_))
+        ));
+        assert!(state
+            .verify_transaction_code("offer-transaction", "246810")
+            .await
+            .unwrap()
+            .is_some());
+        assert!(state
+            .transaction("offer-transaction")
+            .await
+            .unwrap()
+            .is_some());
+    }
+
+    #[tokio::test]
+    async fn registry_client_offer_without_pin_remains_atomically_redeemable() {
+        let state = memory_state();
+        let mut reservation =
+            registry_client_offer_reservation("offer-transaction", "evaluation", '1', 'a');
+        reservation.transaction_code = None;
+        reservation.response.tx_code = None;
+        let code_expires_at = reservation.code_expires_at;
+        assert!(matches!(
+            state.reserve_registry_client_offer(reservation).await,
+            Ok(RegistryClientOfferReservationOutcome::Created(_))
+        ));
+        assert!(state
+            .redeem(&scope(), "offer-transaction", code_expires_at, false, None,)
+            .await
+            .unwrap());
+    }
+
     #[tokio::test]
     async fn wrong_pin_preserves_offer_and_successful_redemption_is_single_use() {
         let state = memory_state();
@@ -974,7 +2161,6 @@ mod tests {
         let backend = Arc::new(InMemoryPreauthorizationState::new().unwrap());
         let issuing_runtime = PreauthorizationState {
             backend: PreauthorizationBackend::InMemory(Arc::clone(&backend)),
-            issuance: Arc::new(Mutex::new(HashMap::new())),
         };
         let expires_at = OffsetDateTime::now_utc() + Duration::minutes(5);
         assert!(issuing_runtime
@@ -984,7 +2170,6 @@ mod tests {
 
         let reconfigured_runtime = PreauthorizationState {
             backend: PreauthorizationBackend::InMemory(backend),
-            issuance: Arc::clone(&issuing_runtime.issuance),
         };
         assert!(matches!(
             reconfigured_runtime
@@ -1054,11 +2239,28 @@ mod tests {
         let rendered = format!("{proof:?}");
         assert!(!rendered.contains('7'));
         assert!(!rendered.contains('9'));
+
+        let reservation =
+            registry_client_offer_reservation("secret-transaction", "secret-evaluation", '1', 'a');
+        let rendered = format!("{reservation:?}");
+        for secret in [
+            "registry-client",
+            "opaque-target-handle",
+            "civil-registration",
+            "secret-transaction",
+            "secret-evaluation",
+            "openid-credential-offer",
+            "246810",
+        ] {
+            assert!(!rendered.contains(secret), "Debug exposed {secret}");
+        }
     }
 
     #[test]
     fn login_state_has_an_explicit_zeroize_lifecycle() {
         fn requires_zeroize<T: Zeroize + ZeroizeOnDrop>() {}
         requires_zeroize::<LoginState>();
+        requires_zeroize::<RegistryClientOfferResponse>();
+        requires_zeroize::<RegistryClientTransactionCode>();
     }
 }
diff --git a/crates/registry-notary-server/src/relay_client.rs b/crates/registry-notary-server/src/relay_client.rs
index 23a943e471..5042fd5e71 100644
--- a/crates/registry-notary-server/src/relay_client.rs
+++ b/crates/registry-notary-server/src/relay_client.rs
@@ -35,6 +35,7 @@ use registry_platform_httputil::destination::{
 };
 use serde::ser::{SerializeMap, SerializeStruct};
 use serde::{Serialize, Serializer};
+use serde_json::Value;
 use thiserror::Error;
 use time::format_description::well_known::Rfc3339;
 use time::OffsetDateTime;
@@ -149,6 +150,28 @@ fn valid_output(output: &NotaryRelayOutputContract) -> bool {
                 && *maximum <= MAX_JSON_INTEROPERABLE_INTEGER as i64
         }
         NotaryRelayOutputContract::Boolean { .. } | NotaryRelayOutputContract::Date { .. } => true,
+        NotaryRelayOutputContract::Object {
+            max_bytes, fields, ..
+        } => {
+            (1..=MAX_PUBLIC_STRING_BYTES).contains(max_bytes)
+                && (1..=32).contains(&fields.len())
+                && fields.iter().all(|(name, field)| {
+                    !name.is_empty()
+                        && name.len() <= 128
+                        && !name.chars().any(char::is_control)
+                        && valid_output(&field.schema)
+                })
+        }
+        NotaryRelayOutputContract::Array {
+            max_bytes,
+            max_items,
+            items,
+            ..
+        } => {
+            (1..=MAX_PUBLIC_STRING_BYTES).contains(max_bytes)
+                && (1..=256).contains(max_items)
+                && valid_output(items)
+        }
     }
 }
 
@@ -1094,13 +1117,40 @@ fn relay_output_schema(
     output: &NotaryRelayOutputContract,
 ) -> Result<ClosedJsonSchema, RelayClientError> {
     match output {
-        NotaryRelayOutputContract::Boolean { .. } => Ok(ClosedJsonSchema::boolean(true)),
+        NotaryRelayOutputContract::Boolean { nullable } => Ok(ClosedJsonSchema::boolean(*nullable)),
         NotaryRelayOutputContract::Integer {
-            minimum, maximum, ..
-        } => ClosedJsonSchema::integer(true, *minimum, *maximum)
+            nullable,
+            minimum,
+            maximum,
+        } => ClosedJsonSchema::integer(*nullable, *minimum, *maximum)
+            .map_err(|_| RelayClientError::InvalidConfiguration),
+        NotaryRelayOutputContract::String {
+            nullable,
+            max_bytes,
+        } => string(*nullable, *max_bytes),
+        NotaryRelayOutputContract::Date { nullable } => string(*nullable, 10),
+        NotaryRelayOutputContract::Object {
+            nullable, fields, ..
+        } => object(
+            *nullable,
+            fields
+                .iter()
+                .map(|(name, field_contract)| {
+                    field(
+                        name,
+                        field_contract.required,
+                        relay_output_schema(&field_contract.schema)?,
+                    )
+                })
+                .collect::<Result<Vec<_>, RelayClientError>>()?,
+        ),
+        NotaryRelayOutputContract::Array {
+            nullable,
+            max_items,
+            items,
+            ..
+        } => ClosedJsonSchema::array(*nullable, *max_items, relay_output_schema(items)?)
             .map_err(|_| RelayClientError::InvalidConfiguration),
-        NotaryRelayOutputContract::String { max_bytes, .. } => string(true, *max_bytes),
-        NotaryRelayOutputContract::Date { .. } => string(true, 10),
     }
 }
 
@@ -1271,6 +1321,15 @@ fn relay_output_value_valid(
         (NotaryRelayOutputContract::Date { .. }, ProjectedJsonScalar::String(value)) => {
             is_rfc3339_full_date(value)
         }
+        (
+            output @ (NotaryRelayOutputContract::Object { max_bytes, .. }
+            | NotaryRelayOutputContract::Array { max_bytes, .. }),
+            ProjectedJsonScalar::CanonicalJson(value),
+        ) => {
+            value.len() <= *max_bytes as usize
+                && serde_json::from_slice::<Value>(value)
+                    .is_ok_and(|value| output.validates_value(&value))
+        }
         (output, ProjectedJsonScalar::Null) => output.nullable(),
         _ => false,
     }
diff --git a/crates/registry-notary-server/src/relay_client/tests.rs b/crates/registry-notary-server/src/relay_client/tests.rs
index c149dc5ff3..a5fb878668 100644
--- a/crates/registry-notary-server/src/relay_client/tests.rs
+++ b/crates/registry-notary-server/src/relay_client/tests.rs
@@ -410,6 +410,175 @@ fn typed_output_expectation() -> RelayExpectedResult {
     .expect("valid typed output expectation")
 }
 
+fn structured_output_contracts() -> BTreeMap<String, NotaryRelayOutputContract> {
+    use registry_notary_core::RelayOutputObjectFieldContract;
+
+    let parent = NotaryRelayOutputContract::Object {
+        nullable: false,
+        max_bytes: 512,
+        fields: BTreeMap::from([
+            (
+                "identifier".to_string(),
+                RelayOutputObjectFieldContract {
+                    required: true,
+                    schema: Box::new(NotaryRelayOutputContract::String {
+                        nullable: false,
+                        max_bytes: 64,
+                    }),
+                },
+            ),
+            (
+                "name".to_string(),
+                RelayOutputObjectFieldContract {
+                    required: true,
+                    schema: Box::new(NotaryRelayOutputContract::String {
+                        nullable: false,
+                        max_bytes: 128,
+                    }),
+                },
+            ),
+            (
+                "type".to_string(),
+                RelayOutputObjectFieldContract {
+                    required: true,
+                    schema: Box::new(NotaryRelayOutputContract::String {
+                        nullable: false,
+                        max_bytes: 32,
+                    }),
+                },
+            ),
+        ]),
+    };
+    BTreeMap::from([
+        (
+            "parents".to_string(),
+            NotaryRelayOutputContract::Array {
+                nullable: false,
+                max_bytes: 2_048,
+                max_items: 4,
+                items: Box::new(parent),
+            },
+        ),
+        (
+            "person".to_string(),
+            NotaryRelayOutputContract::Object {
+                nullable: false,
+                max_bytes: 1_024,
+                fields: BTreeMap::from([
+                    (
+                        "active".to_string(),
+                        RelayOutputObjectFieldContract {
+                            required: true,
+                            schema: Box::new(NotaryRelayOutputContract::Boolean {
+                                nullable: false,
+                            }),
+                        },
+                    ),
+                    (
+                        "name".to_string(),
+                        RelayOutputObjectFieldContract {
+                            required: true,
+                            schema: Box::new(NotaryRelayOutputContract::String {
+                                nullable: false,
+                                max_bytes: 128,
+                            }),
+                        },
+                    ),
+                    (
+                        "tags".to_string(),
+                        RelayOutputObjectFieldContract {
+                            required: false,
+                            schema: Box::new(NotaryRelayOutputContract::Array {
+                                nullable: false,
+                                max_bytes: 256,
+                                max_items: 3,
+                                items: Box::new(NotaryRelayOutputContract::String {
+                                    nullable: false,
+                                    max_bytes: 32,
+                                }),
+                            }),
+                        },
+                    ),
+                ]),
+            },
+        ),
+    ])
+}
+
+fn structured_contract_value() -> Value {
+    let mut contract = contract_value();
+    contract["spec"]["output"] = json!({
+        "parents": {
+            "type": "array",
+            "nullable": false,
+            "max_bytes": 2_048,
+            "max_items": 4,
+            "items": {
+                "type": "object",
+                "nullable": false,
+                "max_bytes": 512,
+                "fields": {
+                    "identifier": {
+                        "required": true,
+                        "schema": { "type": "string", "nullable": false, "max_bytes": 64 }
+                    },
+                    "name": {
+                        "required": true,
+                        "schema": { "type": "string", "nullable": false, "max_bytes": 128 }
+                    },
+                    "type": {
+                        "required": true,
+                        "schema": { "type": "string", "nullable": false, "max_bytes": 32 }
+                    }
+                }
+            }
+        },
+        "person": {
+            "type": "object",
+            "nullable": false,
+            "max_bytes": 1_024,
+            "fields": {
+                "active": {
+                    "required": true,
+                    "schema": { "type": "boolean", "nullable": false }
+                },
+                "name": {
+                    "required": true,
+                    "schema": { "type": "string", "nullable": false, "max_bytes": 128 }
+                },
+                "tags": {
+                    "required": false,
+                    "schema": {
+                        "type": "array",
+                        "nullable": false,
+                        "max_bytes": 256,
+                        "max_items": 3,
+                        "items": { "type": "string", "nullable": false, "max_bytes": 32 }
+                    }
+                }
+            }
+        }
+    });
+    contract
+}
+
+fn structured_result_value(contract_hash: &str) -> Value {
+    let mut result = result_value();
+    result["profile"]["contract_hash"] = json!(contract_hash);
+    result["outputs"] = json!({
+        "parents": [
+            { "type": "mother", "name": "Grace", "identifier": "PARENT-2" },
+            { "identifier": "PARENT-1", "name": "Charles", "type": "father" }
+        ],
+        "person": {
+            "tags": ["citizen", "verified"],
+            "name": "Ada",
+            "active": true
+        }
+    });
+    result
+}
+
 #[test]
 fn output_contract_rejects_reserved_notary_view_names() {
     for name in ["matched", "outcome", "status.code"] {
@@ -1310,6 +1479,113 @@ async fn exact_profile_and_execute_journey_is_strict_and_bounded() {
     server.shutdown().await;
 }
 
+#[tokio::test]
+async fn structured_object_and_array_outputs_preserve_exact_nested_json() {
+    let token_file = TestTokenFile::new(&test_token());
+    let contract = structured_contract_value();
+    let contract_hash = typed_hash(CONTRACT_DOMAIN, &contract);
+    let result = structured_result_value(&contract_hash);
+    let server = FakeRelay::start(
+        metadata_response_for_contract(&contract, &contract_hash),
+        WireResponse::ok(serde_json::to_vec(&result).unwrap()),
+    )
+    .await;
+    let client = client_with_result(
+        &server,
+        &token_file,
+        &contract_hash,
+        RelayExpectedResult::output_map(structured_output_contracts()).unwrap(),
+    )
+    .verify_profile()
+    .await
+    .expect("recursive output contract verifies");
+
+    let result = client
+        .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
+        .await
+        .expect("closed recursive result executes");
+    let Some(RelayMatchData::OutputMap(outputs)) = result.match_data() else {
+        panic!("match exposes the declared structured output map")
+    };
+    let outputs = outputs.fields().collect::<BTreeMap<_, _>>();
+    let expected = structured_result_value(&contract_hash);
+    for name in ["parents", "person"] {
+        let ProjectedJsonScalar::CanonicalJson(actual) = outputs[name] else {
+            panic!("{name} is retained as one canonical JSON value")
+        };
+        let canonical =
+            canonicalize_json(&expected["outputs"][name]).expect("expected value canonicalizes");
+        assert_eq!(
+            actual.as_slice(),
+            canonical.as_slice(),
+            "{name} preserves every nested value and array position"
+        );
+    }
+    server.shutdown().await;
+}
+
+#[tokio::test]
+async fn structured_outputs_reject_nested_shape_and_scalar_composite_mismatches() {
+    let token_file = TestTokenFile::new(&test_token());
+    let contract = structured_contract_value();
+    let contract_hash = typed_hash(CONTRACT_DOMAIN, &contract);
+    let server = FakeRelay::start(
+        metadata_response_for_contract(&contract, &contract_hash),
+        WireResponse::ok(serde_json::to_vec(&structured_result_value(&contract_hash)).unwrap()),
+    )
+    .await;
+    let client = client_with_result(
+        &server,
+        &token_file,
+        &contract_hash,
+        RelayExpectedResult::output_map(structured_output_contracts()).unwrap(),
+    )
+    .verify_profile()
+    .await
+    .expect("recursive output contract verifies");
+
+    let mut cases = Vec::new();
+
+    let mut extra_nested_key = structured_result_value(&contract_hash);
+    extra_nested_key["outputs"]["person"]["undeclared"] = json!("must fail closed");
+    cases.push(("extra nested object key", extra_nested_key));
+
+    let mut wrong_nested_type = structured_result_value(&contract_hash);
+    wrong_nested_type["outputs"]["person"]["active"] = json!("true");
+    cases.push(("wrong nested scalar type", wrong_nested_type));
+
+    let mut malformed_array_item = structured_result_value(&contract_hash);
+    malformed_array_item["outputs"]["parents"][1] = json!("not-an-object");
+    cases.push(("malformed array item", malformed_array_item));
+
+    let mut object_as_scalar = structured_result_value(&contract_hash);
+    object_as_scalar["outputs"]["person"] = json!("Ada");
+    cases.push(("object output returned as scalar", object_as_scalar));
+
+    let mut array_as_object = structured_result_value(&contract_hash);
+    array_as_object["outputs"]["parents"] = json!({
+        "identifier": "PARENT-1",
+        "name": "Charles",
+        "type": "father"
+    });
+    cases.push(("array output returned as object", array_as_object));
+
+    for (label, result) in cases {
+        server
+            .set_execute(WireResponse::ok(serde_json::to_vec(&result).unwrap()))
+            .await;
+        assert_eq!(
+            client
+                .execute(EVALUATION_ID, Zeroizing::new(INPUT_VALUE.to_string()))
+                .await
+                .expect_err(label),
+            RelayClientError::InvalidResult,
+            "{label}"
+        );
+    }
+    server.shutdown().await;
+}
+
 #[tokio::test]
 async fn result_union_requires_outputs_only_for_match() {
     let token_file = TestTokenFile::new(&test_token());
diff --git a/crates/registry-notary-server/src/relay_contract.rs b/crates/registry-notary-server/src/relay_contract.rs
index 6ff7c852f1..e4f4e834d0 100644
--- a/crates/registry-notary-server/src/relay_contract.rs
+++ b/crates/registry-notary-server/src/relay_contract.rs
@@ -233,27 +233,44 @@ enum SourceRevision {
     AcquiredString { field: String, max_bytes: u16 },
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
-#[serde(rename_all = "snake_case")]
-enum OutputType {
-    String,
-    Boolean,
-    Integer,
-    Date,
+#[derive(Debug, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
+enum Output {
+    String {
+        nullable: bool,
+        max_bytes: u32,
+    },
+    Boolean {
+        nullable: bool,
+    },
+    Integer {
+        nullable: bool,
+        minimum: i64,
+        maximum: i64,
+    },
+    Date {
+        nullable: bool,
+        #[serde(default)]
+        max_bytes: Option<u32>,
+    },
+    Object {
+        nullable: bool,
+        max_bytes: u32,
+        fields: BTreeMap<String, OutputObjectField>,
+    },
+    Array {
+        nullable: bool,
+        max_bytes: u32,
+        max_items: u16,
+        items: Box<Output>,
+    },
 }
 
 #[derive(Debug, Deserialize)]
 #[serde(deny_unknown_fields)]
-struct Output {
-    #[serde(rename = "type")]
-    output_type: OutputType,
-    nullable: bool,
-    #[serde(default)]
-    max_bytes: Option<u32>,
-    #[serde(default)]
-    minimum: Option<i64>,
-    #[serde(default)]
-    maximum: Option<i64>,
+struct OutputObjectField {
+    required: bool,
+    schema: Box<Output>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -653,57 +670,109 @@ fn verify_outputs(
         if !stable_id(name) || matches!(name.as_str(), "matched" | "outcome") {
             return Err(());
         }
-        let valid = match (output.output_type, &expected[name]) {
-            (
-                OutputType::String,
-                RelayOutputContract::String {
-                    nullable,
-                    max_bytes,
-                },
-            ) => {
-                output.nullable == *nullable
-                    && output.max_bytes == Some(*max_bytes)
-                    && (1..=MAX_OUTPUT_STRING_BYTES).contains(max_bytes)
-                    && output.minimum.is_none()
-                    && output.maximum.is_none()
-            }
-            (OutputType::Date, RelayOutputContract::Date { nullable }) => {
-                output.nullable == *nullable
-                    && output.max_bytes.is_none_or(|bytes| bytes == 10)
-                    && output.minimum.is_none()
-                    && output.maximum.is_none()
-            }
-            (OutputType::Boolean, RelayOutputContract::Boolean { nullable }) => {
-                output.nullable == *nullable
-                    && output.max_bytes.is_none()
-                    && output.minimum.is_none()
-                    && output.maximum.is_none()
-            }
-            (
-                OutputType::Integer,
-                RelayOutputContract::Integer {
-                    nullable,
-                    minimum,
-                    maximum,
-                },
-            ) => {
-                output.nullable == *nullable
-                    && output.minimum == Some(*minimum)
-                    && output.maximum == Some(*maximum)
-                    && minimum <= maximum
-                    && *minimum >= -MAX_JSON_INTEGER
-                    && *maximum <= MAX_JSON_INTEGER
-                    && output.max_bytes.is_none()
-            }
-            _ => false,
-        };
-        if !valid {
+        if !output_contract_matches(output, &expected[name]) {
             return Err(());
         }
     }
     Ok(())
 }
 
+fn output_contract_matches(output: &Output, expected: &RelayOutputContract) -> bool {
+    match (output, expected) {
+        (
+            Output::String {
+                nullable,
+                max_bytes,
+            },
+            RelayOutputContract::String {
+                nullable: expected_nullable,
+                max_bytes: expected_max_bytes,
+            },
+        ) => {
+            nullable == expected_nullable
+                && max_bytes == expected_max_bytes
+                && (1..=MAX_OUTPUT_STRING_BYTES).contains(max_bytes)
+        }
+        (
+            Output::Date {
+                nullable,
+                max_bytes,
+            },
+            RelayOutputContract::Date {
+                nullable: expected_nullable,
+            },
+        ) => nullable == expected_nullable && max_bytes.is_none_or(|bytes| bytes == 10),
+        (
+            Output::Boolean { nullable },
+            RelayOutputContract::Boolean {
+                nullable: expected_nullable,
+            },
+        ) => nullable == expected_nullable,
+        (
+            Output::Integer {
+                nullable,
+                minimum,
+                maximum,
+            },
+            RelayOutputContract::Integer {
+                nullable: expected_nullable,
+                minimum: expected_minimum,
+                maximum: expected_maximum,
+            },
+        ) => {
+            nullable == expected_nullable
+                && minimum == expected_minimum
+                && maximum == expected_maximum
+                && minimum <= maximum
+                && *minimum >= -MAX_JSON_INTEGER
+                && *maximum <= MAX_JSON_INTEGER
+        }
+        (
+            Output::Object {
+                nullable,
+                max_bytes,
+                fields,
+            },
+            RelayOutputContract::Object {
+                nullable: expected_nullable,
+                max_bytes: expected_max_bytes,
+                fields: expected_fields,
+            },
+        ) => {
+            nullable == expected_nullable
+                && max_bytes == expected_max_bytes
+                && fields.len() <= 32
+                && fields.keys().eq(expected_fields.keys())
+                && fields.iter().all(|(name, field)| {
+                    let expected_field = &expected_fields[name];
+                    bounded_name(name)
+                        && field.required == expected_field.required
+                        && output_contract_matches(&field.schema, &expected_field.schema)
+                })
+        }
+        (
+            Output::Array {
+                nullable,
+                max_bytes,
+                max_items,
+                items,
+            },
+            RelayOutputContract::Array {
+                nullable: expected_nullable,
+                max_bytes: expected_max_bytes,
+                max_items: expected_max_items,
+                items: expected_items,
+            },
+        ) => {
+            nullable == expected_nullable
+                && max_bytes == expected_max_bytes
+                && max_items == expected_max_items
+                && output_contract_matches(items, expected_items)
+        }
+        _ => false,
+    }
+}
+
 fn verify_authorization(
     authorization: &Authorization,
     workload_client_id: &str,
diff --git a/crates/registry-notary-server/src/runtime/cel.rs b/crates/registry-notary-server/src/runtime/cel.rs
index 26d11958d9..93f5fbf7db 100644
--- a/crates/registry-notary-server/src/runtime/cel.rs
+++ b/crates/registry-notary-server/src/runtime/cel.rs
@@ -215,6 +215,7 @@ pub(super) fn cel_preflight_root_bindings(
             let mut output_view = consultation
                 .outputs
                 .iter()
+                .filter(|(_, output)| output.is_scalar())
                 .map(|(name, output)| (name.clone(), registry_output_dummy_value(output)))
                 .collect::<Map<_, _>>();
             output_view.insert("matched".to_string(), Value::Bool(true));
@@ -282,6 +283,19 @@ fn registry_output_dummy_value(output: &registry_notary_core::RelayOutputContrac
             bounded_string_preview(Some(*max_bytes))
         }
         registry_notary_core::RelayOutputContract::Date { .. } => json!("2000-01-01"),
+        registry_notary_core::RelayOutputContract::Object { fields, .. } => Value::Object(
+            fields
+                .iter()
+                .filter(|(_, field)| field.required)
+                .map(|(name, field)| {
+                    (
+                        name.clone(),
+                        registry_output_dummy_value(field.schema.as_ref()),
+                    )
+                })
+                .collect(),
+        ),
+        registry_notary_core::RelayOutputContract::Array { .. } => Value::Array(Vec::new()),
     }
 }
 
@@ -344,6 +358,16 @@ fn validate_registry_cel_expression(
             return Err(EvidenceError::InvalidRequest);
         }
     }
+    let referenced_members = cel_first_level_member_references(expression, consultation_name);
+    if referenced_members.iter().any(|member| {
+        consultation
+            .outputs
+            .get(member)
+            .is_none_or(|output| !output.is_scalar())
+            && !matches!(member.as_str(), "matched" | "outcome")
+    }) {
+        return Err(EvidenceError::InvalidRequest);
+    }
     let compact = expression
         .bytes()
         .filter(|byte| !byte.is_ascii_whitespace())
@@ -354,7 +378,7 @@ fn validate_registry_cel_expression(
             continue;
         }
         let path = format!("{consultation_name}.{name}");
-        if !compact.contains(&path) {
+        if !referenced_members.contains(name) {
             continue;
         }
         let left_guard = format!("{path}!=null");
@@ -371,6 +395,27 @@ fn validate_registry_cel_expression(
     Ok(())
 }
 
+#[cfg(feature = "registry-notary-cel")]
+pub(super) fn cel_first_level_member_references(expression: &str, root: &str) -> BTreeSet<String> {
+    let tokens = cel_tokens(expression);
+    let mut members = BTreeSet::new();
+
+    for (index, token) in tokens.iter().enumerate() {
+        let CelToken::Identifier { text } = token else {
+            continue;
+        };
+        if *text != root || matches!(previous_token(&tokens, index), Some(CelToken::Dot)) {
+            continue;
+        }
+        if let Some([CelToken::Dot, CelToken::Identifier { text: member }]) =
+            next_tokens::<2>(&tokens, index)
+        {
+            members.insert((*member).to_string());
+        }
+    }
+    members
+}
+
 pub(super) fn registry_cel_required_variables<'a>(
     expression: &str,
     declared: impl IntoIterator<Item = &'a str>,
@@ -384,114 +429,200 @@ pub(super) fn registry_cel_required_variables<'a>(
 }
 
 fn cel_bare_identifiers(expression: &str) -> BTreeSet<String> {
+    let tokens = cel_tokens(expression);
+    tokens
+        .iter()
+        .enumerate()
+        .filter_map(|(index, token)| match token {
+            CelToken::Identifier { text }
+                if !matches!(previous_token(&tokens, index), Some(CelToken::Dot)) =>
+            {
+                Some((*text).to_string())
+            }
+            _ => None,
+        })
+        .collect()
+}
+
+#[cfg(feature = "registry-notary-cel")]
+pub(super) fn contains_unquoted_bracket(expression: &str) -> bool {
+    cel_tokens(expression)
+        .iter()
+        .any(|token| matches!(token, CelToken::Bracket))
+}
+
+#[cfg(feature = "registry-notary-cel")]
+pub(super) fn cel_root_references(expression: &str) -> BTreeSet<String> {
+    let tokens = cel_tokens(expression);
+    tokens
+        .iter()
+        .enumerate()
+        .filter_map(|(index, token)| match token {
+            CelToken::Identifier { text } => {
+                let is_root = matches!(
+                    next_token(&tokens, index),
+                    Some(CelToken::Dot | CelToken::Bracket)
+                ) && !matches!(previous_token(&tokens, index), Some(CelToken::Dot));
+                is_root.then(|| (*text).to_string())
+            }
+            CelToken::Dot | CelToken::Bracket | CelToken::Other => None,
+        })
+        .collect()
+}
+
+#[derive(Clone, Copy)]
+enum CelToken<'a> {
+    Identifier { text: &'a str },
+    Dot,
+    Bracket,
+    Other,
+}
+
+fn cel_tokens(expression: &str) -> Vec<CelToken<'_>> {
     let bytes = expression.as_bytes();
-    let mut identifiers = BTreeSet::new();
+    let mut tokens = Vec::new();
     let mut index = 0;
-    let mut quote = None;
     while index < bytes.len() {
-        let byte = bytes[index];
-        if let Some(active_quote) = quote {
-            if byte == b'\\' {
-                index = index.saturating_add(2);
-                continue;
-            }
-            if byte == active_quote {
-                quote = None;
-            }
-            index += 1;
+        if bytes.get(index..index + 2) == Some(b"//") {
+            index = skip_line_comment(bytes, index + 2);
             continue;
         }
-        if matches!(byte, b'\'' | b'"' | b'`') {
-            quote = Some(byte);
-            index += 1;
+        if let Some(end) = cel_string_literal_end(bytes, index) {
+            tokens.push(CelToken::Other);
+            index = end;
             continue;
         }
-        if !is_cel_identifier_start_byte(byte) {
+        if bytes[index] == b'`' {
+            tokens.push(CelToken::Other);
+            index = escaped_identifier_end(bytes, index);
+            continue;
+        }
+        if bytes[index] == b'.' {
+            tokens.push(CelToken::Dot);
             index += 1;
             continue;
         }
-        let start = index;
-        index += 1;
-        while index < bytes.len() && is_cel_identifier_continue_byte(bytes[index]) {
+        if matches!(bytes[index], b'[' | b']') {
+            tokens.push(CelToken::Bracket);
             index += 1;
+            continue;
+        }
+        if is_cel_identifier_start_byte(bytes[index]) {
+            let start = index;
+            index = identifier_end(bytes, start);
+            tokens.push(CelToken::Identifier {
+                text: &expression[start..index],
+            });
+            continue;
         }
-        if start == 0 || bytes[start - 1] != b'.' {
-            identifiers.insert(expression[start..index].to_string());
+        if !bytes[index].is_ascii_whitespace() {
+            tokens.push(CelToken::Other);
         }
+        index += 1;
     }
-    identifiers
+    tokens
+}
+
+fn previous_token<'a>(tokens: &'a [CelToken<'a>], index: usize) -> Option<CelToken<'a>> {
+    index
+        .checked_sub(1)
+        .and_then(|previous| tokens.get(previous))
+        .copied()
 }
 
 #[cfg(feature = "registry-notary-cel")]
-fn contains_unquoted_bracket(expression: &str) -> bool {
-    let mut quote = None;
-    let mut escaped = false;
-    for byte in expression.bytes() {
-        if let Some(active_quote) = quote {
-            if escaped {
-                escaped = false;
-            } else if byte == b'\\' {
-                escaped = true;
-            } else if byte == active_quote {
-                quote = None;
-            }
-        } else if matches!(byte, b'\'' | b'"' | b'`') {
-            quote = Some(byte);
-        } else if matches!(byte, b'[' | b']') {
-            return true;
-        }
-    }
-    false
+fn next_token<'a>(tokens: &'a [CelToken<'a>], index: usize) -> Option<CelToken<'a>> {
+    tokens.get(index + 1).copied()
 }
 
 #[cfg(feature = "registry-notary-cel")]
-pub(super) fn cel_root_references(expression: &str) -> BTreeSet<String> {
-    let bytes = expression.as_bytes();
-    let mut roots = BTreeSet::new();
-    let mut index = 0;
-    let mut quote: Option<u8> = None;
+fn next_tokens<'a, const N: usize>(
+    tokens: &'a [CelToken<'a>],
+    index: usize,
+) -> Option<[CelToken<'a>; N]> {
+    tokens.get(index + 1..index + 1 + N)?.try_into().ok()
+}
+
+fn cel_string_literal_end(bytes: &[u8], index: usize) -> Option<usize> {
+    let (quote_index, raw) = if matches!(bytes.get(index), Some(b'\'' | b'"')) {
+        (index, false)
+    } else if matches!(bytes.get(index), Some(b'r' | b'R'))
+        && matches!(bytes.get(index + 1), Some(b'\'' | b'"'))
+    {
+        (index + 1, true)
+    } else if matches!(bytes.get(index), Some(b'b' | b'B'))
+        && matches!(bytes.get(index + 1), Some(b'\'' | b'"'))
+    {
+        (index + 1, false)
+    } else if matches!(bytes.get(index), Some(b'b' | b'B'))
+        && matches!(bytes.get(index + 1), Some(b'r' | b'R'))
+        && matches!(bytes.get(index + 2), Some(b'\'' | b'"'))
+    {
+        (index + 2, true)
+    } else {
+        return None;
+    };
+    let quote = bytes[quote_index];
+    let triple = bytes.get(quote_index..quote_index + 3) == Some(&[quote, quote, quote]);
+    Some(if triple {
+        skip_triple_quoted_literal(bytes, quote_index + 3, quote, raw)
+    } else {
+        skip_quoted_literal(bytes, quote_index + 1, quote, raw)
+    })
+}
+
+fn skip_quoted_literal(bytes: &[u8], mut index: usize, quote: u8, raw: bool) -> usize {
     while index < bytes.len() {
-        let byte = bytes[index];
-        if let Some(active_quote) = quote {
-            if byte == b'\\' {
-                index = index.saturating_add(2);
-                continue;
-            }
-            if byte == active_quote {
-                quote = None;
-            }
-            index += 1;
+        if !raw && bytes[index] == b'\\' {
+            index = index.saturating_add(2);
             continue;
         }
-        if matches!(byte, b'\'' | b'"' | b'`') {
-            quote = Some(byte);
-            index += 1;
-            continue;
+        if bytes[index] == quote {
+            return index + 1;
         }
-        if !is_cel_identifier_start_byte(byte) {
-            index += 1;
-            continue;
-        }
-        let start = index;
         index += 1;
-        while index < bytes.len() && is_cel_identifier_continue_byte(bytes[index]) {
-            index += 1;
+    }
+    bytes.len()
+}
+
+fn skip_triple_quoted_literal(bytes: &[u8], mut index: usize, quote: u8, raw: bool) -> usize {
+    while index < bytes.len() {
+        if !raw && bytes[index] == b'\\' {
+            index = index.saturating_add(2);
+            continue;
         }
-        let mut lookahead = index;
-        while lookahead < bytes.len() && bytes[lookahead].is_ascii_whitespace() {
-            lookahead += 1;
+        if bytes.get(index..index + 3) == Some(&[quote, quote, quote]) {
+            return index + 3;
         }
-        let previous = start
-            .checked_sub(1)
-            .and_then(|previous| bytes.get(previous))
-            .copied();
-        let is_member = previous == Some(b'.');
-        let is_root = matches!(bytes.get(lookahead), Some(b'.' | b'[')) && !is_member;
-        if is_root {
-            roots.insert(expression[start..index].to_string());
+        index += 1;
+    }
+    bytes.len()
+}
+
+fn escaped_identifier_end(bytes: &[u8], mut index: usize) -> usize {
+    index += 1;
+    while index < bytes.len() {
+        if bytes[index] == b'`' {
+            return index + 1;
         }
+        index += 1;
+    }
+    bytes.len()
+}
+
+fn skip_line_comment(bytes: &[u8], mut index: usize) -> usize {
+    while index < bytes.len() && bytes[index] != b'\n' {
+        index += 1;
     }
-    roots
+    index
+}
+
+fn identifier_end(bytes: &[u8], mut index: usize) -> usize {
+    index += 1;
+    while index < bytes.len() && is_cel_identifier_continue_byte(bytes[index]) {
+        index += 1;
+    }
+    index
 }
 
 pub(super) fn is_cel_identifier_start_byte(byte: u8) -> bool {
@@ -507,7 +638,8 @@ pub(super) fn cel_root_bindings(
     ctx: &CelEvaluationContext<'_>,
 ) -> Result<BTreeMap<String, Value>, EvidenceError> {
     if ctx.claim.evidence_mode.is_registry_backed() {
-        let mut root_bindings = ctx.consultation_outputs.clone();
+        let mut root_bindings =
+            registry_cel_scalar_consultation_outputs(ctx.claim, ctx.consultation_outputs)?;
         for (name, declaration) in &ctx.evidence.variables {
             let Some(value) = ctx.variables.get(name) else {
                 continue;
@@ -577,6 +709,41 @@ pub(super) fn cel_root_bindings(
     Ok(root_bindings)
 }
 
+#[cfg(feature = "registry-notary-cel")]
+pub(super) fn registry_cel_scalar_consultation_outputs(
+    claim: &ClaimDefinition,
+    consultation_outputs: &BTreeMap<String, Value>,
+) -> Result<BTreeMap<String, Value>, EvidenceError> {
+    let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode else {
+        return Err(EvidenceError::InvalidRequest);
+    };
+    consultations
+        .iter()
+        .map(|(consultation_name, consultation)| {
+            let source = consultation_outputs
+                .get(consultation_name)
+                .and_then(Value::as_object)
+                .ok_or(EvidenceError::RuleEvaluationFailed)?;
+            let mut projected = Map::new();
+            for fixed in ["matched", "outcome"] {
+                if let Some(value) = source.get(fixed) {
+                    projected.insert(fixed.to_string(), value.clone());
+                }
+            }
+            for (name, _) in consultation
+                .outputs
+                .iter()
+                .filter(|(_, output)| output.is_scalar())
+            {
+                if let Some(value) = source.get(name) {
+                    projected.insert(name.clone(), value.clone());
+                }
+            }
+            Ok((consultation_name.clone(), Value::Object(projected)))
+        })
+        .collect()
+}
+
 #[cfg(feature = "registry-notary-cel")]
 pub(super) fn cel_project_claim_value(
     ctx: &CelEvaluationContext<'_>,
diff --git a/crates/registry-notary-server/src/runtime/consultation.rs b/crates/registry-notary-server/src/runtime/consultation.rs
index 5f81874ae5..0242697e86 100644
--- a/crates/registry-notary-server/src/runtime/consultation.rs
+++ b/crates/registry-notary-server/src/runtime/consultation.rs
@@ -42,7 +42,7 @@ impl RuntimeRelayExpectedResult {
         outputs: BTreeMap<String, RelayOutputContract>,
     ) -> Result<Self, ConsultationPlanError> {
         if outputs.is_empty()
-            || outputs.len() > 64
+            || outputs.len() > 32
             || outputs.keys().any(|name| {
                 !input_name(name, MAX_INPUT_NAME_BYTES)
                     || matches!(name.as_str(), "matched" | "outcome")
@@ -566,6 +566,7 @@ enum RuntimeRelayOutputValue {
     Boolean(bool),
     Integer(i64),
     String(Zeroizing<String>),
+    CanonicalJson(Zeroizing<Vec<u8>>),
 }
 
 impl RuntimeRelayOutputMap {
@@ -582,8 +583,11 @@ impl RuntimeRelayOutputMap {
                         .map(RuntimeRelayOutputValue::Integer)
                         .ok_or(RelayClientError::InvalidResult)?,
                     Value::String(value) => RuntimeRelayOutputValue::String(Zeroizing::new(value)),
-                    Value::Array(_) | Value::Object(_) => {
-                        return Err(RelayClientError::InvalidResult)
+                    value @ (Value::Array(_) | Value::Object(_)) => {
+                        RuntimeRelayOutputValue::CanonicalJson(Zeroizing::new(
+                            canonicalize_json(&value)
+                                .map_err(|_| RelayClientError::InvalidResult)?,
+                        ))
                     }
                 };
                 Ok((name.into_boxed_str(), value))
@@ -603,6 +607,9 @@ impl RuntimeRelayOutputMap {
                     ProjectedJsonScalar::String(value) => {
                         RuntimeRelayOutputValue::String(Zeroizing::new(value.to_string()))
                     }
+                    ProjectedJsonScalar::CanonicalJson(value) => {
+                        RuntimeRelayOutputValue::CanonicalJson(Zeroizing::new(value.to_vec()))
+                    }
                     ProjectedJsonScalar::Number(_) => return Err(RelayClientError::InvalidResult),
                 };
                 Ok((name.into(), value))
@@ -620,6 +627,8 @@ impl RuntimeRelayOutputMap {
                     RuntimeRelayOutputValue::Boolean(value) => Value::Bool(*value),
                     RuntimeRelayOutputValue::Integer(value) => Value::Number((*value).into()),
                     RuntimeRelayOutputValue::String(value) => Value::String(value.to_string()),
+                    RuntimeRelayOutputValue::CanonicalJson(value) => serde_json::from_slice(value)
+                        .expect("verified canonical Relay output remains valid JSON"),
                 };
                 (name.to_string(), value)
             })
diff --git a/crates/registry-notary-server/src/runtime/evaluation.rs b/crates/registry-notary-server/src/runtime/evaluation.rs
index 2cfbb25ea4..8b966a865f 100644
--- a/crates/registry-notary-server/src/runtime/evaluation.rs
+++ b/crates/registry-notary-server/src/runtime/evaluation.rs
@@ -552,8 +552,6 @@ impl RegistryNotaryRuntime {
                 policy,
             )
             .await?;
-        let issuance_provenance =
-            stored_issuance_provenance(&evidence, &request.claims, &claim_versions, &internal)?;
         let views = request
             .claims
             .iter()
@@ -571,6 +569,15 @@ impl RegistryNotaryRuntime {
                 )
             })
             .collect::<Result<Vec<_>, EvidenceError>>()?;
+        let issuance_provenance = stored_issuance_provenance(
+            &evidence,
+            &self.subject_access_rate_keys,
+            target,
+            &request.claims,
+            &claim_versions,
+            &internal,
+            &views,
+        )?;
         let expires_at = subject_access
             .as_ref()
             .and_then(|metadata| metadata.evaluation_expires_at.as_deref())
@@ -1216,12 +1223,6 @@ impl RegistryNotaryRuntime {
                 EvaluationPolicy::default(),
             )
             .await?;
-        let issuance_provenance = stored_issuance_provenance(
-            &evidence,
-            &item.request.claims,
-            &item.claim_versions,
-            &internal,
-        )?;
         let views = item
             .request
             .claims
@@ -1240,6 +1241,18 @@ impl RegistryNotaryRuntime {
                 )
             })
             .collect::<Result<Vec<_>, EvidenceError>>()?;
+        let issuance_provenance = stored_issuance_provenance(
+            &evidence,
+            &self.subject_access_rate_keys,
+            item.request
+                .target
+                .as_ref()
+                .ok_or(EvidenceError::InvalidRequest)?,
+            &item.request.claims,
+            &item.claim_versions,
+            &internal,
+            &views,
+        )?;
         Ok(EvaluatedRegistryClaims {
             views,
             issuance_provenance,
@@ -1646,9 +1659,12 @@ fn relay_expected_result(
 
 fn stored_issuance_provenance(
     evidence: &EvidenceConfig,
+    subject_access_rate_keys: &SubjectAccessRateLimitKeys,
+    target: &EvidenceEntity,
     selected_claims: &[ClaimRef],
     claim_versions: &ClaimVersionSelections,
     internal: &BTreeMap<String, ClaimResultInternal>,
+    selected_views: &[ClaimResultView],
 ) -> Result<Option<StoredIssuanceProvenance>, EvidenceError> {
     // Retain restricted Relay identifiers only when the selected roots share
     // an actual credential profile. Root configuration validation closes both
@@ -1712,6 +1728,25 @@ fn stored_issuance_provenance(
             .get(claim_id.as_str())
             .ok_or(EvidenceError::RuleEvaluationFailed)?;
         let mut claim = provenance.claim;
+        claim.result_content_binding = match selected_views
+            .iter()
+            .find(|view| view.claim_id == result.claim_id)
+        {
+            Some(view) => issuance_result_content_binding(view)?,
+            None => sha256_canonical_json(&json!({
+                "schema": "registry.notary.private-dependency-result-content/v1",
+                "result": {
+                    "evaluation_id": result.evaluation_id,
+                    "claim_id": result.claim_id,
+                    "claim_version": result.claim_version,
+                    "subject_type": result.subject_type,
+                    "value": result.value,
+                    "issued_at": format_time(result.issued_at),
+                    "expires_at": result.expires_at.map(format_time),
+                    "provenance": result.provenance,
+                },
+            }))?,
+        };
         claim.execution_binding = issuance_execution_binding(
             &claim,
             &provenance.consultation,
@@ -1721,9 +1756,27 @@ fn stored_issuance_provenance(
         )?;
         claims.push(claim);
     }
+    let target_ref = target_ref_view(subject_access_rate_keys, target)?;
+    let authorization_target_binding = match target.to_subject_request() {
+        Some(primary_identity) => {
+            let primary_id_type = match primary_identity.id_type.as_deref() {
+                Some("id") => return Err(EvidenceError::InvalidRequest),
+                Some(id_type) => id_type,
+                None => "id",
+            };
+            issuance_authorization_target_binding(
+                subject_access_rate_keys,
+                &target_ref,
+                primary_id_type,
+                &primary_identity.id,
+            )?
+        }
+        None => String::new(),
+    };
     Ok(Some(StoredIssuanceProvenance {
         claims,
         consultations: consultations.into_values().collect(),
+        authorization_target_binding,
     }))
 }
 
@@ -1800,83 +1853,88 @@ pub(super) async fn evaluate_claim_task(
         }
     }
     let delegated_proof_claim = ctx.evaluation_capability.is_delegated_proof_claim(claim_id);
-    let (consultation_outputs, observed_at, mut relay_consultation_ids, own_issuance_provenance) =
-        match &claim.evidence_mode {
-            ClaimEvidenceMode::SelfAttested => (BTreeMap::new(), None, BTreeSet::new(), None),
-            ClaimEvidenceMode::RegistryBacked { consultations } => {
-                require_relay_consultation_capability(&ctx.evaluation_capability, &claim.id)?;
-                let (_, consultation) = consultations
-                    .first_key_value()
-                    .filter(|_| consultations.len() == 1)
-                    .ok_or(EvidenceError::RuleEvaluationFailed)?;
-                let plan = ctx
-                    .relay_plan
-                    .as_ref()
-                    .ok_or(EvidenceError::EvidenceNotAvailable)?;
-                let result = plan.consult(&claim.id).await.map_err(|_| {
-                    if delegated_proof_claim {
-                        delegated_proof_denied()
-                    } else {
-                        EvidenceError::EvidenceNotAvailable
-                    }
-                })?;
-                let relay_outcome = result.outcome();
-                let consultation_outputs_result = match relay_outcome {
-                    RuntimeRelayOutcome::Match => materialize_relay_match(&claim, &result),
-                    RuntimeRelayOutcome::NoMatch
-                        if matches!(&claim.rule, RuleConfig::ConsultationOutput { .. })
-                            && registry_claim_has_typed_outputs(&claim) =>
-                    {
-                        materialize_relay_absence(&claim)
-                    }
-                    RuntimeRelayOutcome::NoMatch
-                        if matches!(&claim.rule, RuleConfig::ConsultationOutput { .. }) =>
-                    {
-                        Err(EvidenceError::EvidenceNotAvailable)
-                    }
-                    RuntimeRelayOutcome::NoMatch
-                        if matches!(&claim.rule, RuleConfig::Cel { .. }) =>
-                    {
-                        materialize_relay_absence(&claim)
-                    }
-                    RuntimeRelayOutcome::NoMatch => Ok(BTreeMap::new()),
-                    RuntimeRelayOutcome::Ambiguous => Err(EvidenceError::EvidenceNotAvailable),
-                };
-                let consultation_outputs = consultation_outputs_result.map_err(|error| {
-                    if delegated_proof_claim {
-                        if relay_outcome == RuntimeRelayOutcome::NoMatch {
-                            delegated_relationship_unproven()
-                        } else {
-                            delegated_proof_denied()
-                        }
+    let (
+        consultation_outputs,
+        observed_at,
+        mut relay_consultation_ids,
+        own_issuance_provenance,
+        relay_matched,
+    ) = match &claim.evidence_mode {
+        ClaimEvidenceMode::SelfAttested => (BTreeMap::new(), None, BTreeSet::new(), None, false),
+        ClaimEvidenceMode::RegistryBacked { consultations } => {
+            require_relay_consultation_capability(&ctx.evaluation_capability, &claim.id)?;
+            let (_, consultation) = consultations
+                .first_key_value()
+                .filter(|_| consultations.len() == 1)
+                .ok_or(EvidenceError::RuleEvaluationFailed)?;
+            let plan = ctx
+                .relay_plan
+                .as_ref()
+                .ok_or(EvidenceError::EvidenceNotAvailable)?;
+            let result = plan.consult(&claim.id).await.map_err(|_| {
+                if delegated_proof_claim {
+                    delegated_proof_denied()
+                } else {
+                    EvidenceError::EvidenceNotAvailable
+                }
+            })?;
+            let relay_outcome = result.outcome();
+            let consultation_outputs_result = match relay_outcome {
+                RuntimeRelayOutcome::Match => materialize_relay_match(&claim, &result),
+                RuntimeRelayOutcome::NoMatch
+                    if matches!(&claim.rule, RuleConfig::ConsultationOutput { .. })
+                        && registry_claim_has_typed_outputs(&claim) =>
+                {
+                    materialize_relay_absence(&claim)
+                }
+                RuntimeRelayOutcome::NoMatch
+                    if matches!(&claim.rule, RuleConfig::ConsultationOutput { .. }) =>
+                {
+                    Err(EvidenceError::EvidenceNotAvailable)
+                }
+                RuntimeRelayOutcome::NoMatch if matches!(&claim.rule, RuleConfig::Cel { .. }) => {
+                    materialize_relay_absence(&claim)
+                }
+                RuntimeRelayOutcome::NoMatch => Ok(BTreeMap::new()),
+                RuntimeRelayOutcome::Ambiguous => Err(EvidenceError::EvidenceNotAvailable),
+            };
+            let consultation_outputs = consultation_outputs_result.map_err(|error| {
+                if delegated_proof_claim {
+                    if relay_outcome == RuntimeRelayOutcome::NoMatch {
+                        delegated_relationship_unproven()
                     } else {
-                        error
+                        delegated_proof_denied()
                     }
-                })?;
-                let acquired_at = result.acquired_at();
-                let consultation_id = result.consultation_id().to_string();
-                (
-                    consultation_outputs,
-                    Some(acquired_at),
-                    BTreeSet::from([consultation_id.clone()]),
-                    Some(ClaimIssuanceProvenanceInternal {
-                        claim: StoredIssuanceClaimProvenance {
-                            claim_id: claim.id.clone(),
-                            claim_version: claim.version.clone(),
-                            relay_profile_id: consultation.profile.id.clone(),
-                            relay_contract_hash: consultation.profile.contract_hash.clone(),
-                            canonical_purpose: ctx.purpose.clone(),
-                            consultation_id: consultation_id.clone(),
-                            execution_binding: String::new(),
-                        },
-                        consultation: StoredIssuanceConsultationProvenance {
-                            consultation_id,
-                            acquired_at: format_time(acquired_at),
-                        },
-                    }),
-                )
-            }
-        };
+                } else {
+                    error
+                }
+            })?;
+            let acquired_at = result.acquired_at();
+            let consultation_id = result.consultation_id().to_string();
+            (
+                consultation_outputs,
+                Some(acquired_at),
+                BTreeSet::from([consultation_id.clone()]),
+                Some(ClaimIssuanceProvenanceInternal {
+                    claim: StoredIssuanceClaimProvenance {
+                        claim_id: claim.id.clone(),
+                        claim_version: claim.version.clone(),
+                        relay_profile_id: consultation.profile.id.clone(),
+                        relay_contract_hash: consultation.profile.contract_hash.clone(),
+                        canonical_purpose: ctx.purpose.clone(),
+                        consultation_id: consultation_id.clone(),
+                        execution_binding: String::new(),
+                        result_content_binding: String::new(),
+                    },
+                    consultation: StoredIssuanceConsultationProvenance {
+                        consultation_id,
+                        acquired_at: format_time(acquired_at),
+                    },
+                }),
+                relay_outcome == RuntimeRelayOutcome::Match,
+            )
+        }
+    };
     // Relay acquisition time pins the result to the consultation evidence.
     let issued_at = observed_at.unwrap_or(ctx.now);
     let value_result = match &claim.rule {
@@ -1890,6 +1948,20 @@ pub(super) async fn evaluate_claim_task(
             let value = get_json_path(record, output)
                 .cloned()
                 .ok_or(EvidenceError::RuleEvaluationFailed)?;
+            if relay_matched {
+                let ClaimEvidenceMode::RegistryBacked { consultations } = &claim.evidence_mode
+                else {
+                    return Err(EvidenceError::RuleEvaluationFailed);
+                };
+                if let Some(output_contract) = consultations
+                    .get(consultation)
+                    .and_then(|consultation| consultation.outputs.get(output))
+                {
+                    if !output_contract.validates_value(&value) {
+                        return Err(EvidenceError::RuleEvaluationFailed);
+                    }
+                }
+            }
             validate_claim_value_config(&value, &claim.value)?;
             Ok(value)
         }
diff --git a/crates/registry-notary-server/src/runtime/render.rs b/crates/registry-notary-server/src/runtime/render.rs
index 85583de105..6780607961 100644
--- a/crates/registry-notary-server/src/runtime/render.rs
+++ b/crates/registry-notary-server/src/runtime/render.rs
@@ -206,13 +206,14 @@ pub(crate) fn issuance_execution_binding(
     provenance: &ClaimProvenance,
 ) -> Result<String, EvidenceError> {
     sha256_canonical_json(&json!({
-        "schema": "registry.notary.issuance-execution-binding/v1",
+        "schema": "registry.notary.issuance-execution-binding/v2",
         "claim": {
             "id": claim.claim_id,
             "version": claim.claim_version,
             "relay_profile_id": claim.relay_profile_id,
             "relay_contract_hash": claim.relay_contract_hash,
             "canonical_purpose": claim.canonical_purpose,
+            "result_content_binding": claim.result_content_binding,
         },
         "execution": {
             "consultation_id": consultation.consultation_id,
@@ -226,6 +227,28 @@ pub(crate) fn issuance_execution_binding(
     }))
 }
 
+/// Commit the complete issuance-facing result without copying its value into
+/// restricted provenance. Canonical JSON makes object member order irrelevant
+/// while preserving every nested value, array position, disclosure decision,
+/// target handle, and public provenance field.
+pub(crate) fn issuance_result_content_binding(
+    result: &ClaimResultView,
+) -> Result<String, EvidenceError> {
+    sha256_canonical_json(&json!({
+        "schema": "registry.notary.issuance-result-content/v1",
+        "result": result,
+    }))
+}
+
+fn valid_sha256_binding(value: &str) -> bool {
+    value.strip_prefix("sha256:").is_some_and(|hex| {
+        hex.len() == 64
+            && hex
+                .bytes()
+                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+    })
+}
+
 fn expected_issuance_claim_provenance(
     evidence: &EvidenceConfig,
     evaluation: &registry_notary_core::StoredEvaluation,
@@ -262,10 +285,21 @@ pub(crate) fn require_issuable_evaluation_provenance(
     evaluation: &registry_notary_core::StoredEvaluation,
 ) -> Result<(), EvidenceError> {
     let selected = evaluation.selected_claim_refs();
+    let selected_ids = selected
+        .iter()
+        .map(|claim_ref| claim_ref.id.clone())
+        .collect::<Vec<_>>();
+    let result_ids = evaluation
+        .results
+        .iter()
+        .map(|result| result.claim_id.clone())
+        .collect::<Vec<_>>();
     if selected.is_empty()
         || selected.len() > MAX_CLAIM_DEPENDENCY_NODES_V1
         || evaluation.claim_ids.len() != selected.len()
         || evaluation.results.len() != selected.len()
+        || !crate::authz_details::exact_unique_string_set(&evaluation.claim_ids, &selected_ids)
+        || !crate::authz_details::exact_unique_string_set(&result_ids, &selected_ids)
     {
         return Err(EvidenceError::EvaluationBindingMismatch);
     }
@@ -289,15 +323,8 @@ pub(crate) fn require_issuable_evaluation_provenance(
         return Err(EvidenceError::EvaluationBindingMismatch);
     }
 
-    let mut selected_ids = BTreeSet::new();
-    let mut result_ids = BTreeSet::new();
     let mut private_claims = BTreeMap::new();
     let mut private_consultations = BTreeMap::new();
-    for result in &evaluation.results {
-        if !result_ids.insert(result.claim_id.as_str()) {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
-    }
     for provenance in &stored.claims {
         if private_claims
             .insert(provenance.claim_id.as_str(), provenance)
@@ -357,6 +384,7 @@ pub(crate) fn require_issuable_evaluation_provenance(
             || private.relay_profile_id != consultation.profile.id
             || private.relay_contract_hash != consultation.profile.contract_hash
             || private.canonical_purpose != evaluation.purpose
+            || !valid_sha256_binding(&private.result_content_binding)
         {
             return Err(EvidenceError::EvaluationBindingMismatch);
         }
@@ -397,12 +425,7 @@ pub(crate) fn require_issuable_evaluation_provenance(
         return Err(EvidenceError::EvaluationBindingMismatch);
     }
 
-    for (position, claim_ref) in selected.iter().enumerate() {
-        if evaluation.claim_ids[position] != claim_ref.id
-            || !selected_ids.insert(claim_ref.id.as_str())
-        {
-            return Err(EvidenceError::EvaluationBindingMismatch);
-        }
+    for claim_ref in &selected {
         let selected_claim = find_claim_for_selection(evidence, claim_ref, &versions)
             .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
         let root_private = private_claims
@@ -432,6 +455,29 @@ pub(crate) fn require_issuable_evaluation_provenance(
             .iter()
             .find(|result| result.claim_id == claim_ref.id)
             .ok_or(EvidenceError::EvaluationBindingMismatch)?;
+        if let RuleConfig::ConsultationOutput { output, .. } = &selected_claim.rule {
+            let ClaimEvidenceMode::RegistryBacked { consultations } = &selected_claim.evidence_mode
+            else {
+                return Err(EvidenceError::EvaluationBindingMismatch);
+            };
+            let output_contract = consultations
+                .first_key_value()
+                .filter(|_| consultations.len() == 1)
+                .and_then(|(_, consultation)| consultation.outputs.get(output))
+                .ok_or(EvidenceError::EvaluationBindingMismatch)?;
+            if matches!(
+                output_contract,
+                registry_notary_core::RelayOutputContract::Object { .. }
+                    | registry_notary_core::RelayOutputContract::Array { .. }
+            ) && (result
+                .value
+                .as_ref()
+                .is_none_or(|value| !output_contract.validates_value(value))
+                || !result.redacted_fields.is_empty())
+            {
+                return Err(EvidenceError::EvaluationBindingMismatch);
+            }
+        }
         let generated = &result.provenance.generated_by;
         let result_issued_at = OffsetDateTime::parse(&result.issued_at, &Rfc3339)
             .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
@@ -442,6 +488,7 @@ pub(crate) fn require_issuable_evaluation_provenance(
             &result.issued_at,
             &result.provenance,
         )?;
+        let result_content_binding = issuance_result_content_binding(result)?;
         if result.evaluation_id != evaluation_id
             || result.claim_version != selected_claim.version
             || result_issued_at != *root_acquired_at
@@ -454,6 +501,7 @@ pub(crate) fn require_issuable_evaluation_provenance(
             || generated.claim_id != claim_ref.id
             || generated.claim_version != selected_claim.version
             || result.provenance.used.relay_consultation_count != root_consultations.len()
+            || result_content_binding != root_private.result_content_binding
             || result_binding != root_private.execution_binding
         {
             return Err(EvidenceError::EvaluationBindingMismatch);
@@ -469,7 +517,7 @@ pub fn format_time(value: OffsetDateTime) -> String {
         .expect("OffsetDateTime within supported RFC3339 range")
 }
 
-pub(super) fn target_ref_view(
+pub(crate) fn target_ref_view(
     subject_access_rate_keys: &SubjectAccessRateLimitKeys,
     target: &EvidenceEntity,
 ) -> Result<TargetRefView, EvidenceError> {
@@ -482,6 +530,37 @@ pub(super) fn target_ref_view(
     })
 }
 
+/// Commit the complete opaque target reference together with the canonical
+/// identity used by authorization details. `id` is reserved for the
+/// top-level `EvidenceEntity.id`; identifier schemes must use their real
+/// scheme names so the two representations cannot alias.
+pub(crate) fn issuance_authorization_target_binding(
+    subject_access_rate_keys: &SubjectAccessRateLimitKeys,
+    target_ref: &TargetRefView,
+    id_type: &str,
+    id: &str,
+) -> Result<String, EvidenceError> {
+    if id_type.trim().is_empty() || id.trim().is_empty() {
+        return Err(EvidenceError::EvaluationBindingMismatch);
+    }
+    let canonical_input = serde_json::to_string(&json!({
+        "schema": "registry.notary.private-issuance-authorization-target/v1",
+        "target_ref": target_ref,
+        "primary_identity": {
+            "id_type": id_type,
+            "id": id,
+        },
+    }))
+    .map_err(|_| EvidenceError::EvaluationBindingMismatch)?;
+    subject_access_rate_keys
+        .audit_pseudonym_ref(
+            "oid4vci-issuance-authorization-target-binding-v1",
+            &canonical_input,
+        )
+        .map(|binding| binding.as_str().to_string())
+        .map_err(|error| error.evidence_error())
+}
+
 pub(super) fn entity_ref_view(
     subject_access_rate_keys: &SubjectAccessRateLimitKeys,
     role: &str,
diff --git a/crates/registry-notary-server/src/runtime/tests/cel.rs b/crates/registry-notary-server/src/runtime/tests/cel.rs
index e2c128aca5..be3e12e2cd 100644
--- a/crates/registry-notary-server/src/runtime/tests/cel.rs
+++ b/crates/registry-notary-server/src/runtime/tests/cel.rs
@@ -162,16 +162,134 @@ fn cel_policy_validation_rejects_invalid_alias_and_unlisted_dependency() {
     ));
 }
 
+#[cfg(feature = "registry-notary-cel")]
+#[test]
+fn cel_reference_scanners_ignore_literal_and_comment_decoys() {
+    for literal in [
+        "'enrollment.parents'",
+        "\"enrollment.parents\"",
+        "'''enrollment.parents'''",
+        r###""""enrollment.parents "" decoy""""###,
+        r"r'enrollment.parents \x'",
+        "r\"enrollment.parents ' decoy\"",
+        "r'''enrollment.parents ' decoy'''",
+        r###"r"""enrollment.parents " decoy""""###,
+        "b'enrollment.parents'",
+        "br'''enrollment.parents ' decoy'''",
+        r###"br"""enrollment.parents " decoy""""###,
+    ] {
+        let expression = format!("{literal} == {literal} && enrollment.matched");
+        assert_eq!(
+            cel_first_level_member_references(&expression, "enrollment"),
+            BTreeSet::from(["matched".to_string()]),
+            "first-level scanner must ignore decoys in {literal}"
+        );
+        assert_eq!(
+            cel_root_references(&expression),
+            BTreeSet::from(["enrollment".to_string()]),
+            "root scanner must ignore decoys in {literal}"
+        );
+        assert!(
+            !contains_unquoted_bracket(&format!("{literal} == {literal}")),
+            "bracket scanner must ignore brackets in {literal}"
+        );
+    }
+
+    let after_raw_triple =
+        r#"r"""embedded " quote""" != "x" || enrollment.parents.size() > 0"#;
+    assert!(
+        cel_first_level_member_references(after_raw_triple, "enrollment").contains("parents"),
+        "raw triple literals with embedded quotes must not hide later composite references"
+    );
+    let after_triple = r#""""embedded " quote""" != "x" || enrollment.parents.size() > 0"#;
+    assert!(
+        cel_first_level_member_references(after_triple, "enrollment").contains("parents"),
+        "triple literals with embedded quotes must not hide later composite references"
+    );
+    let comment_separated = "enrollment // hidden trivia\n . parents.size() > 0";
+    assert!(
+        cel_first_level_member_references(comment_separated, "enrollment").contains("parents"),
+        "line comments between root, dot, and member are trivia"
+    );
+    assert_eq!(
+        registry_cel_required_variables(
+            "r'''as_of_date''' == 'x' || as_of_date < ctx.today",
+            ["as_of_date"]
+        ),
+        BTreeSet::from(["as_of_date".to_string()]),
+        "bare identifier scanner must ignore raw string decoys"
+    );
+    assert!(
+        contains_unquoted_bracket("r'''[not real]''' == 'x' || enrollment[0]"),
+        "bracket scanner must ignore literal brackets and catch real brackets"
+    );
+    let separated_by_punctuation = "(enrollment).date_of_birth";
+    let preview = MappingRuntime::new(RuntimeOptions::default()).preview_cel_expression_with_input(
+        separated_by_punctuation,
+        StandaloneExpressionInput::new(
+            BTreeMap::from([(
+                "enrollment".to_string(),
+                json!({ "date_of_birth": "2000-01-01" }),
+            )])
+            .into_iter()
+            .collect(),
+        ),
+    );
+    assert!(
+        !preview
+            .issues
+            .iter()
+            .any(|issue| issue.severity == ErrorSeverity::Error),
+        "control expression must compile as CEL"
+    );
+    assert!(
+        !cel_first_level_member_references(separated_by_punctuation, "enrollment")
+            .contains("date_of_birth"),
+        "punctuation must prevent synthetic root.member matches"
+    );
+}
+
 #[cfg(feature = "registry-notary-cel")]
 #[test]
 fn registry_cel_startup_is_limited_to_one_output_root_and_declared_variables() {
     let mut claim = typed_registry_claim(
-            "age-band",
-            RuleConfig::Cel {
-                expression: "enrollment.matched && enrollment.date_of_birth != null ? date.age_on(enrollment.date_of_birth, as_of_date) : null".to_string(),
-                bindings: Default::default(),
+        "age-band",
+        RuleConfig::Cel {
+            expression: "enrollment.matched && enrollment.date_of_birth != null ? date.age_on(enrollment.date_of_birth, as_of_date) : null".to_string(),
+            bindings: Default::default(),
+        },
+        "integer",
+    );
+    let ClaimEvidenceMode::RegistryBacked { consultations } = &mut claim.evidence_mode else {
+        panic!("registry-backed claim");
+    };
+    consultations
+        .get_mut("enrollment")
+        .expect("consultation exists")
+        .outputs
+        .insert(
+            "parents".to_string(),
+            registry_notary_core::RelayOutputContract::Array {
+                nullable: false,
+                max_bytes: 4_096,
+                max_items: 4,
+                items: Box::new(registry_notary_core::RelayOutputContract::Object {
+                    nullable: false,
+                    max_bytes: 1_024,
+                    fields: BTreeMap::from([(
+                        "name".to_string(),
+                        registry_notary_core::RelayOutputObjectFieldContract {
+                            required: true,
+                            schema: Box::new(
+                                registry_notary_core::RelayOutputContract::String {
+                                    nullable: false,
+                                    max_bytes: 128,
+                                },
+                            ),
+                        },
+                    )]),
+                }),
             },
-            "integer",
         );
     let mut evidence = EvidenceConfig {
         enabled: true,
@@ -188,6 +306,44 @@ fn registry_cel_startup_is_limited_to_one_output_root_and_declared_variables() {
     );
     validate_cel_claims_for_startup(&evidence, &RegistryNotaryCelConfig::default())
         .expect("OpenCRVS-style full-date derivation preflights");
+    let projected = registry_cel_scalar_consultation_outputs(
+        &claim,
+        &BTreeMap::from([(
+            "enrollment".to_string(),
+            json!({
+                "matched": true,
+                "outcome": "match",
+                "date_of_birth": "2000-01-01",
+                "parents": [{"name": "Ada"}]
+            }),
+        )]),
+    )
+    .expect("scalar CEL view projects");
+    assert_eq!(projected["enrollment"]["date_of_birth"], "2000-01-01");
+    assert!(
+        projected["enrollment"].get("parents").is_none(),
+        "composite outputs never enter the CEL binding surface"
+    );
+
+    for expression in [
+        "enrollment.matched && 'enrollment.parents' == 'enrollment.parents' ? 1 : 0",
+        "enrollment.matched && \"enrollment.parents\" == \"enrollment.parents\" ? 1 : 0",
+        "enrollment.matched && '''enrollment.parents''' == '''enrollment.parents''' ? 1 : 0",
+        r#"enrollment.matched && """enrollment.parents""" == """enrollment.parents""" ? 1 : 0"#,
+        r"enrollment.matched && r'enrollment.parents \x' == r'enrollment.parents \x' ? 1 : 0",
+        "enrollment.matched && r\"enrollment.parents ' decoy\" == r\"enrollment.parents ' decoy\" ? 1 : 0",
+        "enrollment.matched && b'enrollment.parents' == b'enrollment.parents' ? 1 : 0",
+    ] {
+        claim.rule = RuleConfig::Cel {
+            expression: expression.to_string(),
+            bindings: Default::default(),
+        };
+        evidence.claims[0] = claim.clone();
+        validate_cel_claims_for_startup(&evidence, &RegistryNotaryCelConfig::default())
+            .unwrap_or_else(|error| {
+                panic!("literal decoy references must not trip registry CEL validation: {expression}: {error:?}")
+            });
+    }
 
     for expression in [
         "caller.scopes.contains('admin')",
@@ -197,8 +353,14 @@ fn registry_cel_startup_is_limited_to_one_output_root_and_declared_variables() {
         "disclosure == 'value'",
         "consultation == 'other-profile'",
         "enrollment.secret == 'x'",
+        "enrollment.parents.size() > 0",
         "enrollment['date_of_birth'] != null",
         "date.age_on(enrollment.date_of_birth, as_of_date)",
+        r#""""embedded " quote""" != "x" || enrollment.parents.size() > 0 ? 1 : 0"#,
+        r#"r"""embedded " quote""" != "x" || enrollment.parents.size() > 0 ? 1 : 0"#,
+        "'''embedded ' quote''' != \"x\" || enrollment.parents.size() > 0 ? 1 : 0",
+        "r'''embedded ' quote''' != \"x\" || enrollment.parents.size() > 0 ? 1 : 0",
+        "enrollment // comment hides trivia\n . parents.size() > 0 ? 1 : 0",
     ] {
         claim.rule = RuleConfig::Cel {
             expression: expression.to_string(),
diff --git a/crates/registry-notary-server/src/runtime/tests/render.rs b/crates/registry-notary-server/src/runtime/tests/render.rs
index d01da91e4b..1d8096ce15 100644
--- a/crates/registry-notary-server/src/runtime/tests/render.rs
+++ b/crates/registry-notary-server/src/runtime/tests/render.rs
@@ -1,5 +1,44 @@
 // SPDX-License-Identifier: Apache-2.0
 
+    #[test]
+    fn top_level_target_id_uses_reserved_authorization_id_type() {
+        let keys = SubjectAccessRateLimitKeys::new(AuditKeyHasher::unkeyed_dev_only());
+        let mut target = EvidenceEntity::new("Person");
+        target.id = Some("registry-person-42".to_string());
+        target
+            .attributes
+            .insert("region".to_string(), json!("central"));
+        let target_ref = target_ref_view(&keys, &target).expect("target reference hashes");
+        let evaluated = issuance_authorization_target_binding(
+            &keys,
+            &target_ref,
+            "id",
+            "registry-person-42",
+        )
+        .expect("top-level id binding hashes");
+        assert_eq!(
+            evaluated,
+            issuance_authorization_target_binding(
+                &keys,
+                &target_ref,
+                "id",
+                "registry-person-42",
+            )
+            .expect("matching RAR binding hashes"),
+        );
+        assert_ne!(
+            evaluated,
+            issuance_authorization_target_binding(
+                &keys,
+                &target_ref,
+                "national_id",
+                "registry-person-42",
+            )
+            .expect("wrong-scheme comparison hashes"),
+            "top-level target.id cannot alias a named identifier scheme",
+        );
+    }
+
     #[test]
     fn render_cccev_uses_result_claim_version_for_requirement() {
         let mut older_claim = test_claim("selected", Vec::new(), true);
@@ -273,6 +312,12 @@ profile_b:
         let mut claim = test_claim("registry-fact", Vec::new(), false);
         claim.version = "1".to_string();
         claim.purpose = Some("credential-purpose".to_string());
+        claim.value = registry_notary_core::ClaimValueConfig {
+            value_type: "object".to_string(),
+            nullable: true,
+            max_bytes: None,
+            unit: None,
+        };
         claim.evidence_mode = ClaimEvidenceMode::RegistryBacked {
             consultations: BTreeMap::from([(
                 "registry".to_string(),
@@ -288,14 +333,63 @@ profile_b:
                         RelayConsultationInput::TargetId,
                     )]),
                     outputs: BTreeMap::from([(
-                        "active".to_string(),
-                        registry_notary_core::RelayOutputContract::Boolean { nullable: false },
+                        "record".to_string(),
+                        registry_notary_core::RelayOutputContract::Object {
+                            nullable: false,
+                            max_bytes: 4_096,
+                            fields: BTreeMap::from([
+                                (
+                                    "name".to_string(),
+                                    registry_notary_core::RelayOutputObjectFieldContract {
+                                        required: true,
+                                        schema: Box::new(
+                                            registry_notary_core::RelayOutputContract::String {
+                                                nullable: false,
+                                                max_bytes: 128,
+                                            },
+                                        ),
+                                    },
+                                ),
+                                (
+                                    "parents".to_string(),
+                                    registry_notary_core::RelayOutputObjectFieldContract {
+                                        required: true,
+                                        schema: Box::new(
+                                            registry_notary_core::RelayOutputContract::Array {
+                                                nullable: false,
+                                                max_bytes: 2_048,
+                                                max_items: 4,
+                                                items: Box::new(
+                                                    registry_notary_core::RelayOutputContract::Object {
+                                                        nullable: false,
+                                                        max_bytes: 512,
+                                                        fields: BTreeMap::from([(
+                                                            "name".to_string(),
+                                                            registry_notary_core::RelayOutputObjectFieldContract {
+                                                                required: true,
+                                                                schema: Box::new(
+                                                                    registry_notary_core::RelayOutputContract::String {
+                                                                        nullable: false,
+                                                                        max_bytes: 128,
+                                                                    },
+                                                                ),
+                                                            },
+                                                        )]),
+                                                    },
+                                                ),
+                                            },
+                                        ),
+                                    },
+                                ),
+                            ]),
+                        },
                     )]),
                 },
             )]),
         };
-        claim.rule = RuleConfig::ConsultationMatched {
+        claim.rule = RuleConfig::ConsultationOutput {
             consultation: "registry".to_string(),
+            output: "record".to_string(),
         };
         let evidence = test_evidence(vec![claim]);
         let evaluation_id = "01J00000000000000000000001";
@@ -312,9 +406,15 @@ profile_b:
                 identifier_schemes: Vec::new(),
                 profile: None,
             },
-            value: Some(json!(true)),
-            satisfied: Some(true),
-            disclosure: "predicate".to_string(),
+            value: Some(json!({
+                "name": "Ada",
+                "parents": [
+                    { "name": "Grace" },
+                    { "name": "Charles" }
+                ]
+            })),
+            satisfied: None,
+            disclosure: "value".to_string(),
             redacted_fields: Vec::new(),
             format: FORMAT_CLAIM_RESULT_JSON.to_string(),
             issued_at: issued_at.to_string(),
@@ -334,7 +434,7 @@ profile_b:
             purpose: "credential-purpose".to_string(),
             claim_ids: vec!["registry-fact".to_string()],
             claim_refs: vec![ClaimRef::with_version("registry-fact", "1")],
-            disclosure: "predicate".to_string(),
+            disclosure: "value".to_string(),
             format: FORMAT_CLAIM_RESULT_JSON.to_string(),
             results: vec![result],
             created_at: issued_at.to_string(),
@@ -351,18 +451,23 @@ profile_b:
                     canonical_purpose: "credential-purpose".to_string(),
                     consultation_id: "01J00000000000000000000000".to_string(),
                     execution_binding: String::new(),
+                    result_content_binding: String::new(),
                 }],
                 consultations: vec![StoredIssuanceConsultationProvenance {
                     consultation_id: "01J00000000000000000000000".to_string(),
                     acquired_at: issued_at.to_string(),
                 }],
+                authorization_target_binding: String::new(),
             }),
             subject_access: None,
         };
+        let result_content_binding = issuance_result_content_binding(&evaluation.results[0])
+            .expect("result content binding hashes");
         let issuance = evaluation
             .issuance_provenance
             .as_mut()
             .expect("private issuance provenance exists");
+        issuance.claims[0].result_content_binding = result_content_binding;
         issuance.claims[0].execution_binding = issuance_execution_binding(
             &issuance.claims[0],
             &issuance.consultations[0],
@@ -468,6 +573,10 @@ profile_b:
         tampered.results[0].provenance.used.relay_consultation_count = 0;
         assert_not_issuable(&evidence, &tampered);
 
+        let mut tampered = evaluation.clone();
+        tampered.results[0].value.as_mut().unwrap()["parents"][0]["name"] = json!("Mallory");
+        assert_not_issuable(&evidence, &tampered);
+
         let mut tampered = evaluation.clone();
         let duplicate = tampered
             .issuance_provenance
@@ -504,3 +613,24 @@ profile_b:
         );
         assert_not_issuable(&source_free, &evaluation);
     }
+
+    #[test]
+    fn structured_claim_values_are_absent_from_result_and_stored_evaluation_debug() {
+        let (_, evaluation) = issuable_registry_evaluation();
+        let result_debug = format!("{:?}", evaluation.results[0]);
+        let evaluation_debug = format!("{evaluation:?}");
+
+        for secret in ["Ada", "Grace", "Charles", "Mallory"] {
+            assert!(
+                !result_debug.contains(secret),
+                "claim-result Debug must not expose structured value member {secret}"
+            );
+            assert!(
+                !evaluation_debug.contains(secret),
+                "stored-evaluation Debug must not expose structured value member {secret}"
+            );
+        }
+        assert!(result_debug.contains("value: \"[REDACTED]\""));
+        assert!(evaluation_debug.contains("result_count: 1"));
+        assert!(!evaluation_debug.contains("request-hash"));
+    }
diff --git a/crates/registry-notary-server/src/standalone/auth/mod.rs b/crates/registry-notary-server/src/standalone/auth/mod.rs
index b6604f8770..d0354862cd 100644
--- a/crates/registry-notary-server/src/standalone/auth/mod.rs
+++ b/crates/registry-notary-server/src/standalone/auth/mod.rs
@@ -43,6 +43,8 @@ pub(super) struct OidcAuthenticator {
     assurance_claim_source: SubjectAccessAssuranceClaimSource,
     userinfo_endpoint: Option<String>,
     userinfo_issuers: Vec<String>,
+    citizen_client_ids: Vec<String>,
+    citizen_audiences: Vec<String>,
     /// Second, separately-keyed trust anchor for the Notary's own issuer
     /// (the pre-authorized-code access tokens). `None` unless self-issuance
     /// is enabled. The unverified issuer is used only to select this verifier;
@@ -233,6 +235,22 @@ impl OidcAuthenticator {
             .enabled
             .then(|| config.subject_access.subject_binding.token_claim.clone())
             .filter(|claim| !claim.is_empty());
+        let (citizen_client_ids, citizen_audiences) = if config.subject_access.enabled {
+            (
+                config
+                    .subject_access
+                    .citizen_clients
+                    .allowed_client_ids
+                    .clone(),
+                config
+                    .subject_access
+                    .citizen_clients
+                    .allowed_audiences
+                    .clone(),
+            )
+        } else {
+            (Vec::new(), Vec::new())
+        };
         let notary_anchor = Authenticator::build_notary_anchor(
             config,
             oidc.principal_claim.clone(),
@@ -247,6 +265,8 @@ impl OidcAuthenticator {
             assurance_claim_source: config.subject_access.token_policy.assurance_claim_source,
             userinfo_endpoint: oidc.userinfo_endpoint.clone(),
             userinfo_issuers,
+            citizen_client_ids,
+            citizen_audiences,
             notary_anchor,
         })
     }
@@ -281,6 +301,8 @@ impl OidcAuthenticator {
             self.assurance_claim_source,
             self.userinfo_endpoint.as_deref(),
             &self.userinfo_issuers,
+            &self.citizen_client_ids,
+            &self.citizen_audiences,
         )
         .await
     }
diff --git a/crates/registry-notary-server/src/standalone/auth/oidc.rs b/crates/registry-notary-server/src/standalone/auth/oidc.rs
index 937a4b4113..709f6a033a 100644
--- a/crates/registry-notary-server/src/standalone/auth/oidc.rs
+++ b/crates/registry-notary-server/src/standalone/auth/oidc.rs
@@ -11,11 +11,21 @@ pub(in super::super) async fn authenticate_oidc(
     assurance_claim_source: SubjectAccessAssuranceClaimSource,
     userinfo_endpoint: Option<&str>,
     userinfo_issuers: &[String],
+    citizen_client_ids: &[String],
+    citizen_audiences: &[String],
 ) -> Result<EvidencePrincipal, EvidenceError> {
     let Some(token) = credentials.bearer_token.as_deref() else {
         return Err(EvidenceError::MissingCredential);
     };
     let verified = verifier.verify(token).await.map_err(oidc_auth_error)?;
+    if !oidc_citizen_candidate(&verified, citizen_client_ids, citizen_audiences) {
+        return principal_from_machine_oidc(
+            &verified,
+            EvidenceAuthProfileId::ExternalOidc,
+            token_type_from_compact_jwt(token),
+            principal_claim,
+        );
+    }
     let verified_userinfo = match (subject_binding_claim, subject_binding_claim_source) {
         (Some(_), SubjectAccessClaimSource::Userinfo) => {
             let endpoint = userinfo_endpoint.ok_or(EvidenceError::MissingCredential)?;
@@ -68,16 +78,12 @@ pub(in super::super) async fn authenticate_oidc(
             Some(id_token)
         }
     };
-    let token_type = jsonwebtoken::decode_header(token)
-        .ok()
-        .and_then(|header| header.typ)
-        .and_then(|typ| verified_claim_value(&typ));
     principal_from_oidc(
         &verified,
         EvidenceAuthProfileId::ExternalOidc,
         verified_userinfo.as_ref(),
         verified_id_token.as_ref(),
-        token_type,
+        token_type_from_compact_jwt(token),
         principal_claim,
         subject_binding_claim,
         subject_binding_claim_source,
@@ -85,6 +91,39 @@ pub(in super::super) async fn authenticate_oidc(
     )
 }
 
+fn token_type_from_compact_jwt(token: &str) -> Option<VerifiedClaimValue> {
+    jsonwebtoken::decode_header(token)
+        .ok()
+        .and_then(|header| header.typ)
+        .and_then(|typ| verified_claim_value(&typ))
+}
+
+pub(in super::super) fn oidc_citizen_candidate(
+    verified: &VerifiedToken,
+    citizen_client_ids: &[String],
+    citizen_audiences: &[String],
+) -> bool {
+    let client_matches = [
+        verified.claims.azp.as_deref(),
+        verified.claims.client_id.as_deref(),
+    ]
+    .into_iter()
+    .flatten()
+    .any(|candidate| {
+        citizen_client_ids
+            .iter()
+            .any(|allowed| candidate == allowed)
+    });
+    let audience_matches = match verified.claims.aud.as_ref() {
+        Some(Audience::One(audience)) => citizen_audiences.contains(audience),
+        Some(Audience::Many(audiences)) => audiences
+            .iter()
+            .any(|audience| citizen_audiences.contains(audience)),
+        None => false,
+    };
+    client_matches || audience_matches
+}
+
 /// Read the `iss` claim from a JWT WITHOUT verifying the signature. Used only to
 /// ROUTE to the correct verifier; the value is never trusted before the chosen
 /// anchor fully verifies the token (signature, alg, typ, iss, aud, exp/nbf).
@@ -99,6 +138,50 @@ pub(in super::super) fn principal_from_oidc(
     subject_binding_claim: Option<&str>,
     subject_binding_claim_source: SubjectAccessClaimSource,
     assurance_claim_source: SubjectAccessAssuranceClaimSource,
+) -> Result<EvidencePrincipal, EvidenceError> {
+    principal_from_oidc_inner(
+        verified,
+        auth_profile_id,
+        userinfo,
+        id_token,
+        token_type,
+        principal_claim,
+        subject_binding_claim,
+        subject_binding_claim_source,
+        Some(assurance_claim_source),
+    )
+}
+
+pub(in super::super) fn principal_from_machine_oidc(
+    verified: &VerifiedToken,
+    auth_profile_id: EvidenceAuthProfileId,
+    token_type: Option<VerifiedClaimValue>,
+    principal_claim: &str,
+) -> Result<EvidencePrincipal, EvidenceError> {
+    principal_from_oidc_inner(
+        verified,
+        auth_profile_id,
+        None,
+        None,
+        token_type,
+        principal_claim,
+        None,
+        SubjectAccessClaimSource::AccessToken,
+        None,
+    )
+}
+
+#[allow(clippy::too_many_arguments)]
+fn principal_from_oidc_inner(
+    verified: &VerifiedToken,
+    auth_profile_id: EvidenceAuthProfileId,
+    userinfo: Option<&registry_platform_oidc::Claims>,
+    id_token: Option<&VerifiedToken>,
+    token_type: Option<VerifiedClaimValue>,
+    principal_claim: &str,
+    subject_binding_claim: Option<&str>,
+    subject_binding_claim_source: SubjectAccessClaimSource,
+    assurance_claim_source: Option<SubjectAccessAssuranceClaimSource>,
 ) -> Result<EvidencePrincipal, EvidenceError> {
     let principal_id = if principal_claim == "sub" {
         verified.claims.sub.clone()
@@ -117,7 +200,7 @@ pub(in super::super) fn principal_from_oidc(
         principal_id,
         scopes: verified.scopes.clone(),
         access_mode: AccessMode::MachineClient,
-        verified_claims: bounded_verified_claims_from_oidc(
+        verified_claims: bounded_verified_claims_from_oidc_inner(
             verified,
             userinfo,
             id_token,
@@ -140,6 +223,7 @@ pub(in super::super) fn authorization_details_from_oidc(
     Ok(details.filter(crate::authz_details::has_transaction_scope))
 }
 
+#[cfg(test)]
 pub(in super::super) fn bounded_verified_claims_from_oidc(
     verified: &VerifiedToken,
     userinfo: Option<&registry_platform_oidc::Claims>,
@@ -148,6 +232,27 @@ pub(in super::super) fn bounded_verified_claims_from_oidc(
     subject_binding_claim: Option<&str>,
     subject_binding_claim_source: SubjectAccessClaimSource,
     assurance_claim_source: SubjectAccessAssuranceClaimSource,
+) -> Option<BoundedVerifiedClaims> {
+    bounded_verified_claims_from_oidc_inner(
+        verified,
+        userinfo,
+        id_token,
+        token_type,
+        subject_binding_claim,
+        subject_binding_claim_source,
+        Some(assurance_claim_source),
+    )
+}
+
+#[allow(clippy::too_many_arguments)]
+fn bounded_verified_claims_from_oidc_inner(
+    verified: &VerifiedToken,
+    userinfo: Option<&registry_platform_oidc::Claims>,
+    id_token: Option<&VerifiedToken>,
+    token_type: Option<VerifiedClaimValue>,
+    subject_binding_claim: Option<&str>,
+    subject_binding_claim_source: SubjectAccessClaimSource,
+    assurance_claim_source: Option<SubjectAccessAssuranceClaimSource>,
 ) -> Option<BoundedVerifiedClaims> {
     let issuer = verified
         .claims
@@ -170,8 +275,9 @@ pub(in super::super) fn bounded_verified_claims_from_oidc(
         (None, None)
     };
     let assurance_claims = match assurance_claim_source {
-        SubjectAccessAssuranceClaimSource::AccessToken => &verified.claims,
-        SubjectAccessAssuranceClaimSource::IdToken => &id_token?.claims,
+        Some(SubjectAccessAssuranceClaimSource::AccessToken) => Some(&verified.claims),
+        Some(SubjectAccessAssuranceClaimSource::IdToken) => Some(&id_token?.claims),
+        None => None,
     };
     Some(BoundedVerifiedClaims {
         issuer,
@@ -205,11 +311,10 @@ pub(in super::super) fn bounded_verified_claims_from_oidc(
         subject_binding_claim,
         subject_binding_value,
         acr: assurance_claims
-            .extra
-            .get("acr")
+            .and_then(|claims| claims.extra.get("acr"))
             .and_then(Value::as_str)
             .and_then(verified_claim_value),
-        auth_time: numeric_claim(&assurance_claims.extra, "auth_time"),
+        auth_time: assurance_claims.and_then(|claims| numeric_claim(&claims.extra, "auth_time")),
         exp: verified.claims.exp,
         iat: verified.claims.iat,
         nbf: verified.claims.nbf,
diff --git a/crates/registry-notary-server/src/standalone/preauth.rs b/crates/registry-notary-server/src/standalone/preauth.rs
index 54b8114ea9..028bd2d21e 100644
--- a/crates/registry-notary-server/src/standalone/preauth.rs
+++ b/crates/registry-notary-server/src/standalone/preauth.rs
@@ -333,6 +333,15 @@ impl PreAuthRuntime {
         }
     }
 
+    #[cfg(test)]
+    pub(crate) fn with_access_token_signer_for_tests(
+        mut self,
+        signer: Arc<dyn SigningProvider>,
+    ) -> Self {
+        self.access_token_signer = signer;
+        self
+    }
+
     /// Emit a hashed pre-auth audit event. Returns an error if emission fails so
     /// callers fail closed rather than silently dropping the audit trail.
     pub(crate) async fn emit_audit(&self, event: &EvidenceAuditEvent) -> Result<(), AuditError> {
diff --git a/crates/registry-notary-server/src/standalone/tests/auth.inc b/crates/registry-notary-server/src/standalone/tests/auth.inc
index 0a68b6c533..721af00036 100644
--- a/crates/registry-notary-server/src/standalone/tests/auth.inc
+++ b/crates/registry-notary-server/src/standalone/tests/auth.inc
@@ -212,6 +212,22 @@
             "server.openapi_requires_auth only affects /openapi.json"
         );
     }
+
+    #[test]
+    fn registrar_offer_creation_is_not_auth_exempt() {
+        for openapi_requires_auth in [true, false] {
+            assert!(
+                !is_auth_exempt_path(
+                    "/oid4vci/offers",
+                    AuthExemptionPolicy {
+                        openapi_requires_auth,
+                    },
+                ),
+                "registrar offer creation must always pass through authentication middleware"
+            );
+        }
+    }
+
     #[tokio::test]
     async fn invalid_bearer_tokens_are_rate_limited_when_subject_access_is_enabled() {
         let rate_limits = SubjectAccessRateLimitsConfig {
@@ -592,6 +608,224 @@
         }
     }
 
+    #[test]
+    fn oidc_citizen_candidate_uses_any_configured_client_or_audience_signal() {
+        let citizen_client_ids = vec!["citizen-client".to_string()];
+        let citizen_audiences = vec!["citizen-portal".to_string()];
+        let mut machine = verified_token_with_extra(Map::new());
+        machine.claims.azp = Some("registrar-client".to_string());
+        machine.claims.client_id = Some("registrar-client".to_string());
+        machine.claims.aud = Some(Audience::One(
+            "https://notary.example.invalid".to_string(),
+        ));
+        machine.matched_client = Some("azp:registrar-client".to_string());
+
+        assert!(!oidc_citizen_candidate(
+            &machine,
+            &citizen_client_ids,
+            &citizen_audiences,
+        ));
+
+        let mut citizen_client_with_resource_audience = machine.clone();
+        citizen_client_with_resource_audience.claims.azp = Some("citizen-client".to_string());
+        citizen_client_with_resource_audience.matched_client =
+            Some("azp:citizen-client".to_string());
+        assert!(oidc_citizen_candidate(
+            &citizen_client_with_resource_audience,
+            &citizen_client_ids,
+            &citizen_audiences,
+        ));
+
+        let mut registrar_client_with_citizen_audience = machine.clone();
+        registrar_client_with_citizen_audience.claims.aud =
+            Some(Audience::One("citizen-portal".to_string()));
+        assert!(oidc_citizen_candidate(
+            &registrar_client_with_citizen_audience,
+            &citizen_client_ids,
+            &citizen_audiences,
+        ));
+
+        let mut mixed_clients = machine;
+        mixed_clients.claims.client_id = Some("citizen-client".to_string());
+        assert!(
+            oidc_citizen_candidate(
+                &mixed_clients,
+                &citizen_client_ids,
+                &citizen_audiences,
+            ),
+            "any citizen identity signal must select the subject-bound authentication path"
+        );
+    }
+
+    #[tokio::test]
+    async fn signed_registrar_oidc_token_authenticates_without_citizen_credentials() {
+        let idp = registry_platform_testing::MockIdp::start().await;
+        let notary_audience = "https://notary.example.invalid";
+        let citizen_client = "citizen-client";
+        let registrar_client = "registrar-client";
+        let verifier = TokenVerifier::new(
+            TokenVerifierConfig::registry_notary_access_profile(
+                idp.issuer(),
+                vec![citizen_client.to_string(), notary_audience.to_string()],
+                vec![Algorithm::EdDSA],
+                vec!["JWT".to_string()],
+            )
+            .with_allowed_clients(vec![
+                citizen_client.to_string(),
+                registrar_client.to_string(),
+            ]),
+            Arc::new(JwksFetcher::new_with_fetch_url_policy(
+                idp.jwks_uri(),
+                JwksFetcherConfig::defaults(),
+                FetchUrlPolicy::dev(),
+            )),
+        );
+        let machine_token = idp.mint_token(json!({
+            "aud": notary_audience,
+            "sub": "opencrvs-machine-1",
+            "azp": registrar_client,
+            "client_id": registrar_client,
+            "scope": "registry_notary:credential_offer_create birth_certificate",
+            "authorization_details": [{
+                "type": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE,
+                "schema_version": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION,
+                "actions": ["create_credential_offer"],
+                "locations": [notary_audience]
+            }]
+        }));
+        let machine_credentials = RequestCredentials {
+            authorization_present: true,
+            bearer_token: Some(machine_token),
+            ..RequestCredentials::default()
+        };
+
+        let principal = authenticate_oidc(
+            &machine_credentials,
+            &verifier,
+            &FetchUrlPolicy::dev(),
+            "sub",
+            Some("civil_id"),
+            SubjectAccessClaimSource::Userinfo,
+            SubjectAccessAssuranceClaimSource::IdToken,
+            None,
+            &[idp.issuer()],
+            &[citizen_client.to_string()],
+            &[citizen_client.to_string()],
+        )
+        .await
+        .expect("signed registrar access token needs neither userinfo nor an ID token");
+        assert_eq!(principal.principal_id, "opencrvs-machine-1");
+        assert_eq!(principal.access_mode(), AccessMode::MachineClient);
+        assert_eq!(
+            principal
+                .authorization_details
+                .as_ref()
+                .and_then(|details| details.actions.first())
+                .map(String::as_str),
+            Some("create_credential_offer")
+        );
+
+        let cross_pair_token = idp.mint_token(json!({
+            "aud": citizen_client,
+            "sub": "opencrvs-machine-1",
+            "azp": registrar_client,
+            "client_id": registrar_client,
+            "scope": "registry_notary:credential_offer_create birth_certificate"
+        }));
+        let cross_pair_credentials = RequestCredentials {
+            authorization_present: true,
+            bearer_token: Some(cross_pair_token),
+            ..RequestCredentials::default()
+        };
+        assert!(matches!(
+            authenticate_oidc(
+                &cross_pair_credentials,
+                &verifier,
+                &FetchUrlPolicy::dev(),
+                "sub",
+                Some("civil_id"),
+                SubjectAccessClaimSource::Userinfo,
+                SubjectAccessAssuranceClaimSource::IdToken,
+                None,
+                &[idp.issuer()],
+                &[citizen_client.to_string()],
+                &[citizen_client.to_string()],
+            )
+            .await,
+            Err(EvidenceError::MissingCredential)
+        ));
+
+        idp.stop().await;
+    }
+
+    #[test]
+    fn oidc_machine_principal_needs_no_userinfo_or_id_token_assurance() {
+        let mut extra = Map::new();
+        extra.insert("acr".to_string(), json!("untrusted-machine-acr"));
+        extra.insert("auth_time".to_string(), json!(1_700_000_000_i64));
+        extra.insert(
+            "authorization_details".to_string(),
+            json!([{
+                "type": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_TYPE,
+                "schema_version": registry_notary_core::tokens::NOTARY_AUTHORIZATION_DETAILS_SCHEMA_VERSION,
+                "actions": ["create_credential_offer"],
+                "locations": ["https://notary.example.invalid"]
+            }]),
+        );
+        let mut verified = verified_token_with_extra(extra);
+        verified.claims.azp = Some("registrar-client".to_string());
+        verified.claims.client_id = Some("registrar-client".to_string());
+        verified.claims.aud = Some(Audience::One(
+            "https://notary.example.invalid".to_string(),
+        ));
+        verified.matched_client = Some("azp:registrar-client".to_string());
+        verified.scopes = vec![
+            "registry_notary:credential_offer_create".to_string(),
+            "evidence:birth:read".to_string(),
+        ];
+
+        let principal = principal_from_machine_oidc(
+            &verified,
+            EvidenceAuthProfileId::ExternalOidc,
+            verified_claim_value("at+jwt"),
+            "sub",
+        )
+        .expect("verified registrar token authenticates without citizen credentials");
+        let claims = principal
+            .verified_claims
+            .as_ref()
+            .expect("verified machine claims are retained");
+
+        assert_eq!(principal.access_mode(), AccessMode::MachineClient);
+        assert_eq!(principal.principal_id, "login-subject-123");
+        assert_eq!(
+            claims.client_id.as_ref().map(VerifiedClaimValue::as_str),
+            Some("azp:registrar-client")
+        );
+        assert_eq!(
+            claims
+                .audiences
+                .iter()
+                .map(VerifiedClaimValue::as_str)
+                .collect::<Vec<_>>(),
+            vec!["https://notary.example.invalid"]
+        );
+        assert!(claims.subject_binding_claim.is_none());
+        assert!(claims.subject_binding_value.is_none());
+        assert!(
+            claims.acr.is_none() && claims.auth_time.is_none(),
+            "machine access-token assurance must not be reinterpreted as citizen assurance"
+        );
+        assert_eq!(
+            principal
+                .authorization_details
+                .as_ref()
+                .and_then(|details| details.actions.first())
+                .map(String::as_str),
+            Some("create_credential_offer")
+        );
+    }
+
     #[test]
     fn oidc_principal_carries_bounded_verified_claims() {
         let subject_binding_claim = "https://id.example.gov/claims/national_id";
diff --git a/crates/registry-notary-server/src/state_plane/migration.rs b/crates/registry-notary-server/src/state_plane/migration.rs
index 5d803206a1..d04616224d 100644
--- a/crates/registry-notary-server/src/state_plane/migration.rs
+++ b/crates/registry-notary-server/src/state_plane/migration.rs
@@ -29,19 +29,25 @@ const STATE_PLANE_SCHEMA_IDENTITY_PREIMAGE_V1: &str = concat!(
     "evaluation=client-bound-stored-record-v2-atomic-publication-expiry-v1\0",
     "batch=keyed-request-owner-lease-quota-once-takeover-atomic-completion-stored-response-v2-fifteen-minute-retention-v1\0",
     "credential-status=insert-only-locked-transition-terminal-revocation-database-clock-effective-expiry-before-suspension-retention-monotonic-updated-at-v2\0",
-    "machine-quota=keyed-principal-fixed-minute-whole-cost-atomic-v1\0",
+    "machine-quota=keyed-principal-fixed-minute-whole-cost-atomic-quota-independent-idempotency-request-conflict-owner-sixty-second-lease-renewal-bounded-completion-final-owner-fence-evaluation-retention-takeover-v4\0",
     "subject-access-quota=keyed-pseudonym-six-closed-buckets-fixed-windows-canonical-lock-order-caller-denial-order-atomic-all-or-none-check-only-no-mutation-v1\0",
     "preauthorization-login=keyed-state-capacity-4096-encrypted-single-consume-expiry-live-key-attestation-v2\0",
     "preauthorization-tx-code=verified-notary-issuer-stable-scope-jti-keyed-pin-verifier-peek-redeem-one-winner-expiry-live-key-attestation-v3\0",
     "oid4vci-issuance-transaction=keyed-id-encrypted-immutable-record-sha256-uri-commitment-token-nonce-bind-holder-and-request-atomic-one-materialization-encrypted-response-terminal-failure-expiry-v2\0",
-    "retention=bounded-expiry-prune-skip-locked-saturation-catch-up-v2\0",
+    "issuance-evaluation-consumption=keyed-owner-evaluation-single-lineage-shared-direct-and-offer-expiry-capacity-v1\0",
+    "registry-client-offer=hashed-idempotency-exact-encrypted-response-read-only-preflight-before-side-effects-shared-evaluation-consumption-atomic-client-quota-transaction-and-optional-pin-expiry-capacity-v3\0",
+    "retention=thirteen-fixed-groups-bounded-expiry-prune-skip-locked-saturation-catch-up-v3\0",
 );
 pub const STATE_PLANE_SCHEMA_FINGERPRINT_V1: &str =
+    "5d18c2de416906b0c40bf8abdd7c7d7b9a1ddad1c21cb90dba50d24112e4f94b";
+// The immediately preceding v1 contract is the only supported in-place
+// upgrade source. Its exact catalog is attested before any DDL runs.
+const PREVIOUS_STATE_PLANE_SCHEMA_FINGERPRINT_V1: &str =
     "f08bb0bc9b927b534ce736c640d43e3c7f898bd110616f92a60857c5fd1323fd";
 
 const MIGRATION_ADVISORY_LOCK_KEY_V1: i64 = 0x4e4f_5441_5259_0001;
-const EXPECTED_PRIVATE_TABLE_COUNT_V1: i64 = 11;
-const EXPECTED_API_FUNCTION_COUNT_V1: i64 = 31;
+const EXPECTED_PRIVATE_TABLE_COUNT_V1: i64 = 14;
+const EXPECTED_API_FUNCTION_COUNT_V1: i64 = 36;
 
 /// The `NOLOGIN` role that owns the Notary schemas and fixed functions.
 #[derive(Clone, PartialEq, Eq)]
@@ -197,7 +203,33 @@ pub async fn install_postgres_state_plane_v1(
                 .map_err(|_| StatePlaneMigrationError::Unavailable)?;
         }
         2 => {
-            rebind_restored_metadata(&transaction, role_oids, runtime_role, server_major).await?;
+            // Prove ownership and the complete catalog through public catalog
+            // data before inspecting private metadata. A wrong owner or an
+            // unknown catalog must fail closed as drift without gaining access
+            // to restored state.
+            attest_catalog_ownership(&transaction, role_oids.owner).await?;
+            let observed_catalog = catalog_definition_fingerprint(&transaction).await?;
+            if observed_catalog == expected_catalog_definition_fingerprint(server_major)? {
+                if installed_schema_fingerprint(&transaction).await?
+                    != STATE_PLANE_SCHEMA_FINGERPRINT_V1
+                {
+                    return Err(StatePlaneMigrationError::CapabilityDrift);
+                }
+                rebind_restored_metadata(&transaction, role_oids, runtime_role, server_major)
+                    .await?;
+            } else if observed_catalog
+                == expected_previous_catalog_definition_fingerprint(server_major)?
+            {
+                if installed_schema_fingerprint(&transaction).await?
+                    != PREVIOUS_STATE_PLANE_SCHEMA_FINGERPRINT_V1
+                {
+                    return Err(StatePlaneMigrationError::CapabilityDrift);
+                }
+                upgrade_previous_state_plane(&transaction, role_oids, runtime_role, server_major)
+                    .await?;
+            } else {
+                return Err(StatePlaneMigrationError::CapabilityDrift);
+            }
         }
         _ => return Err(StatePlaneMigrationError::PartialInstallation),
     }
@@ -381,6 +413,32 @@ async fn schema_count(client: &impl GenericClient) -> Result<i64, StatePlaneMigr
     row_i64(&row, "schema_count")
 }
 
+async fn installed_schema_fingerprint(
+    client: &impl GenericClient,
+) -> Result<String, StatePlaneMigrationError> {
+    let row = client
+        .query_opt(
+            "SELECT capability_id, schema_version, schema_fingerprint\n\
+               FROM registry_notary_private.schema_metadata\n\
+              WHERE singleton\n\
+              FOR UPDATE",
+            &[],
+        )
+        .await
+        .map_err(|_| StatePlaneMigrationError::Unavailable)?
+        .ok_or(StatePlaneMigrationError::CapabilityDrift)?;
+    let capability: String = row
+        .try_get("capability_id")
+        .map_err(|_| StatePlaneMigrationError::CapabilityDrift)?;
+    if capability != STATE_PLANE_CAPABILITY_V1
+        || row_i32(&row, "schema_version")? != STATE_PLANE_SCHEMA_VERSION_V1
+    {
+        return Err(StatePlaneMigrationError::CapabilityDrift);
+    }
+    row.try_get("schema_fingerprint")
+        .map_err(|_| StatePlaneMigrationError::CapabilityDrift)
+}
+
 async fn bind_metadata(
     transaction: &Transaction<'_>,
     roles: BoundRoleOids,
@@ -436,6 +494,8 @@ fn state_plane_acl_sql(runtime_role: &RuntimeDatabaseRole) -> String {
          GRANT EXECUTE ON FUNCTION registry_notary_api.credential_status_get_v1(text) TO {role};\n\
          GRANT EXECUTE ON FUNCTION registry_notary_api.credential_status_update_v1(text, text) TO {role};\n\
          GRANT EXECUTE ON FUNCTION registry_notary_api.machine_quota_debit_v1(bytea, integer, integer) TO {role};\n\
+         GRANT EXECUTE ON FUNCTION registry_notary_api.machine_quota_debit_once_v1(bytea, bytea, bytea, bytea, integer, integer, integer, timestamptz) TO {role};\n\
+         GRANT EXECUTE ON FUNCTION registry_notary_api.machine_quota_operation_release_v1(bytea, bytea, bytea) TO {role};\n\
          GRANT EXECUTE ON FUNCTION registry_notary_api.subject_access_quota_debit_v1(text[], bytea[], integer[], integer[]) TO {role};\n\
          GRANT EXECUTE ON FUNCTION registry_notary_api.subject_access_quota_check_v1(text[], bytea[], integer[], integer[]) TO {role};\n\
          GRANT EXECUTE ON FUNCTION registry_notary_api.preauthorization_login_reserve_v1(bytea, text, bytea, bytea, bytea, timestamptz) TO {role};\n\
@@ -444,6 +504,9 @@ fn state_plane_acl_sql(runtime_role: &RuntimeDatabaseRole) -> String {
          GRANT EXECUTE ON FUNCTION registry_notary_api.preauthorization_tx_code_peek_v1(bytea) TO {role};\n\
          GRANT EXECUTE ON FUNCTION registry_notary_api.preauthorization_key_attest_v1(bytea) TO {role};\n\
          GRANT EXECUTE ON FUNCTION registry_notary_api.preauthorization_redeem_v1(bytea, bytea, timestamptz, boolean, bytea) TO {role};\n\
+         GRANT EXECUTE ON FUNCTION registry_notary_api.evaluation_issuance_consume_v1(bytea, bytea, timestamptz) TO {role};\n\
+         GRANT EXECUTE ON FUNCTION registry_notary_api.registry_client_offer_preflight_v1(bytea, bytea, bytea, bytea) TO {role};\n\
+         GRANT EXECUTE ON FUNCTION registry_notary_api.registry_client_offer_reserve_v1(bytea, bytea, bytea, bytea, bytea, bytea, text, text, bytea, bytea, timestamptz, bytea, smallint, timestamptz, bytea, bytea, timestamptz, timestamptz, bytea, integer, integer, bytea, bytea) TO {role};\n\
          GRANT EXECUTE ON FUNCTION registry_notary_api.oid4vci_transaction_reserve_v1(bytea, bytea, text, text, bytea, bytea, timestamptz) TO {role};\n\
          GRANT EXECUTE ON FUNCTION registry_notary_api.oid4vci_transaction_get_v1(bytea) TO {role};\n\
          GRANT EXECUTE ON FUNCTION registry_notary_api.oid4vci_transaction_bind_nonce_v1(bytea, text, bytea) TO {role};\n\
@@ -464,7 +527,12 @@ async fn rebind_restored_metadata(
     // Check this through pg_catalog before reading private metadata so a wrong
     // owner is rejected as drift rather than gaining enough access to inspect
     // or repair the restored schema.
-    attest_restored_catalog_ownership(transaction, roles.owner, server_major).await?;
+    attest_catalog_ownership_and_definition(
+        transaction,
+        roles.owner,
+        expected_catalog_definition_fingerprint(server_major)?,
+    )
+    .await?;
     let observed_roles = metadata_roles_for_exact_v1(transaction).await?;
     if observed_roles == roles {
         transaction
@@ -507,6 +575,56 @@ async fn rebind_restored_metadata(
     Ok(())
 }
 
+async fn upgrade_previous_state_plane(
+    transaction: &Transaction<'_>,
+    roles: BoundRoleOids,
+    runtime_role: &RuntimeDatabaseRole,
+    server_major: i32,
+) -> Result<(), StatePlaneMigrationError> {
+    // An upgrade is allowed only from the exact previously released catalog,
+    // already wholly owned by the candidate owner. This keeps the idempotent
+    // DDL below from accepting or concealing arbitrary catalog drift.
+    attest_catalog_ownership_and_definition(
+        transaction,
+        roles.owner,
+        expected_previous_catalog_definition_fingerprint(server_major)?,
+    )
+    .await?;
+    transaction
+        .batch_execute(POSTGRES_STATE_PLANE_MIGRATION_V1)
+        .await
+        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
+    let updated = transaction
+        .execute(
+            "UPDATE registry_notary_private.schema_metadata\n\
+                SET schema_fingerprint = $1,\n\
+                    owner_role_oid = $2::bigint::oid,\n\
+                    runtime_role_oid = $3::bigint::oid\n\
+              WHERE singleton\n\
+                AND capability_id = $4\n\
+                AND schema_version = $5\n\
+                AND schema_fingerprint = $6",
+            &[
+                &STATE_PLANE_SCHEMA_FINGERPRINT_V1,
+                &roles.owner,
+                &roles.runtime,
+                &STATE_PLANE_CAPABILITY_V1,
+                &STATE_PLANE_SCHEMA_VERSION_V1,
+                &PREVIOUS_STATE_PLANE_SCHEMA_FINGERPRINT_V1,
+            ],
+        )
+        .await
+        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
+    if updated != 1 {
+        return Err(StatePlaneMigrationError::CapabilityDrift);
+    }
+    transaction
+        .batch_execute(&state_plane_acl_sql(runtime_role))
+        .await
+        .map_err(|_| StatePlaneMigrationError::Unavailable)?;
+    Ok(())
+}
+
 async fn metadata_roles_for_exact_v1(
     client: &impl GenericClient,
 ) -> Result<BoundRoleOids, StatePlaneMigrationError> {
@@ -540,10 +658,22 @@ async fn metadata_roles_for_exact_v1(
     })
 }
 
-async fn attest_restored_catalog_ownership(
+async fn attest_catalog_ownership_and_definition(
+    client: &impl GenericClient,
+    owner_oid: i64,
+    expected_fingerprint: &str,
+) -> Result<(), StatePlaneMigrationError> {
+    attest_catalog_ownership(client, owner_oid).await?;
+    let observed = catalog_definition_fingerprint(client).await?;
+    if observed != expected_fingerprint {
+        return Err(StatePlaneMigrationError::CapabilityDrift);
+    }
+    Ok(())
+}
+
+async fn attest_catalog_ownership(
     client: &impl GenericClient,
     owner_oid: i64,
-    server_major: i32,
 ) -> Result<(), StatePlaneMigrationError> {
     let ownership = client
         .query_one(
@@ -577,10 +707,6 @@ async fn attest_restored_catalog_ownership(
     {
         return Err(StatePlaneMigrationError::CapabilityDrift);
     }
-    let observed = catalog_definition_fingerprint(client).await?;
-    if observed != expected_catalog_definition_fingerprint(server_major)? {
-        return Err(StatePlaneMigrationError::CapabilityDrift);
-    }
     Ok(())
 }
 
@@ -784,13 +910,30 @@ fn expected_catalog_definition_fingerprint(
     }
 }
 
+fn expected_previous_catalog_definition_fingerprint(
+    server_major: i32,
+) -> Result<&'static str, StatePlaneMigrationError> {
+    match server_major {
+        16 => Ok(PREVIOUS_CATALOG_DEFINITION_FINGERPRINT_PG16_V1),
+        17 => Ok(PREVIOUS_CATALOG_DEFINITION_FINGERPRINT_PG17_V1),
+        18 => Ok(PREVIOUS_CATALOG_DEFINITION_FINGERPRINT_PG18_V1),
+        _ => Err(StatePlaneMigrationError::UnsupportedServerMajor),
+    }
+}
+
 // These fingerprints are derived from the deterministic catalog projection
 // below and are pinned separately for every supported PostgreSQL major.
 const EXPECTED_CATALOG_DEFINITION_FINGERPRINT_PG16_V1: &str =
-    "cf45576aced8a825cd2891800f2636ec1ca0dd0959b81f3a787cc0ed36ea09a5";
+    "459c0604fa2711af2704f8307577ea03df374a067f494abf34411e7c1cd2b621";
 const EXPECTED_CATALOG_DEFINITION_FINGERPRINT_PG17_V1: &str =
-    "cf45576aced8a825cd2891800f2636ec1ca0dd0959b81f3a787cc0ed36ea09a5";
+    "459c0604fa2711af2704f8307577ea03df374a067f494abf34411e7c1cd2b621";
 const EXPECTED_CATALOG_DEFINITION_FINGERPRINT_PG18_V1: &str =
+    "495041552db166b39a794e051b43a8a45da657270bca244ed1f6df884a303edf";
+const PREVIOUS_CATALOG_DEFINITION_FINGERPRINT_PG16_V1: &str =
+    "cf45576aced8a825cd2891800f2636ec1ca0dd0959b81f3a787cc0ed36ea09a5";
+const PREVIOUS_CATALOG_DEFINITION_FINGERPRINT_PG17_V1: &str =
+    "cf45576aced8a825cd2891800f2636ec1ca0dd0959b81f3a787cc0ed36ea09a5";
+const PREVIOUS_CATALOG_DEFINITION_FINGERPRINT_PG18_V1: &str =
     "81760fbb2d3839783503774b3e6b436187c1969a154a331929d097e0e654eea2";
 
 const CATALOG_DEFINITION_QUERY_V1: &str = r#"
diff --git a/crates/registry-notary-server/src/state_plane/migration/postgres_state_plane_v1.sql b/crates/registry-notary-server/src/state_plane/migration/postgres_state_plane_v1.sql
index 788362c46e..d82e9e91c5 100644
--- a/crates/registry-notary-server/src/state_plane/migration/postgres_state_plane_v1.sql
+++ b/crates/registry-notary-server/src/state_plane/migration/postgres_state_plane_v1.sql
@@ -1,10 +1,10 @@
-CREATE SCHEMA registry_notary_private AUTHORIZATION CURRENT_USER;
-CREATE SCHEMA registry_notary_api AUTHORIZATION CURRENT_USER;
+CREATE SCHEMA IF NOT EXISTS registry_notary_private AUTHORIZATION CURRENT_USER;
+CREATE SCHEMA IF NOT EXISTS registry_notary_api AUTHORIZATION CURRENT_USER;
 
 REVOKE ALL ON SCHEMA registry_notary_private FROM PUBLIC;
 REVOKE ALL ON SCHEMA registry_notary_api FROM PUBLIC;
 
-CREATE TABLE registry_notary_private.schema_metadata (
+CREATE TABLE IF NOT EXISTS registry_notary_private.schema_metadata (
     singleton boolean PRIMARY KEY DEFAULT TRUE CHECK (singleton),
     capability_id text NOT NULL,
     schema_version integer NOT NULL CHECK (schema_version > 0),
@@ -15,7 +15,7 @@ CREATE TABLE registry_notary_private.schema_metadata (
     CHECK (owner_role_oid <> runtime_role_oid)
 );
 
-CREATE TABLE registry_notary_private.replay_identifier (
+CREATE TABLE IF NOT EXISTS registry_notary_private.replay_identifier (
     scope_hash bytea NOT NULL CHECK (pg_catalog.octet_length(scope_hash) = 32),
     identifier_hash bytea NOT NULL CHECK (pg_catalog.octet_length(identifier_hash) = 32),
     created_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
@@ -23,10 +23,10 @@ CREATE TABLE registry_notary_private.replay_identifier (
     PRIMARY KEY (scope_hash, identifier_hash),
     CHECK (expires_at > created_at)
 );
-CREATE INDEX replay_identifier_expiry_idx
+CREATE INDEX IF NOT EXISTS replay_identifier_expiry_idx
     ON registry_notary_private.replay_identifier (expires_at);
 
-CREATE TABLE registry_notary_private.consumable_nonce (
+CREATE TABLE IF NOT EXISTS registry_notary_private.consumable_nonce (
     scope_hash bytea NOT NULL CHECK (pg_catalog.octet_length(scope_hash) = 32),
     nonce_hash bytea NOT NULL CHECK (pg_catalog.octet_length(nonce_hash) = 32),
     generation bigint NOT NULL CHECK (generation > 0),
@@ -41,12 +41,12 @@ CREATE TABLE registry_notary_private.consumable_nonce (
         OR (state = 'consumed' AND tombstone_expires_at IS NOT NULL)
     )
 );
-CREATE INDEX consumable_nonce_retention_idx
+CREATE INDEX IF NOT EXISTS consumable_nonce_retention_idx
     ON registry_notary_private.consumable_nonce (
         (CASE WHEN state = 'reserved' THEN reservation_expires_at ELSE tombstone_expires_at END)
     );
 
-CREATE TABLE registry_notary_private.evaluation (
+CREATE TABLE IF NOT EXISTS registry_notary_private.evaluation (
     evaluation_id text PRIMARY KEY CHECK (pg_catalog.length(evaluation_id) BETWEEN 1 AND 256),
     client_id_hash bytea NOT NULL CHECK (pg_catalog.octet_length(client_id_hash) = 32),
     request_hash bytea NOT NULL CHECK (pg_catalog.octet_length(request_hash) = 32),
@@ -57,12 +57,12 @@ CREATE TABLE registry_notary_private.evaluation (
     expires_at timestamptz NOT NULL,
     CHECK (expires_at > created_at)
 );
-CREATE INDEX evaluation_client_expiry_idx
+CREATE INDEX IF NOT EXISTS evaluation_client_expiry_idx
     ON registry_notary_private.evaluation (client_id_hash, expires_at);
-CREATE INDEX evaluation_expiry_idx
+CREATE INDEX IF NOT EXISTS evaluation_expiry_idx
     ON registry_notary_private.evaluation (expires_at);
 
-CREATE TABLE registry_notary_private.batch_idempotency (
+CREATE TABLE IF NOT EXISTS registry_notary_private.batch_idempotency (
     key_hash bytea PRIMARY KEY CHECK (pg_catalog.octet_length(key_hash) = 32),
     request_hash bytea NOT NULL CHECK (pg_catalog.octet_length(request_hash) = 32),
     principal_hash bytea NOT NULL CHECK (pg_catalog.octet_length(principal_hash) = 32),
@@ -84,13 +84,13 @@ CREATE TABLE registry_notary_private.batch_idempotency (
             AND response_version IS NULL AND response_json IS NULL)
     )
 );
-CREATE INDEX batch_idempotency_retention_idx
+CREATE INDEX IF NOT EXISTS batch_idempotency_retention_idx
     ON registry_notary_private.batch_idempotency (retention_expires_at);
-CREATE INDEX batch_idempotency_lease_idx
+CREATE INDEX IF NOT EXISTS batch_idempotency_lease_idx
     ON registry_notary_private.batch_idempotency (lease_expires_at)
     WHERE state = 'in_flight';
 
-CREATE TABLE registry_notary_private.credential_status (
+CREATE TABLE IF NOT EXISTS registry_notary_private.credential_status (
     credential_id text PRIMARY KEY CHECK (pg_catalog.length(credential_id) BETWEEN 1 AND 512),
     issuer text NOT NULL CHECK (pg_catalog.length(issuer) BETWEEN 1 AND 2048),
     profile text NOT NULL CHECK (pg_catalog.length(profile) BETWEEN 1 AND 256),
@@ -103,20 +103,35 @@ CREATE TABLE registry_notary_private.credential_status (
     CHECK (purge_after > credential_expires_at),
     CHECK (updated_at >= issued_at)
 );
-CREATE INDEX credential_status_purge_idx
+CREATE INDEX IF NOT EXISTS credential_status_purge_idx
     ON registry_notary_private.credential_status (purge_after);
 
-CREATE TABLE registry_notary_private.machine_quota (
+CREATE TABLE IF NOT EXISTS registry_notary_private.machine_quota (
     principal_hash bytea PRIMARY KEY CHECK (pg_catalog.octet_length(principal_hash) = 32),
     window_started_at timestamptz NOT NULL,
     window_expires_at timestamptz NOT NULL,
     used integer NOT NULL CHECK (used >= 0),
     CHECK (window_expires_at > window_started_at)
 );
-CREATE INDEX machine_quota_expiry_idx
+CREATE INDEX IF NOT EXISTS machine_quota_expiry_idx
     ON registry_notary_private.machine_quota (window_expires_at);
 
-CREATE TABLE registry_notary_private.subject_access_quota (
+CREATE TABLE IF NOT EXISTS registry_notary_private.machine_quota_operation (
+    principal_hash bytea NOT NULL CHECK (pg_catalog.octet_length(principal_hash) = 32),
+    operation_hash bytea NOT NULL CHECK (pg_catalog.octet_length(operation_hash) = 32),
+    request_hash bytea NOT NULL CHECK (pg_catalog.octet_length(request_hash) = 32),
+    lease_owner_hash bytea NOT NULL CHECK (pg_catalog.octet_length(lease_owner_hash) = 32),
+    lease_expires_at timestamptz NOT NULL,
+    created_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
+    expires_at timestamptz NOT NULL,
+    PRIMARY KEY (principal_hash, operation_hash),
+    CHECK (expires_at > created_at),
+    CHECK (lease_expires_at <= expires_at)
+);
+CREATE INDEX IF NOT EXISTS machine_quota_operation_expiry_idx
+    ON registry_notary_private.machine_quota_operation (expires_at);
+
+CREATE TABLE IF NOT EXISTS registry_notary_private.subject_access_quota (
     bucket_kind text NOT NULL CHECK (bucket_kind IN (
         'invalid_token_per_client_address',
         'per_principal',
@@ -132,10 +147,10 @@ CREATE TABLE registry_notary_private.subject_access_quota (
     PRIMARY KEY (bucket_kind, key_hash),
     CHECK (window_expires_at > window_started_at)
 );
-CREATE INDEX subject_access_quota_expiry_idx
+CREATE INDEX IF NOT EXISTS subject_access_quota_expiry_idx
     ON registry_notary_private.subject_access_quota (window_expires_at);
 
-CREATE TABLE registry_notary_private.preauthorization_login_state (
+CREATE TABLE IF NOT EXISTS registry_notary_private.preauthorization_login_state (
     state_hash bytea PRIMARY KEY CHECK (pg_catalog.octet_length(state_hash) = 32),
     credential_configuration_id text NOT NULL
         CHECK (pg_catalog.length(credential_configuration_id) BETWEEN 1 AND 256),
@@ -146,10 +161,10 @@ CREATE TABLE registry_notary_private.preauthorization_login_state (
     expires_at timestamptz NOT NULL,
     CHECK (expires_at > created_at)
 );
-CREATE INDEX preauthorization_login_state_expiry_idx
+CREATE INDEX IF NOT EXISTS preauthorization_login_state_expiry_idx
     ON registry_notary_private.preauthorization_login_state (expires_at);
 
-CREATE TABLE registry_notary_private.preauthorization_tx_code (
+CREATE TABLE IF NOT EXISTS registry_notary_private.preauthorization_tx_code (
     jti_hash bytea PRIMARY KEY CHECK (pg_catalog.octet_length(jti_hash) = 32),
     key_id bytea NOT NULL CHECK (pg_catalog.octet_length(key_id) = 32),
     pin_verifier bytea NOT NULL CHECK (pg_catalog.octet_length(pin_verifier) = 32),
@@ -158,10 +173,10 @@ CREATE TABLE registry_notary_private.preauthorization_tx_code (
     expires_at timestamptz NOT NULL,
     CHECK (expires_at > created_at)
 );
-CREATE INDEX preauthorization_tx_code_expiry_idx
+CREATE INDEX IF NOT EXISTS preauthorization_tx_code_expiry_idx
     ON registry_notary_private.preauthorization_tx_code (expires_at);
 
-CREATE TABLE registry_notary_private.oid4vci_issuance_transaction (
+CREATE TABLE IF NOT EXISTS registry_notary_private.oid4vci_issuance_transaction (
     transaction_hash bytea PRIMARY KEY CHECK (pg_catalog.octet_length(transaction_hash) = 32),
     key_id bytea NOT NULL CHECK (pg_catalog.octet_length(key_id) = 32),
     credential_configuration_id text NOT NULL
@@ -204,9 +219,44 @@ CREATE TABLE registry_notary_private.oid4vci_issuance_transaction (
             AND response_aead_nonce IS NULL AND response_ciphertext IS NULL)
     )
 );
-CREATE INDEX oid4vci_issuance_transaction_expiry_idx
+CREATE INDEX IF NOT EXISTS oid4vci_issuance_transaction_expiry_idx
     ON registry_notary_private.oid4vci_issuance_transaction (expires_at);
 
+CREATE TABLE IF NOT EXISTS registry_notary_private.issuance_evaluation_consumption (
+    evaluation_hash bytea PRIMARY KEY
+        CHECK (pg_catalog.octet_length(evaluation_hash) = 32),
+    key_id bytea NOT NULL CHECK (pg_catalog.octet_length(key_id) = 32),
+    created_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
+    expires_at timestamptz NOT NULL,
+    CHECK (expires_at > created_at)
+);
+CREATE INDEX IF NOT EXISTS issuance_evaluation_consumption_expiry_idx
+    ON registry_notary_private.issuance_evaluation_consumption (expires_at);
+
+CREATE TABLE IF NOT EXISTS registry_notary_private.registry_client_offer (
+    idempotency_key_hash bytea PRIMARY KEY
+        CHECK (pg_catalog.octet_length(idempotency_key_hash) = 32),
+    request_hash bytea NOT NULL CHECK (pg_catalog.octet_length(request_hash) = 32),
+    evaluation_hash bytea NOT NULL UNIQUE
+        CHECK (pg_catalog.octet_length(evaluation_hash) = 32),
+    transaction_hash bytea NOT NULL UNIQUE
+        CHECK (pg_catalog.octet_length(transaction_hash) = 32),
+    key_id bytea NOT NULL CHECK (pg_catalog.octet_length(key_id) = 32),
+    response_aead_nonce bytea NOT NULL
+        CHECK (pg_catalog.octet_length(response_aead_nonce) BETWEEN 12 AND 24),
+    response_ciphertext bytea NOT NULL
+        CHECK (pg_catalog.octet_length(response_ciphertext) BETWEEN 17 AND 65536),
+    retention_expires_at timestamptz NOT NULL,
+    evaluation_expires_at timestamptz NOT NULL,
+    purge_after timestamptz NOT NULL,
+    created_at timestamptz NOT NULL DEFAULT pg_catalog.clock_timestamp(),
+    CHECK (retention_expires_at > created_at),
+    CHECK (evaluation_expires_at > created_at),
+    CHECK (purge_after = GREATEST(retention_expires_at, evaluation_expires_at))
+);
+CREATE INDEX IF NOT EXISTS registry_client_offer_purge_idx
+    ON registry_notary_private.registry_client_offer (purge_after);
+
 ALTER DEFAULT PRIVILEGES IN SCHEMA registry_notary_private
     REVOKE ALL ON TABLES FROM PUBLIC;
 ALTER DEFAULT PRIVILEGES IN SCHEMA registry_notary_private
@@ -214,7 +264,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA registry_notary_private
 ALTER DEFAULT PRIVILEGES IN SCHEMA registry_notary_api
     REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC;
 
-CREATE FUNCTION registry_notary_api.attest_v1()
+CREATE OR REPLACE FUNCTION registry_notary_api.attest_v1()
 RETURNS TABLE (
     capability_id text,
     schema_version integer,
@@ -247,7 +297,7 @@ AS $function$
      WHERE metadata.singleton
 $function$;
 
-CREATE FUNCTION registry_notary_api.readiness_v1()
+CREATE OR REPLACE FUNCTION registry_notary_api.readiness_v1()
 RETURNS TABLE (
     capability_id text,
     schema_version integer,
@@ -266,7 +316,7 @@ AS $function$
     SELECT * FROM registry_notary_api.attest_v1()
 $function$;
 
-CREATE FUNCTION registry_notary_api.replay_insert_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.replay_insert_v1(
     p_scope_hash bytea,
     p_identifier_hash bytea,
     p_expires_at timestamptz
@@ -298,7 +348,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.nonce_reserve_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.nonce_reserve_v1(
     p_scope_hash bytea,
     p_nonce_hash bytea,
     p_expires_at timestamptz
@@ -344,7 +394,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.nonce_reservation_generation_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.nonce_reservation_generation_v1(
     p_scope_hash bytea,
     p_nonce_hash bytea
 )
@@ -362,7 +412,7 @@ AS $function$
        AND stored.reservation_expires_at > pg_catalog.statement_timestamp()
 $function$;
 
-CREATE FUNCTION registry_notary_api.nonce_consume_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.nonce_consume_v1(
     p_scope_hash bytea,
     p_nonce_hash bytea,
     p_generation bigint
@@ -396,7 +446,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.evaluation_insert_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.evaluation_insert_v1(
     p_evaluation_id text,
     p_client_id_hash bytea,
     p_request_hash bytea,
@@ -426,7 +476,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.evaluation_get_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.evaluation_get_v1(
     p_evaluation_id text,
     p_client_id_hash bytea
 )
@@ -450,7 +500,7 @@ AS $function$
        AND evaluation.expires_at > pg_catalog.clock_timestamp()
 $function$;
 
-CREATE FUNCTION registry_notary_api.batch_reserve_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.batch_reserve_v1(
     p_key_hash bytea,
     p_request_hash bytea,
     p_principal_hash bytea,
@@ -590,7 +640,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.batch_heartbeat_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.batch_heartbeat_v1(
     p_key_hash bytea,
     p_request_hash bytea,
     p_owner_token bytea,
@@ -620,7 +670,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.batch_complete_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.batch_complete_v1(
     p_key_hash bytea,
     p_request_hash bytea,
     p_owner_token bytea,
@@ -681,7 +731,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.batch_fail_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.batch_fail_v1(
     p_key_hash bytea,
     p_request_hash bytea,
     p_owner_token bytea
@@ -710,7 +760,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.credential_status_insert_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.credential_status_insert_v1(
     p_credential_id text,
     p_issuer text,
     p_profile text,
@@ -742,7 +792,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.credential_status_get_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.credential_status_get_v1(
     p_credential_id text
 )
 RETURNS TABLE (
@@ -778,7 +828,7 @@ AS $function$
        AND stored.purge_after > pg_catalog.clock_timestamp()
 $function$;
 
-CREATE FUNCTION registry_notary_api.credential_status_update_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.credential_status_update_v1(
     p_credential_id text,
     p_status text
 )
@@ -850,7 +900,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.machine_quota_debit_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.machine_quota_debit_v1(
     p_principal_hash bytea,
     p_limit integer,
     p_cost integer
@@ -902,7 +952,156 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.subject_access_quota_debit_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.machine_quota_debit_once_v1(
+    p_principal_hash bytea,
+    p_operation_hash bytea,
+    p_request_hash bytea,
+    p_lease_owner_hash bytea,
+    p_limit integer,
+    p_cost integer,
+    p_lease_seconds integer,
+    p_operation_expires_at timestamptz
+)
+RETURNS TABLE (
+    allowed boolean,
+    acquired boolean,
+    conflict boolean,
+    remaining integer,
+    retry_after_seconds bigint
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+    v_now timestamptz := pg_catalog.clock_timestamp();
+    v_quota registry_notary_private.machine_quota%ROWTYPE;
+    v_operation registry_notary_private.machine_quota_operation%ROWTYPE;
+BEGIN
+    IF pg_catalog.octet_length(p_principal_hash) <> 32
+       OR pg_catalog.octet_length(p_operation_hash) <> 32
+       OR pg_catalog.octet_length(p_request_hash) <> 32
+       OR pg_catalog.octet_length(p_lease_owner_hash) <> 32
+       OR (p_limit IS NOT NULL AND p_limit <= 0) OR p_cost <= 0
+       OR p_lease_seconds NOT BETWEEN 1 AND 60
+       OR p_operation_expires_at <= v_now THEN
+        RAISE EXCEPTION USING ERRCODE = '22023',
+            MESSAGE = 'invalid idempotent machine quota input';
+    END IF;
+    INSERT INTO registry_notary_private.machine_quota (
+        principal_hash, window_started_at, window_expires_at, used
+    ) VALUES (p_principal_hash, v_now, v_now + interval '1 minute', 0)
+    ON CONFLICT (principal_hash) DO NOTHING;
+    SELECT * INTO STRICT v_quota
+      FROM registry_notary_private.machine_quota AS quota
+     WHERE quota.principal_hash = p_principal_hash
+     FOR UPDATE;
+    v_now := pg_catalog.clock_timestamp();
+    IF p_operation_expires_at <= v_now THEN
+        RAISE EXCEPTION USING ERRCODE = '22023',
+            MESSAGE = 'expired idempotent machine quota operation';
+    END IF;
+    IF v_quota.window_expires_at <= v_now THEN
+        UPDATE registry_notary_private.machine_quota AS quota
+           SET window_started_at = v_now,
+               window_expires_at = v_now + interval '1 minute',
+               used = 0
+         WHERE quota.principal_hash = p_principal_hash;
+        v_quota.window_expires_at := v_now + interval '1 minute';
+        v_quota.used := 0;
+    END IF;
+    DELETE FROM registry_notary_private.machine_quota_operation AS operation
+     WHERE operation.principal_hash = p_principal_hash
+       AND operation.operation_hash = p_operation_hash
+       AND operation.expires_at <= v_now;
+    SELECT * INTO v_operation
+      FROM registry_notary_private.machine_quota_operation AS operation
+     WHERE operation.principal_hash = p_principal_hash
+       AND operation.operation_hash = p_operation_hash
+       AND operation.expires_at > v_now
+     FOR UPDATE;
+    v_now := pg_catalog.clock_timestamp();
+    IF FOUND THEN
+        IF v_operation.expires_at <= v_now THEN
+            RAISE EXCEPTION USING ERRCODE = '22023',
+                MESSAGE = 'expired idempotent machine quota operation';
+        END IF;
+        IF v_operation.request_hash <> p_request_hash THEN
+            RETURN QUERY SELECT TRUE, FALSE, TRUE,
+                CASE WHEN p_limit IS NULL THEN 0
+                     ELSE GREATEST(0, p_limit - v_quota.used) END,
+                0::bigint;
+        ELSIF v_operation.lease_owner_hash = p_lease_owner_hash
+           OR v_operation.lease_expires_at <= v_now THEN
+            UPDATE registry_notary_private.machine_quota_operation AS operation
+               SET lease_owner_hash = p_lease_owner_hash,
+                   lease_expires_at = LEAST(
+                       v_now + pg_catalog.make_interval(secs => p_lease_seconds),
+                       operation.expires_at
+                   )
+             WHERE operation.principal_hash = p_principal_hash
+               AND operation.operation_hash = p_operation_hash;
+            RETURN QUERY SELECT TRUE, TRUE, FALSE,
+                CASE WHEN p_limit IS NULL THEN 0
+                     ELSE GREATEST(0, p_limit - v_quota.used) END,
+                0::bigint;
+        ELSE
+            RETURN QUERY SELECT TRUE, FALSE, FALSE,
+                CASE WHEN p_limit IS NULL THEN 0
+                     ELSE GREATEST(0, p_limit - v_quota.used) END,
+                0::bigint;
+        END IF;
+        RETURN;
+    END IF;
+    IF p_limit IS NOT NULL AND p_cost > p_limit - v_quota.used THEN
+        RETURN QUERY SELECT FALSE, FALSE, FALSE,
+            GREATEST(0, p_limit - v_quota.used),
+            GREATEST(1::bigint, CEIL(EXTRACT(EPOCH FROM
+                (v_quota.window_expires_at - v_now)))::bigint);
+        RETURN;
+    END IF;
+    IF p_limit IS NOT NULL THEN
+        UPDATE registry_notary_private.machine_quota AS quota
+           SET used = quota.used + p_cost
+         WHERE quota.principal_hash = p_principal_hash;
+    END IF;
+    INSERT INTO registry_notary_private.machine_quota_operation (
+        principal_hash, operation_hash, request_hash, lease_owner_hash, lease_expires_at,
+        created_at, expires_at
+    ) VALUES (
+        p_principal_hash, p_operation_hash, p_request_hash, p_lease_owner_hash,
+        LEAST(
+            v_now + pg_catalog.make_interval(secs => p_lease_seconds),
+            p_operation_expires_at
+        ),
+        v_now, p_operation_expires_at
+    );
+    RETURN QUERY SELECT TRUE, TRUE, FALSE,
+        CASE WHEN p_limit IS NULL THEN 0
+             ELSE p_limit - (v_quota.used + p_cost) END,
+        0::bigint;
+END
+$function$;
+
+CREATE OR REPLACE FUNCTION registry_notary_api.machine_quota_operation_release_v1(
+    p_principal_hash bytea,
+    p_operation_hash bytea,
+    p_lease_owner_hash bytea
+)
+RETURNS boolean
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+    UPDATE registry_notary_private.machine_quota_operation AS operation
+       SET lease_expires_at = pg_catalog.clock_timestamp()
+     WHERE operation.principal_hash = p_principal_hash
+       AND operation.operation_hash = p_operation_hash
+       AND operation.lease_owner_hash = p_lease_owner_hash
+    RETURNING TRUE
+$function$;
+
+CREATE OR REPLACE FUNCTION registry_notary_api.subject_access_quota_debit_v1(
     p_bucket_kinds text[],
     p_key_hashes bytea[],
     p_limits integer[],
@@ -1020,7 +1219,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.subject_access_quota_check_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.subject_access_quota_check_v1(
     p_bucket_kinds text[],
     p_key_hashes bytea[],
     p_limits integer[],
@@ -1110,7 +1309,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.preauthorization_login_reserve_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.preauthorization_login_reserve_v1(
     p_state_hash bytea,
     p_credential_configuration_id text,
     p_key_id bytea,
@@ -1142,6 +1341,12 @@ BEGIN
         UNION ALL
         SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction
          WHERE expires_at > v_now AND key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
+         WHERE expires_at > v_now AND key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.registry_client_offer
+         WHERE purge_after > v_now AND key_id <> p_key_id
     ) THEN
         RAISE EXCEPTION USING ERRCODE = '55000',
             MESSAGE = 'sensitive-state key generation mismatch';
@@ -1174,7 +1379,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.preauthorization_login_consume_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.preauthorization_login_consume_v1(
     p_state_hash bytea
 )
 RETURNS TABLE (
@@ -1198,7 +1403,7 @@ AS $function$
               stored.expires_at
 $function$;
 
-CREATE FUNCTION registry_notary_api.preauthorization_tx_code_reserve_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.preauthorization_tx_code_reserve_v1(
     p_jti_hash bytea,
     p_key_id bytea,
     p_pin_verifier bytea,
@@ -1227,6 +1432,12 @@ BEGIN
         UNION ALL
         SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction
          WHERE expires_at > v_now AND key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
+         WHERE expires_at > v_now AND key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.registry_client_offer
+         WHERE purge_after > v_now AND key_id <> p_key_id
     ) THEN
         RAISE EXCEPTION USING ERRCODE = '55000',
             MESSAGE = 'sensitive-state key generation mismatch';
@@ -1243,7 +1454,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.preauthorization_key_attest_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.preauthorization_key_attest_v1(
     p_key_id bytea
 )
 RETURNS boolean
@@ -1262,10 +1473,16 @@ AS $function$
             UNION ALL
             SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction
              WHERE expires_at > pg_catalog.statement_timestamp() AND key_id <> p_key_id
+            UNION ALL
+            SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
+             WHERE expires_at > pg_catalog.statement_timestamp() AND key_id <> p_key_id
+            UNION ALL
+            SELECT 1 FROM registry_notary_private.registry_client_offer
+             WHERE purge_after > pg_catalog.statement_timestamp() AND key_id <> p_key_id
        )
 $function$;
 
-CREATE FUNCTION registry_notary_api.preauthorization_tx_code_peek_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.preauthorization_tx_code_peek_v1(
     p_jti_hash bytea
 )
 RETURNS TABLE (
@@ -1287,7 +1504,7 @@ AS $function$
        AND stored.expires_at > pg_catalog.clock_timestamp()
 $function$;
 
-CREATE FUNCTION registry_notary_api.preauthorization_redeem_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.preauthorization_redeem_v1(
     p_replay_scope_hash bytea,
     p_jti_hash bytea,
     p_code_expires_at timestamptz,
@@ -1342,7 +1559,402 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.oid4vci_transaction_reserve_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.evaluation_issuance_consume_v1(
+    p_evaluation_hash bytea,
+    p_key_id bytea,
+    p_expires_at timestamptz
+)
+RETURNS smallint
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+    v_now timestamptz := pg_catalog.clock_timestamp();
+    v_count bigint;
+BEGIN
+    IF pg_catalog.octet_length(p_evaluation_hash) <> 32
+       OR pg_catalog.octet_length(p_key_id) <> 32
+       OR p_expires_at <= v_now THEN
+        RAISE EXCEPTION USING ERRCODE = '22023',
+            MESSAGE = 'invalid evaluation issuance consumption';
+    END IF;
+    PERFORM pg_catalog.pg_advisory_xact_lock(5642808141211099137);
+    IF EXISTS (
+        SELECT 1 FROM registry_notary_private.preauthorization_login_state
+         WHERE expires_at > v_now AND key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.preauthorization_tx_code
+         WHERE expires_at > v_now AND key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction
+         WHERE expires_at > v_now AND key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
+         WHERE expires_at > v_now AND key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.registry_client_offer
+         WHERE purge_after > v_now AND key_id <> p_key_id
+    ) THEN
+        RAISE EXCEPTION USING ERRCODE = '55000',
+            MESSAGE = 'sensitive-state key generation mismatch';
+    END IF;
+    LOCK TABLE registry_notary_private.issuance_evaluation_consumption
+        IN SHARE ROW EXCLUSIVE MODE;
+    DELETE FROM registry_notary_private.issuance_evaluation_consumption
+     WHERE expires_at <= v_now;
+    IF EXISTS (
+        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
+         WHERE evaluation_hash = p_evaluation_hash
+    ) THEN
+        RETURN 0;
+    END IF;
+    SELECT pg_catalog.count(*) INTO v_count
+      FROM registry_notary_private.issuance_evaluation_consumption;
+    IF v_count >= 4096 THEN
+        RETURN -1;
+    END IF;
+    INSERT INTO registry_notary_private.issuance_evaluation_consumption (
+        evaluation_hash, key_id, created_at, expires_at
+    ) VALUES (p_evaluation_hash, p_key_id, v_now, p_expires_at);
+    RETURN 1;
+END
+$function$;
+
+CREATE OR REPLACE FUNCTION registry_notary_api.registry_client_offer_preflight_v1(
+    p_idempotency_key_hash bytea,
+    p_request_hash bytea,
+    p_evaluation_hash bytea,
+    p_key_id bytea
+)
+RETURNS TABLE (
+    outcome smallint,
+    key_id bytea,
+    response_aead_nonce bytea,
+    response_ciphertext bytea,
+    retention_expires_at timestamptz
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+    v_now timestamptz := pg_catalog.clock_timestamp();
+    v_stored registry_notary_private.registry_client_offer%ROWTYPE;
+BEGIN
+    IF pg_catalog.octet_length(p_idempotency_key_hash) <> 32
+       OR pg_catalog.octet_length(p_request_hash) <> 32
+       OR pg_catalog.octet_length(p_evaluation_hash) <> 32
+       OR pg_catalog.octet_length(p_key_id) <> 32 THEN
+        RAISE EXCEPTION USING ERRCODE = '22023',
+            MESSAGE = 'invalid registry-client offer preflight';
+    END IF;
+    SELECT offer.* INTO v_stored
+      FROM registry_notary_private.registry_client_offer AS offer
+     WHERE offer.idempotency_key_hash = p_idempotency_key_hash
+       AND offer.purge_after > v_now;
+    IF FOUND THEN
+        IF v_stored.key_id <> p_key_id THEN
+            RAISE EXCEPTION USING ERRCODE = '55000',
+                MESSAGE = 'sensitive-state key generation mismatch';
+        ELSIF v_stored.request_hash <> p_request_hash THEN
+            RETURN QUERY SELECT 0::smallint, NULL::bytea, NULL::bytea,
+                NULL::bytea, NULL::timestamptz;
+        ELSIF v_stored.retention_expires_at > v_now THEN
+            RETURN QUERY SELECT 2::smallint, v_stored.key_id,
+                v_stored.response_aead_nonce, v_stored.response_ciphertext,
+                v_stored.retention_expires_at;
+        ELSE
+            RETURN QUERY SELECT -2::smallint, NULL::bytea, NULL::bytea,
+                NULL::bytea, NULL::timestamptz;
+        END IF;
+        RETURN;
+    END IF;
+    IF EXISTS (
+        SELECT 1
+          FROM registry_notary_private.issuance_evaluation_consumption AS consumption
+         WHERE consumption.evaluation_hash = p_evaluation_hash
+           AND consumption.expires_at > v_now
+           AND consumption.key_id <> p_key_id
+    ) THEN
+        RAISE EXCEPTION USING ERRCODE = '55000',
+            MESSAGE = 'sensitive-state key generation mismatch';
+    END IF;
+    IF EXISTS (
+        SELECT 1
+          FROM registry_notary_private.issuance_evaluation_consumption AS consumption
+         WHERE consumption.evaluation_hash = p_evaluation_hash
+           AND consumption.expires_at > v_now
+    ) THEN
+        RETURN QUERY SELECT -2::smallint, NULL::bytea, NULL::bytea,
+            NULL::bytea, NULL::timestamptz;
+        RETURN;
+    END IF;
+    RETURN QUERY SELECT 1::smallint, NULL::bytea, NULL::bytea,
+        NULL::bytea, NULL::timestamptz;
+END
+$function$;
+
+CREATE OR REPLACE FUNCTION registry_notary_api.registry_client_offer_reserve_v1(
+    p_idempotency_key_hash bytea,
+    p_request_hash bytea,
+    p_evaluation_hash bytea,
+    p_transaction_hash bytea,
+    p_jti_hash bytea,
+    p_key_id bytea,
+    p_configuration_id text,
+    p_commitment text,
+    p_record_aead_nonce bytea,
+    p_record_ciphertext bytea,
+    p_transaction_expires_at timestamptz,
+    p_pin_verifier bytea,
+    p_pin_length smallint,
+    p_code_expires_at timestamptz,
+    p_response_aead_nonce bytea,
+    p_response_ciphertext bytea,
+    p_retention_expires_at timestamptz,
+    p_evaluation_expires_at timestamptz,
+    p_quota_principal_hash bytea,
+    p_quota_limit integer,
+    p_quota_cost integer,
+    p_quota_operation_hash bytea,
+    p_quota_lease_owner_hash bytea
+)
+RETURNS TABLE (
+    outcome smallint,
+    key_id bytea,
+    response_aead_nonce bytea,
+    response_ciphertext bytea,
+    retention_expires_at timestamptz,
+    retry_after_seconds bigint
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+    v_now timestamptz := pg_catalog.clock_timestamp();
+    v_count bigint;
+    v_stored registry_notary_private.registry_client_offer%ROWTYPE;
+    v_quota registry_notary_private.machine_quota%ROWTYPE;
+    v_quota_operation registry_notary_private.machine_quota_operation%ROWTYPE;
+BEGIN
+    IF pg_catalog.octet_length(p_idempotency_key_hash) <> 32
+       OR pg_catalog.octet_length(p_request_hash) <> 32
+       OR pg_catalog.octet_length(p_quota_principal_hash) <> 32
+       OR (p_quota_operation_hash IS NULL)
+          <> (p_quota_lease_owner_hash IS NULL)
+       OR (p_quota_operation_hash IS NOT NULL
+           AND (pg_catalog.octet_length(p_quota_operation_hash) <> 32
+                OR pg_catalog.octet_length(p_quota_lease_owner_hash) <> 32)) THEN
+        RAISE EXCEPTION USING ERRCODE = '22023',
+            MESSAGE = 'invalid registry-client idempotency binding';
+    END IF;
+    PERFORM pg_catalog.pg_advisory_xact_lock(5642808141211099137);
+    v_now := pg_catalog.clock_timestamp();
+    IF p_quota_limit IS NOT NULL THEN
+        INSERT INTO registry_notary_private.machine_quota (
+            principal_hash, window_started_at, window_expires_at, used
+        ) VALUES (
+            p_quota_principal_hash, v_now, v_now + interval '1 minute', 0
+        ) ON CONFLICT (principal_hash) DO NOTHING;
+        SELECT * INTO STRICT v_quota
+          FROM registry_notary_private.machine_quota
+         WHERE principal_hash = p_quota_principal_hash
+         FOR UPDATE;
+        v_now := pg_catalog.clock_timestamp();
+        IF v_quota.window_expires_at <= v_now THEN
+            UPDATE registry_notary_private.machine_quota
+               SET window_started_at = v_now,
+                   window_expires_at = v_now + interval '1 minute',
+                   used = 0
+             WHERE principal_hash = p_quota_principal_hash;
+            v_quota.window_expires_at := v_now + interval '1 minute';
+            v_quota.used := 0;
+        END IF;
+    END IF;
+    IF p_quota_operation_hash IS NOT NULL THEN
+        SELECT * INTO v_quota_operation
+          FROM registry_notary_private.machine_quota_operation AS operation
+         WHERE operation.principal_hash = p_quota_principal_hash
+           AND operation.operation_hash = p_quota_operation_hash
+         FOR UPDATE;
+        v_now := pg_catalog.clock_timestamp();
+        IF NOT FOUND
+           OR v_quota_operation.request_hash <> p_request_hash
+           OR v_quota_operation.lease_owner_hash <> p_quota_lease_owner_hash
+           OR v_quota_operation.lease_expires_at <= v_now
+           OR v_quota_operation.expires_at <= v_now THEN
+            RETURN QUERY SELECT -6::smallint, NULL::bytea, NULL::bytea,
+                NULL::bytea, NULL::timestamptz, NULL::bigint;
+            RETURN;
+        END IF;
+    END IF;
+    IF EXISTS (
+        SELECT 1 FROM registry_notary_private.preauthorization_login_state AS login
+         WHERE login.expires_at > v_now AND login.key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.preauthorization_tx_code AS tx_code
+         WHERE tx_code.expires_at > v_now AND tx_code.key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction AS transaction
+         WHERE transaction.expires_at > v_now AND transaction.key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption AS consumption
+         WHERE consumption.expires_at > v_now AND consumption.key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.registry_client_offer AS offer
+         WHERE offer.purge_after > v_now AND offer.key_id <> p_key_id
+    ) THEN
+        RAISE EXCEPTION USING ERRCODE = '55000',
+            MESSAGE = 'sensitive-state key generation mismatch';
+    END IF;
+    LOCK TABLE registry_notary_private.oid4vci_issuance_transaction,
+               registry_notary_private.preauthorization_tx_code,
+               registry_notary_private.issuance_evaluation_consumption,
+               registry_notary_private.registry_client_offer
+        IN SHARE ROW EXCLUSIVE MODE;
+    DELETE FROM registry_notary_private.oid4vci_issuance_transaction
+     WHERE expires_at <= v_now;
+    DELETE FROM registry_notary_private.preauthorization_tx_code
+     WHERE expires_at <= v_now;
+    DELETE FROM registry_notary_private.issuance_evaluation_consumption
+     WHERE expires_at <= v_now;
+    DELETE FROM registry_notary_private.registry_client_offer
+     WHERE purge_after <= v_now;
+
+    SELECT * INTO v_stored
+      FROM registry_notary_private.registry_client_offer
+     WHERE idempotency_key_hash = p_idempotency_key_hash
+     FOR UPDATE;
+    IF FOUND THEN
+        IF v_stored.request_hash <> p_request_hash THEN
+            RETURN QUERY SELECT 0::smallint, NULL::bytea, NULL::bytea,
+                NULL::bytea, NULL::timestamptz, NULL::bigint;
+        ELSIF v_stored.retention_expires_at > v_now THEN
+            RETURN QUERY SELECT 2::smallint, v_stored.key_id,
+                v_stored.response_aead_nonce, v_stored.response_ciphertext,
+                v_stored.retention_expires_at, 0::bigint;
+        ELSE
+            RETURN QUERY SELECT -2::smallint, NULL::bytea, NULL::bytea,
+                NULL::bytea, NULL::timestamptz, NULL::bigint;
+        END IF;
+        RETURN;
+    END IF;
+
+    IF pg_catalog.octet_length(p_evaluation_hash) <> 32
+       OR pg_catalog.octet_length(p_transaction_hash) <> 32
+       OR pg_catalog.octet_length(p_jti_hash) <> 32
+       OR pg_catalog.octet_length(p_key_id) <> 32
+       OR p_quota_cost <= 0
+       OR (p_quota_limit IS NOT NULL AND p_quota_limit <= 0)
+       OR p_commitment !~ '^sha256:[0-9a-f]{64}$'
+       OR (p_pin_verifier IS NULL) <> (p_pin_length IS NULL)
+       OR (p_pin_verifier IS NOT NULL
+           AND (pg_catalog.octet_length(p_pin_verifier) <> 32
+                OR p_pin_length NOT BETWEEN 4 AND 12)) THEN
+        RAISE EXCEPTION USING ERRCODE = '22023',
+            MESSAGE = 'invalid registry-client offer reservation';
+    END IF;
+    IF p_code_expires_at <= v_now
+       OR p_transaction_expires_at < p_code_expires_at
+       OR p_evaluation_expires_at <= v_now
+       OR p_retention_expires_at < p_code_expires_at THEN
+        RETURN QUERY SELECT -4::smallint, NULL::bytea, NULL::bytea,
+            NULL::bytea, NULL::timestamptz, NULL::bigint;
+        RETURN;
+    END IF;
+    IF EXISTS (
+        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
+         WHERE evaluation_hash = p_evaluation_hash
+           AND expires_at > v_now
+    ) THEN
+        RETURN QUERY SELECT -2::smallint, NULL::bytea, NULL::bytea,
+            NULL::bytea, NULL::timestamptz, NULL::bigint;
+        RETURN;
+    END IF;
+    IF EXISTS (
+        SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction
+         WHERE transaction_hash = p_transaction_hash
+    ) OR EXISTS (
+        SELECT 1 FROM registry_notary_private.preauthorization_tx_code
+         WHERE jti_hash = p_jti_hash
+    ) THEN
+        RETURN QUERY SELECT -3::smallint, NULL::bytea, NULL::bytea,
+            NULL::bytea, NULL::timestamptz, NULL::bigint;
+        RETURN;
+    END IF;
+    SELECT pg_catalog.count(*) INTO v_count
+      FROM registry_notary_private.oid4vci_issuance_transaction;
+    IF v_count >= 4096 THEN
+        RETURN QUERY SELECT -1::smallint, NULL::bytea, NULL::bytea,
+            NULL::bytea, NULL::timestamptz, NULL::bigint;
+        RETURN;
+    END IF;
+    SELECT pg_catalog.count(*) INTO v_count
+      FROM registry_notary_private.registry_client_offer;
+    IF v_count >= 4096 THEN
+        RETURN QUERY SELECT -1::smallint, NULL::bytea, NULL::bytea,
+            NULL::bytea, NULL::timestamptz, NULL::bigint;
+        RETURN;
+    END IF;
+    SELECT pg_catalog.count(*) INTO v_count
+      FROM registry_notary_private.issuance_evaluation_consumption;
+    IF v_count >= 4096 THEN
+        RETURN QUERY SELECT -1::smallint, NULL::bytea, NULL::bytea,
+            NULL::bytea, NULL::timestamptz, NULL::bigint;
+        RETURN;
+    END IF;
+
+    IF p_quota_limit IS NOT NULL THEN
+        IF p_quota_cost > p_quota_limit - v_quota.used THEN
+            RETURN QUERY SELECT -5::smallint, NULL::bytea, NULL::bytea,
+                NULL::bytea, NULL::timestamptz,
+                GREATEST(1::bigint, CEIL(EXTRACT(EPOCH FROM
+                    (v_quota.window_expires_at - v_now)))::bigint);
+            RETURN;
+        END IF;
+        UPDATE registry_notary_private.machine_quota
+           SET used = used + p_quota_cost
+         WHERE principal_hash = p_quota_principal_hash;
+    END IF;
+
+    INSERT INTO registry_notary_private.oid4vci_issuance_transaction (
+        transaction_hash, key_id, credential_configuration_id, commitment,
+        record_aead_nonce, record_ciphertext, state, created_at, updated_at, expires_at
+    ) VALUES (
+        p_transaction_hash, p_key_id, p_configuration_id, p_commitment,
+        p_record_aead_nonce, p_record_ciphertext, 'ready', v_now, v_now,
+        p_transaction_expires_at
+    );
+    IF p_pin_verifier IS NOT NULL THEN
+        INSERT INTO registry_notary_private.preauthorization_tx_code (
+            jti_hash, key_id, pin_verifier, pin_length, created_at, expires_at
+        ) VALUES (
+            p_jti_hash, p_key_id, p_pin_verifier, p_pin_length, v_now,
+            p_code_expires_at
+        );
+    END IF;
+    INSERT INTO registry_notary_private.issuance_evaluation_consumption (
+        evaluation_hash, key_id, created_at, expires_at
+    ) VALUES (p_evaluation_hash, p_key_id, v_now, p_evaluation_expires_at);
+    INSERT INTO registry_notary_private.registry_client_offer (
+        idempotency_key_hash, request_hash, evaluation_hash, transaction_hash,
+        key_id, response_aead_nonce, response_ciphertext, retention_expires_at,
+        evaluation_expires_at, purge_after, created_at
+    ) VALUES (
+        p_idempotency_key_hash, p_request_hash, p_evaluation_hash,
+        p_transaction_hash, p_key_id, p_response_aead_nonce,
+        p_response_ciphertext, p_retention_expires_at,
+        p_evaluation_expires_at,
+        GREATEST(p_retention_expires_at, p_evaluation_expires_at), v_now
+    );
+    RETURN QUERY SELECT 1::smallint, NULL::bytea, NULL::bytea,
+        NULL::bytea, NULL::timestamptz, 0::bigint;
+END
+$function$;
+
+CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_reserve_v1(
     p_transaction_hash bytea,
     p_key_id bytea,
     p_configuration_id text,
@@ -1376,6 +1988,12 @@ BEGIN
         UNION ALL
         SELECT 1 FROM registry_notary_private.oid4vci_issuance_transaction
          WHERE expires_at > v_now AND key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
+         WHERE expires_at > v_now AND key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.registry_client_offer
+         WHERE purge_after > v_now AND key_id <> p_key_id
     ) THEN
         RAISE EXCEPTION USING ERRCODE = '55000',
             MESSAGE = 'sensitive-state key generation mismatch';
@@ -1406,7 +2024,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.oid4vci_transaction_get_v1(p_transaction_hash bytea)
+CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_get_v1(p_transaction_hash bytea)
 RETURNS TABLE (
     key_id bytea,
     credential_configuration_id text,
@@ -1426,7 +2044,7 @@ AS $function$
        AND stored.expires_at > pg_catalog.clock_timestamp()
 $function$;
 
-CREATE FUNCTION registry_notary_api.oid4vci_transaction_bind_nonce_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_bind_nonce_v1(
     p_transaction_hash bytea,
     p_commitment text,
     p_token_nonce_hash bytea
@@ -1448,7 +2066,7 @@ AS $function$
     RETURNING TRUE
 $function$;
 
-CREATE FUNCTION registry_notary_api.oid4vci_transaction_begin_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_begin_v1(
     p_transaction_hash bytea,
     p_commitment text,
     p_configuration_id text,
@@ -1519,7 +2137,7 @@ BEGIN
 END
 $function$;
 
-CREATE FUNCTION registry_notary_api.oid4vci_transaction_complete_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_complete_v1(
     p_transaction_hash bytea,
     p_holder_thumbprint_hash bytea,
     p_request_hash bytea,
@@ -1543,7 +2161,7 @@ AS $function$
     RETURNING TRUE
 $function$;
 
-CREATE FUNCTION registry_notary_api.oid4vci_transaction_fail_v1(
+CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_fail_v1(
     p_transaction_hash bytea,
     p_holder_thumbprint_hash bytea
 )
@@ -1561,7 +2179,7 @@ AS $function$
     RETURNING TRUE
 $function$;
 
-CREATE FUNCTION registry_notary_api.retention_prune_v1(p_batch_size integer)
+CREATE OR REPLACE FUNCTION registry_notary_api.retention_prune_v1(p_batch_size integer)
 RETURNS TABLE (deleted_count bigint, batch_saturated boolean)
 LANGUAGE plpgsql
 SECURITY DEFINER
@@ -1662,6 +2280,22 @@ BEGIN
     v_total := v_total + v_count;
     v_saturated := v_saturated OR v_count = p_batch_size;
 
+    WITH candidates AS (
+        SELECT principal_hash, operation_hash
+          FROM registry_notary_private.machine_quota_operation
+         WHERE expires_at <= v_now
+         ORDER BY expires_at, principal_hash, operation_hash
+         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
+    ), deleted AS (
+        DELETE FROM registry_notary_private.machine_quota_operation AS stored
+         USING candidates
+         WHERE stored.principal_hash = candidates.principal_hash
+           AND stored.operation_hash = candidates.operation_hash
+        RETURNING 1
+    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
+    v_total := v_total + v_count;
+    v_saturated := v_saturated OR v_count = p_batch_size;
+
     WITH candidates AS (
         SELECT bucket_kind, key_hash
           FROM registry_notary_private.subject_access_quota
@@ -1718,6 +2352,36 @@ BEGIN
     v_total := v_total + v_count;
     v_saturated := v_saturated OR v_count = p_batch_size;
 
+    WITH candidates AS (
+        SELECT evaluation_hash
+          FROM registry_notary_private.issuance_evaluation_consumption
+         WHERE expires_at <= v_now
+         ORDER BY expires_at, evaluation_hash
+         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
+    ), deleted AS (
+        DELETE FROM registry_notary_private.issuance_evaluation_consumption AS stored
+         USING candidates
+         WHERE stored.evaluation_hash = candidates.evaluation_hash
+        RETURNING 1
+    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
+    v_total := v_total + v_count;
+    v_saturated := v_saturated OR v_count = p_batch_size;
+
+    WITH candidates AS (
+        SELECT idempotency_key_hash
+          FROM registry_notary_private.registry_client_offer
+         WHERE purge_after <= v_now
+         ORDER BY purge_after, idempotency_key_hash
+         LIMIT p_batch_size FOR UPDATE SKIP LOCKED
+    ), deleted AS (
+        DELETE FROM registry_notary_private.registry_client_offer AS stored
+         USING candidates
+         WHERE stored.idempotency_key_hash = candidates.idempotency_key_hash
+        RETURNING 1
+    ) SELECT pg_catalog.count(*) INTO v_count FROM deleted;
+    v_total := v_total + v_count;
+    v_saturated := v_saturated OR v_count = p_batch_size;
+
     RETURN QUERY SELECT v_total, v_saturated;
 END
 $function$;
diff --git a/crates/registry-notary-server/src/state_plane/migration/tests.rs b/crates/registry-notary-server/src/state_plane/migration/tests.rs
index c455acd6a4..0daf882957 100644
--- a/crates/registry-notary-server/src/state_plane/migration/tests.rs
+++ b/crates/registry-notary-server/src/state_plane/migration/tests.rs
@@ -5,8 +5,12 @@ use std::{path::PathBuf, sync::Arc, time::Duration};
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
 use registry_notary_core::{StateConfig, StatePostgresqlConfig, STATE_STORAGE_POSTGRESQL};
 
+use crate::machine_quota::{MachineQuotaLimiter, MachineQuotaOperationOutcome};
 use crate::preauth_state::{
-    CredentialMaterialization, IssuanceTransaction, LoginState, PreauthorizationState,
+    CredentialMaterialization, IssuanceAuthority, IssuanceTransaction, LoginState,
+    PreauthorizationState, PreauthorizationStateError, RegistryClientOfferPreflightOutcome,
+    RegistryClientOfferReservation, RegistryClientOfferReservationOutcome,
+    RegistryClientOfferResponse, RegistryClientTransactionCode,
 };
 use crate::state_plane::{
     attest_postgres_state_plane_runtime, LoginReserveOutcome, NotaryPostgresStatePlaneError,
@@ -26,6 +30,9 @@ const SENSITIVE_PROBE_PIN_ENV: &str = "REGISTRY_NOTARY_STATE_SENSITIVE_PROBE_PIN
 const OWNER_ROLE: &str = "registry_notary_owner_test";
 const RUNTIME_ROLE: &str = "registry_notary_runtime_test";
 const MIGRATION_ROLE: &str = "registry_notary_migration_test";
+const UPGRADE_OWNER_ROLE: &str = "registry_notary_upgrade_owner_test";
+const UPGRADE_RUNTIME_ROLE: &str = "registry_notary_upgrade_runtime_test";
+const UPGRADE_MIGRATION_ROLE: &str = "registry_notary_upgrade_migration_test";
 const RESTORE_SOURCE_OWNER_ROLE: &str = "registry_notary_restore_source_owner";
 const RESTORE_SOURCE_RUNTIME_ROLE: &str = "registry_notary_restore_source_runtime";
 const RESTORE_SOURCE_MIGRATION_ROLE: &str = "registry_notary_restore_source_migration";
@@ -48,12 +55,14 @@ fn schema_fingerprint_is_the_framed_semantic_identity() {
         "evaluation=client-bound-stored-record-v2-atomic-publication-expiry-v1",
         "batch=keyed-request-owner-lease-quota-once-takeover-atomic-completion-stored-response-v2-fifteen-minute-retention-v1",
         "credential-status=insert-only-locked-transition-terminal-revocation-database-clock-effective-expiry-before-suspension-retention-monotonic-updated-at-v2",
-        "machine-quota=keyed-principal-fixed-minute-whole-cost-atomic-v1",
+        "machine-quota=keyed-principal-fixed-minute-whole-cost-atomic-quota-independent-idempotency-request-conflict-owner-sixty-second-lease-renewal-bounded-completion-final-owner-fence-evaluation-retention-takeover-v4",
         "subject-access-quota=keyed-pseudonym-six-closed-buckets-fixed-windows-canonical-lock-order-caller-denial-order-atomic-all-or-none-check-only-no-mutation-v1",
         "preauthorization-login=keyed-state-capacity-4096-encrypted-single-consume-expiry-live-key-attestation-v2",
         "preauthorization-tx-code=verified-notary-issuer-stable-scope-jti-keyed-pin-verifier-peek-redeem-one-winner-expiry-live-key-attestation-v3",
         "oid4vci-issuance-transaction=keyed-id-encrypted-immutable-record-sha256-uri-commitment-token-nonce-bind-holder-and-request-atomic-one-materialization-encrypted-response-terminal-failure-expiry-v2",
-        "retention=bounded-expiry-prune-skip-locked-saturation-catch-up-v2",
+        "issuance-evaluation-consumption=keyed-owner-evaluation-single-lineage-shared-direct-and-offer-expiry-capacity-v1",
+        "registry-client-offer=hashed-idempotency-exact-encrypted-response-read-only-preflight-before-side-effects-shared-evaluation-consumption-atomic-client-quota-transaction-and-optional-pin-expiry-capacity-v3",
+        "retention=thirteen-fixed-groups-bounded-expiry-prune-skip-locked-saturation-catch-up-v3",
     ] {
         assert!(
             STATE_PLANE_SCHEMA_IDENTITY_PREIMAGE_V1.contains(semantic_revision),
@@ -106,15 +115,282 @@ fn migration_uses_fixed_security_definer_api_without_generic_grants() {
         "batch_idempotency",
         "credential_status",
         "machine_quota",
+        "machine_quota_operation",
         "subject_access_quota",
         "preauthorization_login_state",
         "preauthorization_tx_code",
         "oid4vci_issuance_transaction",
+        "issuance_evaluation_consumption",
+        "registry_client_offer",
     ] {
         assert!(POSTGRES_STATE_PLANE_MIGRATION_V1.contains(table));
     }
 }
 
+fn previous_state_plane_migration_v1() -> String {
+    fn remove_unique_range(sql: &mut String, start: &str, end: &str) {
+        assert_eq!(
+            sql.matches(start).count(),
+            1,
+            "previous migration start marker must be unique"
+        );
+        let start_offset = sql.find(start).expect("checked start marker");
+        let end_offset = sql[start_offset..]
+            .find(end)
+            .map(|offset| start_offset + offset)
+            .expect("previous migration end marker");
+        sql.replace_range(start_offset..end_offset, "");
+    }
+
+    let mut sql = POSTGRES_STATE_PLANE_MIGRATION_V1.to_string();
+    remove_unique_range(
+        &mut sql,
+        "CREATE TABLE IF NOT EXISTS registry_notary_private.machine_quota_operation",
+        "CREATE TABLE IF NOT EXISTS registry_notary_private.subject_access_quota",
+    );
+    remove_unique_range(
+        &mut sql,
+        "CREATE TABLE IF NOT EXISTS registry_notary_private.issuance_evaluation_consumption",
+        "ALTER DEFAULT PRIVILEGES IN SCHEMA registry_notary_private",
+    );
+    remove_unique_range(
+        &mut sql,
+        "CREATE OR REPLACE FUNCTION registry_notary_api.evaluation_issuance_consume_v1",
+        "CREATE OR REPLACE FUNCTION registry_notary_api.oid4vci_transaction_reserve_v1",
+    );
+    remove_unique_range(
+        &mut sql,
+        "CREATE OR REPLACE FUNCTION registry_notary_api.machine_quota_debit_once_v1",
+        "CREATE OR REPLACE FUNCTION registry_notary_api.subject_access_quota_debit_v1",
+    );
+
+    let v_now_key_extension = r#"        UNION ALL
+        SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
+         WHERE expires_at > v_now AND key_id <> p_key_id
+        UNION ALL
+        SELECT 1 FROM registry_notary_private.registry_client_offer
+         WHERE purge_after > v_now AND key_id <> p_key_id
+"#;
+    assert_eq!(sql.matches(v_now_key_extension).count(), 3);
+    sql = sql.replace(v_now_key_extension, "");
+    let statement_key_extension = r#"            UNION ALL
+            SELECT 1 FROM registry_notary_private.issuance_evaluation_consumption
+             WHERE expires_at > pg_catalog.statement_timestamp() AND key_id <> p_key_id
+            UNION ALL
+            SELECT 1 FROM registry_notary_private.registry_client_offer
+             WHERE purge_after > pg_catalog.statement_timestamp() AND key_id <> p_key_id
+"#;
+    assert_eq!(sql.matches(statement_key_extension).count(), 1);
+    sql = sql.replace(statement_key_extension, "");
+    remove_unique_range(
+        &mut sql,
+        r#"    WITH candidates AS (
+        SELECT principal_hash, operation_hash
+          FROM registry_notary_private.machine_quota_operation"#,
+        r#"    WITH candidates AS (
+        SELECT bucket_kind, key_hash
+          FROM registry_notary_private.subject_access_quota"#,
+    );
+    remove_unique_range(
+        &mut sql,
+        r#"    WITH candidates AS (
+        SELECT evaluation_hash
+          FROM registry_notary_private.issuance_evaluation_consumption"#,
+        "    RETURN QUERY SELECT v_total, v_saturated;",
+    );
+    assert_eq!(sql.matches("SECURITY DEFINER").count(), 31);
+    assert!(!sql.contains("issuance_evaluation_consumption"));
+    assert!(!sql.contains("registry_client_offer"));
+    assert!(!sql.contains("machine_quota_operation"));
+    sql
+}
+
+#[test]
+fn preceding_migration_fixture_is_exactly_narrowed() {
+    previous_state_plane_migration_v1();
+}
+
+async fn assert_previous_state_plane_upgrade_contract(
+    database_url: &str,
+    admin: &Client,
+) -> Result<(), Box<dyn std::error::Error>> {
+    admin
+        .batch_execute(&format!(
+            "CREATE ROLE {UPGRADE_OWNER_ROLE} NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE \
+                 NOREPLICATION NOBYPASSRLS;\n\
+             CREATE ROLE {UPGRADE_RUNTIME_ROLE} LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE \
+                 NOREPLICATION NOBYPASSRLS;\n\
+             CREATE ROLE {UPGRADE_MIGRATION_ROLE} LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE \
+                 NOREPLICATION NOBYPASSRLS;\n\
+             GRANT {UPGRADE_OWNER_ROLE} TO {UPGRADE_MIGRATION_ROLE};\n\
+             GRANT CREATE ON DATABASE postgres TO {UPGRADE_OWNER_ROLE};"
+        ))
+        .await?;
+    let (mut migration, migration_driver) =
+        connect_as(database_url, UPGRADE_MIGRATION_ROLE).await?;
+    let transaction = migration.transaction().await?;
+    transaction
+        .batch_execute(&format!(
+            "SET LOCAL ROLE {UPGRADE_OWNER_ROLE};\n{}",
+            previous_state_plane_migration_v1()
+        ))
+        .await?;
+    let roles = transaction
+        .query_one(
+            "SELECT owner.oid::bigint, runtime.oid::bigint\n\
+               FROM pg_catalog.pg_roles AS owner\n\
+               JOIN pg_catalog.pg_roles AS runtime ON runtime.rolname = $2\n\
+              WHERE owner.rolname = $1",
+            &[&UPGRADE_OWNER_ROLE, &UPGRADE_RUNTIME_ROLE],
+        )
+        .await?;
+    let owner_oid: i64 = roles.get(0);
+    let runtime_oid: i64 = roles.get(1);
+    transaction
+        .execute(
+            "INSERT INTO registry_notary_private.schema_metadata (\n\
+                 singleton, capability_id, schema_version, schema_fingerprint,\n\
+                 owner_role_oid, runtime_role_oid\n\
+             ) VALUES (TRUE, $1, $2, $3, $4::bigint::oid, $5::bigint::oid)",
+            &[
+                &STATE_PLANE_CAPABILITY_V1,
+                &STATE_PLANE_SCHEMA_VERSION_V1,
+                &PREVIOUS_STATE_PLANE_SCHEMA_FINGERPRINT_V1,
+                &owner_oid,
+                &runtime_oid,
+            ],
+        )
+        .await?;
+    let live_scope = vec![0xa1_u8; 32];
+    let live_identifier = vec![0xa2_u8; 32];
+    let live_state = vec![0xa3_u8; 32];
+    let live_key = vec![0xa4_u8; 32];
+    transaction
+        .execute(
+            "INSERT INTO registry_notary_private.replay_identifier (\n\
+                 scope_hash, identifier_hash, expires_at\n\
+             ) VALUES ($1, $2, pg_catalog.clock_timestamp() + interval '1 hour')",
+            &[&live_scope, &live_identifier],
+        )
+        .await?;
+    transaction
+        .execute(
+            "INSERT INTO registry_notary_private.preauthorization_login_state (\n\
+                 state_hash, credential_configuration_id, key_id, aead_nonce,\n\
+                 ciphertext, expires_at\n\
+             ) VALUES ($1, 'upgrade-live-state', $2, $3, $4,\n\
+                 pg_catalog.clock_timestamp() + interval '1 hour')",
+            &[
+                &live_state,
+                &live_key,
+                &vec![0xa5_u8; 12],
+                &vec![0xa6_u8; 17],
+            ],
+        )
+        .await?;
+    transaction.commit().await?;
+
+    let server_major = attest_server(admin).await?;
+    assert_eq!(
+        catalog_definition_fingerprint(admin).await?,
+        expected_previous_catalog_definition_fingerprint(server_major)?,
+        "the upgrade fixture must exactly reproduce the preceding catalog"
+    );
+    let installed = install_postgres_state_plane_v1(
+        &mut migration,
+        &OwnerDatabaseRole::parse(UPGRADE_OWNER_ROLE)?,
+        &RuntimeDatabaseRole::parse(UPGRADE_RUNTIME_ROLE)?,
+    )
+    .await?;
+    assert_eq!(installed.server_major, server_major);
+    assert_eq!(
+        admin
+            .query_one(
+                "SELECT schema_fingerprint FROM registry_notary_private.schema_metadata",
+                &[],
+            )
+            .await?
+            .get::<_, String>(0),
+        STATE_PLANE_SCHEMA_FINGERPRINT_V1
+    );
+    assert_eq!(
+        admin
+            .query_one(
+                "SELECT count(*)::bigint FROM registry_notary_private.replay_identifier\n\
+                  WHERE scope_hash = $1 AND identifier_hash = $2",
+                &[&live_scope, &live_identifier],
+            )
+            .await?
+            .get::<_, i64>(0),
+        1,
+        "forward migration must preserve preceding live rows"
+    );
+    assert_eq!(
+        admin
+            .query_one(
+                "SELECT count(*)::bigint\n\
+                   FROM registry_notary_private.preauthorization_login_state\n\
+                  WHERE state_hash = $1 AND key_id = $2",
+                &[&live_state, &live_key],
+            )
+            .await?
+            .get::<_, i64>(0),
+        1,
+        "forward migration must preserve preceding live sensitive rows"
+    );
+    let new_table_counts = admin
+        .query_one(
+            "SELECT\n\
+                 (SELECT count(*)::bigint FROM \
+                    registry_notary_private.issuance_evaluation_consumption),\n\
+                 (SELECT count(*)::bigint FROM \
+                    registry_notary_private.registry_client_offer),\n\
+                 (SELECT count(*)::bigint FROM \
+                    registry_notary_private.machine_quota_operation)",
+            &[],
+        )
+        .await?;
+    assert_eq!(new_table_counts.get::<_, i64>(0), 0);
+    assert_eq!(new_table_counts.get::<_, i64>(1), 0);
+    assert_eq!(new_table_counts.get::<_, i64>(2), 0);
+
+    let (runtime, runtime_driver) = connect_as(database_url, UPGRADE_RUNTIME_ROLE).await?;
+    assert_eq!(attest_postgres_state_plane_v1(&runtime).await?, installed);
+    assert_eq!(
+        runtime
+            .query_one(
+                "SELECT registry_notary_api.evaluation_issuance_consume_v1(\n\
+                     $1, $2, pg_catalog.clock_timestamp() + interval '1 hour')",
+                &[&vec![0xa7_u8; 32], &live_key],
+            )
+            .await?
+            .get::<_, i16>(0),
+        1
+    );
+    install_postgres_state_plane_v1(
+        &mut migration,
+        &OwnerDatabaseRole::parse(UPGRADE_OWNER_ROLE)?,
+        &RuntimeDatabaseRole::parse(UPGRADE_RUNTIME_ROLE)?,
+    )
+    .await?;
+
+    drop(runtime);
+    runtime_driver.abort();
+    drop(migration);
+    migration_driver.abort();
+    admin
+        .batch_execute(&format!(
+            "DROP SCHEMA registry_notary_api CASCADE;\n\
+             DROP SCHEMA registry_notary_private CASCADE;\n\
+             DROP ROLE {UPGRADE_RUNTIME_ROLE};\n\
+             DROP ROLE {UPGRADE_MIGRATION_ROLE};\n\
+             REVOKE CREATE ON DATABASE postgres FROM {UPGRADE_OWNER_ROLE};\n\
+             DROP ROLE {UPGRADE_OWNER_ROLE};"
+        ))
+        .await?;
+    Ok(())
+}
+
 #[tokio::test]
 #[ignore = "requires a dedicated REGISTRY_NOTARY_STATE_POSTGRES_TEST_URL"]
 async fn postgres_v1_logical_restore_rebind_requires_exact_owner_and_catalog(
@@ -373,14 +649,22 @@ async fn postgres_v1_typed_state_contracts_and_drift_rejection(
             "SELECT EXISTS (SELECT 1 FROM pg_catalog.pg_namespace\n\
                WHERE nspname IN ('registry_notary_private', 'registry_notary_api'))\n\
              OR EXISTS (SELECT 1 FROM pg_catalog.pg_roles\n\
-               WHERE rolname IN ($1, $2, $3))",
-            &[&OWNER_ROLE, &RUNTIME_ROLE, &MIGRATION_ROLE],
+               WHERE rolname IN ($1, $2, $3, $4, $5, $6))",
+            &[
+                &OWNER_ROLE,
+                &RUNTIME_ROLE,
+                &MIGRATION_ROLE,
+                &UPGRADE_OWNER_ROLE,
+                &UPGRADE_RUNTIME_ROLE,
+                &UPGRADE_MIGRATION_ROLE,
+            ],
         )
         .await?
         .get(0);
     if occupied {
         return Err("the dedicated conformance database is not empty".into());
     }
+    assert_previous_state_plane_upgrade_contract(&database_url, &admin).await?;
     admin
         .batch_execute(&format!(
             "CREATE ROLE {OWNER_ROLE} NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE \
@@ -1359,6 +1643,215 @@ async fn assert_credential_status_and_machine_quota_contracts(
     assert!(!denied.get::<_, bool>("allowed"));
     assert_eq!(denied.get::<_, i32>("remaining"), 0);
     assert!(denied.get::<_, i64>("retry_after_seconds") >= 1);
+
+    let once_principal = vec![0x86_u8; 32];
+    let exact_operation = vec![0x87_u8; 32];
+    let distinct_operation = vec![0x88_u8; 32];
+    let exact_request = vec![0x8b_u8; 32];
+    let first_owner = vec![0x89_u8; 32];
+    let takeover_owner = vec![0x8a_u8; 32];
+    let operation_expires_at = time::OffsetDateTime::now_utc() + time::Duration::minutes(10);
+    let (quota_peer, quota_peer_driver) = connect_as(database_url, RUNTIME_ROLE).await?;
+    let first_args: [&(dyn tokio_postgres::types::ToSql + Sync); 5] = [
+        &once_principal,
+        &exact_operation,
+        &exact_request,
+        &first_owner,
+        &operation_expires_at,
+    ];
+    let retry_args: [&(dyn tokio_postgres::types::ToSql + Sync); 5] = [
+        &once_principal,
+        &exact_operation,
+        &exact_request,
+        &takeover_owner,
+        &operation_expires_at,
+    ];
+    let (first, exact_retry) = tokio::join!(
+        runtime.query_one(
+            "SELECT allowed, acquired, remaining FROM \
+             registry_notary_api.machine_quota_debit_once_v1(\
+                 $1, $2, $3, $4, 1, 1, 60, $5)",
+            &first_args,
+        ),
+        quota_peer.query_one(
+            "SELECT allowed, acquired, remaining FROM \
+             registry_notary_api.machine_quota_debit_once_v1(\
+                 $1, $2, $3, $4, 1, 1, 60, $5)",
+            &retry_args,
+        ),
+    );
+    let first = first?;
+    let exact_retry = exact_retry?;
+    assert!(first.get::<_, bool>("allowed"));
+    assert_eq!(first.get::<_, i32>("remaining"), 0);
+    assert!(exact_retry.get::<_, bool>("allowed"));
+    assert_eq!(exact_retry.get::<_, i32>("remaining"), 0);
+    let first_acquired = first.get::<_, bool>("acquired");
+    let retry_acquired = exact_retry.get::<_, bool>("acquired");
+    assert_ne!(
+        first_acquired, retry_acquired,
+        "exact operations racing on separate connections have one lease owner"
+    );
+    let (acquired_owner, waiting_owner) = if first_acquired {
+        (&first_owner, &takeover_owner)
+    } else {
+        (&takeover_owner, &first_owner)
+    };
+    assert!(runtime
+        .query_one(
+            "SELECT registry_notary_api.machine_quota_operation_release_v1($1, $2, $3)",
+            &[&once_principal, &exact_operation, acquired_owner],
+        )
+        .await?
+        .get::<_, bool>(0));
+    let takeover = runtime
+        .query_one(
+            "SELECT allowed, acquired, remaining FROM \
+             registry_notary_api.machine_quota_debit_once_v1(\
+                 $1, $2, $3, $4, 1, 1, 60, $5)",
+            &[
+                &once_principal,
+                &exact_operation,
+                &exact_request,
+                waiting_owner,
+                &operation_expires_at,
+            ],
+        )
+        .await?;
+    assert!(takeover.get::<_, bool>("allowed"));
+    assert!(takeover.get::<_, bool>("acquired"));
+    assert_eq!(takeover.get::<_, i32>("remaining"), 0);
+    assert!(!runtime
+        .query_one(
+            "SELECT allowed FROM \
+             registry_notary_api.machine_quota_debit_once_v1(\
+                 $1, $2, $3, $4, 1, 1, 60, $5)",
+            &[
+                &once_principal,
+                &distinct_operation,
+                &exact_request,
+                &takeover_owner,
+                &operation_expires_at,
+            ],
+        )
+        .await?
+        .get::<_, bool>("allowed"));
+
+    let conflict_principal = vec![0x8c_u8; 32];
+    let conflict_operation = vec![0x8d_u8; 32];
+    let request_a = vec![0x8e_u8; 32];
+    let request_b = vec![0x8f_u8; 32];
+    let conflict_a_args: [&(dyn tokio_postgres::types::ToSql + Sync); 5] = [
+        &conflict_principal,
+        &conflict_operation,
+        &request_a,
+        &first_owner,
+        &operation_expires_at,
+    ];
+    let conflict_b_args: [&(dyn tokio_postgres::types::ToSql + Sync); 5] = [
+        &conflict_principal,
+        &conflict_operation,
+        &request_b,
+        &takeover_owner,
+        &operation_expires_at,
+    ];
+    let conflict_a = runtime.query_one(
+        "SELECT allowed, acquired, conflict FROM \
+         registry_notary_api.machine_quota_debit_once_v1(\
+             $1, $2, $3, $4, 2, 1, 60, $5)",
+        &conflict_a_args,
+    );
+    let conflict_b = quota_peer.query_one(
+        "SELECT allowed, acquired, conflict FROM \
+         registry_notary_api.machine_quota_debit_once_v1(\
+             $1, $2, $3, $4, 2, 1, 60, $5)",
+        &conflict_b_args,
+    );
+    let (conflict_a, conflict_b) = tokio::join!(conflict_a, conflict_b);
+    let conflict_a = conflict_a?;
+    let conflict_b = conflict_b?;
+    assert!(conflict_a.get::<_, bool>("allowed"));
+    assert!(conflict_b.get::<_, bool>("allowed"));
+    assert_eq!(
+        [
+            conflict_a.get::<_, bool>("acquired"),
+            conflict_b.get::<_, bool>("acquired"),
+        ]
+        .into_iter()
+        .filter(|acquired| *acquired)
+        .count(),
+        1,
+    );
+    assert_eq!(
+        [
+            conflict_a.get::<_, bool>("conflict"),
+            conflict_b.get::<_, bool>("conflict"),
+        ]
+        .into_iter()
+        .filter(|conflict| *conflict)
+        .count(),
+        1,
+    );
+    assert_eq!(
+        admin
+            .query_one(
+                "SELECT used FROM registry_notary_private.machine_quota \
+                 WHERE principal_hash = $1",
+                &[&conflict_principal],
+            )
+            .await?
+            .get::<_, i32>("used"),
+        1,
+        "request-shape conflict must not debit the idempotency operation twice",
+    );
+
+    let disabled_principal = vec![0x90_u8; 32];
+    let disabled_operation = vec![0x91_u8; 32];
+    let disabled_request = vec![0x92_u8; 32];
+    let disabled_first = runtime
+        .query_one(
+            "SELECT acquired FROM registry_notary_api.machine_quota_debit_once_v1(\
+                 $1, $2, $3, $4, NULL::integer, 1, 60, $5)",
+            &[
+                &disabled_principal,
+                &disabled_operation,
+                &disabled_request,
+                &first_owner,
+                &operation_expires_at,
+            ],
+        )
+        .await?;
+    assert!(disabled_first.get::<_, bool>("acquired"));
+    let disabled_retry = quota_peer
+        .query_one(
+            "SELECT acquired, conflict FROM \
+             registry_notary_api.machine_quota_debit_once_v1(\
+                 $1, $2, $3, $4, NULL::integer, 1, 60, $5)",
+            &[
+                &disabled_principal,
+                &disabled_operation,
+                &disabled_request,
+                &takeover_owner,
+                &operation_expires_at,
+            ],
+        )
+        .await?;
+    assert!(!disabled_retry.get::<_, bool>("acquired"));
+    assert!(!disabled_retry.get::<_, bool>("conflict"));
+    assert_eq!(
+        admin
+            .query_one(
+                "SELECT used FROM registry_notary_private.machine_quota \
+                 WHERE principal_hash = $1",
+                &[&disabled_principal],
+            )
+            .await?
+            .get::<_, i32>("used"),
+        0,
+        "disabled quota retains ownership without charging budget",
+    );
+    drop(quota_peer);
+    quota_peer_driver.abort();
     Ok(())
 }
 
@@ -2050,8 +2543,9 @@ async fn assert_sensitive_adapter_contract(
             .await?
     );
 
-    let preauthorization_state =
-        PreauthorizationState::from_state_plane(Arc::clone(&readiness_handle))?;
+    let preauthorization_state = Arc::new(PreauthorizationState::from_state_plane(Arc::clone(
+        &readiness_handle,
+    ))?);
     let mismatch_jti = "adapter-policy-mismatch-jti";
     assert!(
         preauthorization_state
@@ -2093,6 +2587,7 @@ async fn assert_sensitive_adapter_contract(
         evaluation_client_id: "hmac-sha256:adapter-client".to_string(),
         credential_configuration_id: "adapter-config".to_string(),
         commitment: format!("sha256:{}", "c".repeat(64)),
+        authority: IssuanceAuthority::SubjectAccess,
     };
     preauthorization_state
         .reserve_issuance_transaction(transaction_id, transaction.clone(), expires_at)
@@ -2102,6 +2597,7 @@ async fn assert_sensitive_adapter_contract(
             .transaction(transaction_id)
             .await?
             .expect("encrypted transaction must round trip")
+            .transaction
             .evaluation_id,
         transaction.evaluation_id.as_str()
     );
@@ -2216,11 +2712,375 @@ async fn assert_sensitive_adapter_contract(
         );
     }
 
+    let offer_now = time::OffsetDateTime::now_utc();
+    let offer_transaction = IssuanceTransaction {
+        transaction_id: "adapter-registry-offer-transaction".to_string(),
+        evaluation_id: "adapter-registry-offer-evaluation".to_string(),
+        evaluation_client_id: "adapter-registry-client".to_string(),
+        credential_configuration_id: "adapter-config".to_string(),
+        commitment: format!("sha256:{}", "e".repeat(64)),
+        authority: IssuanceAuthority::RegistryClient {
+            initiating_client_id: "adapter-registry-client".to_string(),
+            initiating_client_id_hash: format!("hmac-sha256:{}", "f".repeat(64)),
+            auth_profile_id: registry_notary_core::EvidenceAuthProfileId::ExternalOidc,
+            authorized_scopes: vec!["registry:evidence".to_string()],
+            target_ref: registry_notary_core::TargetRefView {
+                entity_type: "Person".to_string(),
+                handle: "adapter-target-handle".to_string(),
+                identifier_schemes: Vec::new(),
+                profile: None,
+            },
+            service_id: "adapter.notary".to_string(),
+            purpose: "civil-registration".to_string(),
+        },
+    };
+    let offer_response = RegistryClientOfferResponse {
+        credential_offer_uri: "openid-credential-offer://adapter-secret-offer".to_string(),
+        tx_code: Some("246810".to_string()),
+        expires_at: "2030-01-01T00:00:00Z".to_string(),
+    };
+    let offer_reservation = |idempotency: char, request: char, transaction: IssuanceTransaction| {
+        RegistryClientOfferReservation {
+            transaction_id: transaction.transaction_id.clone(),
+            evaluation_id: transaction.evaluation_id.clone(),
+            evaluation_expires_at: offer_now + time::Duration::minutes(20),
+            idempotency_key_hash: format!("hmac-sha256:{}", idempotency.to_string().repeat(64)),
+            canonical_request_hash: format!("sha256:{}", request.to_string().repeat(64)),
+            transaction,
+            transaction_code: Some(RegistryClientTransactionCode {
+                pin: "246810".to_string(),
+                pin_length: 6,
+            }),
+            code_expires_at: offer_now + time::Duration::minutes(5),
+            transaction_expires_at: offer_now + time::Duration::minutes(15),
+            response: offer_response.clone(),
+            retention_expires_at: offer_now + time::Duration::minutes(10),
+            quota_principal_hash: vec![0x71; 32],
+            quota_limit: None,
+            quota_cost: 1,
+        }
+    };
+    let before_preflight_rows: i64 = admin
+        .query_one(
+            "SELECT (SELECT count(*) FROM registry_notary_private.registry_client_offer) + \
+                    (SELECT count(*) FROM registry_notary_private.issuance_evaluation_consumption)",
+            &[],
+        )
+        .await?
+        .get(0);
+    assert!(matches!(
+        preauthorization_state
+            .registry_client_offer_preflight(
+                "adapter-registry-offer-evaluation",
+                "adapter-registry-client",
+                &format!("hmac-sha256:{}", "1".repeat(64)),
+                &format!("sha256:{}", "a".repeat(64)),
+            )
+            .await?,
+        RegistryClientOfferPreflightOutcome::Available
+    ));
+    let after_preflight_rows: i64 = admin
+        .query_one(
+            "SELECT (SELECT count(*) FROM registry_notary_private.registry_client_offer) + \
+                    (SELECT count(*) FROM registry_notary_private.issuance_evaluation_consumption)",
+            &[],
+        )
+        .await?
+        .get(0);
+    assert_eq!(
+        after_preflight_rows, before_preflight_rows,
+        "PostgreSQL preflight must not mutate offer or evaluation state",
+    );
+    assert_eq!(
+        preauthorization_state
+            .reserve_registry_client_offer(offer_reservation('1', 'a', offer_transaction.clone(),))
+            .await?,
+        RegistryClientOfferReservationOutcome::Created(offer_response.clone())
+    );
+    assert_eq!(
+        preauthorization_state
+            .registry_client_offer_preflight(
+                "adapter-registry-offer-evaluation",
+                "adapter-registry-client",
+                &format!("hmac-sha256:{}", "1".repeat(64)),
+                &format!("sha256:{}", "a".repeat(64)),
+            )
+            .await?,
+        RegistryClientOfferPreflightOutcome::Replayed(offer_response.clone())
+    );
+    assert!(matches!(
+        preauthorization_state
+            .registry_client_offer_preflight(
+                "adapter-registry-offer-evaluation",
+                "adapter-registry-client",
+                &format!("hmac-sha256:{}", "1".repeat(64)),
+                &format!("sha256:{}", "b".repeat(64)),
+            )
+            .await?,
+        RegistryClientOfferPreflightOutcome::IdempotencyConflict
+    ));
+    assert!(matches!(
+        preauthorization_state
+            .registry_client_offer_preflight(
+                "adapter-registry-offer-evaluation",
+                "adapter-registry-client",
+                &format!("hmac-sha256:{}", "2".repeat(64)),
+                &format!("sha256:{}", "a".repeat(64)),
+            )
+            .await?,
+        RegistryClientOfferPreflightOutcome::EvaluationConsumed
+    ));
+    assert_eq!(
+        preauthorization_state
+            .reserve_registry_client_offer(offer_reservation('1', 'a', offer_transaction.clone(),))
+            .await?,
+        RegistryClientOfferReservationOutcome::Replayed(offer_response.clone())
+    );
+    assert!(matches!(
+        preauthorization_state
+            .reserve_registry_client_offer(offer_reservation('1', 'b', offer_transaction.clone(),))
+            .await,
+        Err(PreauthorizationStateError::IdempotencyConflict)
+    ));
+    let mut other_transaction = offer_transaction.clone();
+    other_transaction.transaction_id = "adapter-other-offer-transaction".to_string();
+    assert!(matches!(
+        preauthorization_state
+            .reserve_registry_client_offer(offer_reservation('2', 'a', other_transaction,))
+            .await,
+        Err(PreauthorizationStateError::EvaluationConsumed)
+    ));
+    assert!(matches!(
+        preauthorization_state
+            .reserve_evaluation_issuance(
+                "adapter-registry-offer-evaluation",
+                "adapter-registry-client",
+                offer_now + time::Duration::minutes(20),
+            )
+            .await,
+        Err(PreauthorizationStateError::EvaluationConsumed)
+    ));
+    preauthorization_state
+        .reserve_evaluation_issuance(
+            "adapter-direct-first-evaluation",
+            "adapter-registry-client",
+            offer_now + time::Duration::minutes(20),
+        )
+        .await?;
+    let mut direct_first_offer = offer_transaction.clone();
+    direct_first_offer.transaction_id = "adapter-direct-first-offer".to_string();
+    direct_first_offer.evaluation_id = "adapter-direct-first-evaluation".to_string();
+    assert!(matches!(
+        preauthorization_state
+            .reserve_registry_client_offer(offer_reservation('3', 'a', direct_first_offer,))
+            .await,
+        Err(PreauthorizationStateError::EvaluationConsumed)
+    ));
+
+    let race_barrier = Arc::new(tokio::sync::Barrier::new(3));
+    let direct_state = Arc::clone(&preauthorization_state);
+    let direct_barrier = Arc::clone(&race_barrier);
+    let direct_race = tokio::spawn(async move {
+        direct_barrier.wait().await;
+        direct_state
+            .reserve_evaluation_issuance(
+                "adapter-raced-evaluation",
+                "adapter-registry-client",
+                offer_now + time::Duration::minutes(20),
+            )
+            .await
+            .map(|()| "direct")
+    });
+    let mut raced_transaction = offer_transaction.clone();
+    raced_transaction.transaction_id = "adapter-raced-offer".to_string();
+    raced_transaction.evaluation_id = "adapter-raced-evaluation".to_string();
+    let raced_offer = offer_reservation('6', 'a', raced_transaction);
+    let offer_state = Arc::clone(&preauthorization_state);
+    let offer_barrier = Arc::clone(&race_barrier);
+    let offer_race = tokio::spawn(async move {
+        offer_barrier.wait().await;
+        offer_state
+            .reserve_registry_client_offer(raced_offer)
+            .await
+            .map(|_| "offer")
+    });
+    race_barrier.wait().await;
+    let race_outcomes = [direct_race.await?, offer_race.await?];
+    assert_eq!(
+        race_outcomes
+            .iter()
+            .filter(|outcome| outcome.is_ok())
+            .count(),
+        1
+    );
+    assert_eq!(
+        race_outcomes
+            .iter()
+            .filter(|outcome| matches!(
+                outcome,
+                Err(PreauthorizationStateError::EvaluationConsumed)
+            ))
+            .count(),
+        1
+    );
+
+    let mut quota_transaction = offer_transaction.clone();
+    quota_transaction.transaction_id = "adapter-quota-offer-one".to_string();
+    quota_transaction.evaluation_id = "adapter-quota-evaluation-one".to_string();
+    let mut quota_offer = offer_reservation('4', 'a', quota_transaction.clone());
+    quota_offer.quota_principal_hash = vec![0xd1; 32];
+    quota_offer.quota_limit = Some(1);
+    assert!(matches!(
+        preauthorization_state
+            .reserve_registry_client_offer(quota_offer)
+            .await?,
+        RegistryClientOfferReservationOutcome::Created(_)
+    ));
+    let mut quota_replay = offer_reservation('4', 'a', quota_transaction);
+    quota_replay.quota_principal_hash = vec![0xd1; 32];
+    quota_replay.quota_limit = Some(1);
+    assert!(matches!(
+        preauthorization_state
+            .reserve_registry_client_offer(quota_replay)
+            .await?,
+        RegistryClientOfferReservationOutcome::Replayed(_)
+    ));
+    let mut quota_denied_transaction = offer_transaction.clone();
+    quota_denied_transaction.transaction_id = "adapter-quota-offer-two".to_string();
+    quota_denied_transaction.evaluation_id = "adapter-quota-evaluation-two".to_string();
+    let mut quota_denied = offer_reservation('5', 'a', quota_denied_transaction);
+    quota_denied.quota_principal_hash = vec![0xd1; 32];
+    quota_denied.quota_limit = Some(1);
+    assert!(matches!(
+        preauthorization_state
+            .reserve_registry_client_offer(quota_denied)
+            .await,
+        Err(PreauthorizationStateError::MachineQuotaExceeded {
+            retry_after_seconds: 1..=60
+        })
+    ));
+
+    let quota_limiter = MachineQuotaLimiter::with_state_plane(
+        registry_notary_core::MachineQuotaConfig {
+            enabled: false,
+            subjects_per_minute: 1,
+        },
+        Arc::clone(&readiness_handle),
+        registry_platform_audit::AuditKeyHasher::unkeyed_dev_only(),
+    );
+    let fenced_request_hash = format!("sha256:{}", "d".repeat(64));
+    let fenced_operation_id = format!("hmac-sha256:{}", "8".repeat(64));
+    let fenced_expires_at = offer_now + time::Duration::minutes(20);
+    let stale_fence = match quota_limiter
+        .check_and_consume_once(
+            "adapter-registry-client",
+            1,
+            &fenced_operation_id,
+            &fenced_request_hash,
+            "adapter-fenced-owner-a",
+            fenced_expires_at,
+        )
+        .await
+        .expect("initial fenced operation succeeds")
+    {
+        MachineQuotaOperationOutcome::Acquired(fence) => fence,
+        outcome => panic!("expected initial fenced owner, got {outcome:?}"),
+    };
+    quota_limiter
+        .release_operation(
+            "adapter-registry-client",
+            &fenced_operation_id,
+            "adapter-fenced-owner-a",
+        )
+        .await
+        .expect("fenced owner release succeeds");
+    let current_fence = match quota_limiter
+        .check_and_consume_once(
+            "adapter-registry-client",
+            1,
+            &fenced_operation_id,
+            &fenced_request_hash,
+            "adapter-fenced-owner-b",
+            fenced_expires_at,
+        )
+        .await
+        .expect("fenced takeover succeeds")
+    {
+        MachineQuotaOperationOutcome::Acquired(fence) => fence,
+        outcome => panic!("expected takeover owner, got {outcome:?}"),
+    };
+    let mut fenced_transaction = offer_transaction.clone();
+    fenced_transaction.transaction_id = "adapter-fenced-offer".to_string();
+    fenced_transaction.evaluation_id = "adapter-fenced-evaluation".to_string();
+    let mut stale_reservation = offer_reservation('8', 'd', fenced_transaction.clone());
+    stale_reservation.quota_principal_hash = stale_fence.principal_hash().to_vec();
+    assert!(matches!(
+        preauthorization_state
+            .reserve_registry_client_offer_fenced(stale_reservation, &stale_fence)
+            .await,
+        Err(PreauthorizationStateError::OperationLeaseLost)
+    ));
+    let mut current_reservation = offer_reservation('8', 'd', fenced_transaction);
+    current_reservation.quota_principal_hash = current_fence.principal_hash().to_vec();
+    assert!(matches!(
+        preauthorization_state
+            .reserve_registry_client_offer_fenced(current_reservation, &current_fence)
+            .await?,
+        RegistryClientOfferReservationOutcome::Created(_)
+    ));
+
+    preauthorization_state
+        .reserve_evaluation_issuance(
+            "adapter-quota-evaluation-two",
+            "adapter-registry-client",
+            offer_now + time::Duration::minutes(20),
+        )
+        .await?;
+    assert!(preauthorization_state
+        .verify_transaction_code("adapter-registry-offer-transaction", "246810")
+        .await?
+        .is_some());
+    let stored_offers = admin
+        .query(
+            "SELECT offer.response_ciphertext, transaction.record_ciphertext \
+               FROM registry_notary_private.registry_client_offer AS offer \
+               JOIN registry_notary_private.oid4vci_issuance_transaction AS transaction \
+                 ON transaction.transaction_hash = offer.transaction_hash",
+            &[],
+        )
+        .await?;
+    assert!(
+        !stored_offers.is_empty(),
+        "registry-client offer ciphertext must be persisted"
+    );
+    for stored_offer in stored_offers {
+        let offer_ciphertext: Vec<u8> = stored_offer.get(0);
+        let transaction_ciphertext: Vec<u8> = stored_offer.get(1);
+        for secret in [
+            b"openid-credential-offer://adapter-secret-offer".as_slice(),
+            b"246810".as_slice(),
+            b"adapter-registry-client".as_slice(),
+            b"adapter-target-handle".as_slice(),
+        ] {
+            assert!(
+                !offer_ciphertext
+                    .windows(secret.len())
+                    .any(|window| window == secret)
+                    && !transaction_ciphertext
+                        .windows(secret.len())
+                        .any(|window| window == secret),
+                "registry-client offer plaintext must not be stored"
+            );
+        }
+    }
+
     admin
         .batch_execute(
             "DELETE FROM registry_notary_private.preauthorization_login_state; \
              DELETE FROM registry_notary_private.preauthorization_tx_code; \
-             DELETE FROM registry_notary_private.oid4vci_issuance_transaction;",
+             DELETE FROM registry_notary_private.oid4vci_issuance_transaction; \
+             DELETE FROM registry_notary_private.issuance_evaluation_consumption; \
+             DELETE FROM registry_notary_private.registry_client_offer;",
         )
         .await?;
 
@@ -2266,10 +3126,13 @@ async fn assert_retention_contract(
                       registry_notary_private.batch_idempotency,
                       registry_notary_private.credential_status,
                       registry_notary_private.machine_quota,
+                      registry_notary_private.machine_quota_operation,
                       registry_notary_private.subject_access_quota,
                       registry_notary_private.preauthorization_login_state,
                       registry_notary_private.preauthorization_tx_code,
-                      registry_notary_private.oid4vci_issuance_transaction;
+                      registry_notary_private.oid4vci_issuance_transaction,
+                      registry_notary_private.issuance_evaluation_consumption,
+                      registry_notary_private.registry_client_offer;
              INSERT INTO registry_notary_private.replay_identifier
                 (scope_hash, identifier_hash, created_at, expires_at)
              SELECT decode(repeat('90', 32), 'hex'), decode(repeat(marker, 32), 'hex'),
@@ -2319,6 +3182,21 @@ async fn assert_retention_contract(
                     clock_timestamp() - interval '2 minutes', clock_timestamp() + lifetime, 1
                FROM (VALUES ('9d', interval '-1 second'),
                             ('9e', interval '5 minutes')) AS rows(marker, lifetime);
+             INSERT INTO registry_notary_private.machine_quota_operation
+                (principal_hash, operation_hash, request_hash, lease_owner_hash,
+                 lease_expires_at, created_at, expires_at)
+             SELECT decode(repeat(principal_marker, 32), 'hex'),
+                    decode(repeat(operation_marker, 32), 'hex'),
+                    decode(repeat(request_marker, 32), 'hex'),
+                    decode(repeat(owner_marker, 32), 'hex'),
+                    clock_timestamp() + lifetime,
+                    clock_timestamp() - interval '2 seconds',
+                    clock_timestamp() + lifetime
+               FROM (VALUES
+                    ('d0', 'd1', 'd2', 'd3', interval '-1 second'),
+                    ('d4', 'd5', 'd6', 'd7', interval '5 minutes'))
+                    AS rows(principal_marker, operation_marker, request_marker,
+                            owner_marker, lifetime);
              INSERT INTO registry_notary_private.subject_access_quota
                 (bucket_kind, key_hash, window_started_at, window_expires_at, used)
              SELECT 'per_principal', decode(repeat(marker, 32), 'hex'),
@@ -2352,7 +3230,36 @@ async fn assert_retention_contract(
                     clock_timestamp() - interval '2 seconds', clock_timestamp(),
                     clock_timestamp() + lifetime
                FROM (VALUES ('b0', interval '-1 second'),
-                            ('b1', interval '5 minutes')) AS rows(marker, lifetime);",
+                            ('b1', interval '5 minutes')) AS rows(marker, lifetime);
+             INSERT INTO registry_notary_private.issuance_evaluation_consumption
+                (evaluation_hash, key_id, created_at, expires_at)
+             SELECT decode(repeat(marker, 32), 'hex'),
+                    decode(repeat('c8', 32), 'hex'),
+                    clock_timestamp() - interval '2 seconds',
+                    clock_timestamp() + lifetime
+               FROM (VALUES ('cc', interval '-1 second'),
+                            ('cd', interval '5 minutes')) AS rows(marker, lifetime);
+             INSERT INTO registry_notary_private.registry_client_offer
+                (idempotency_key_hash, request_hash, evaluation_hash,
+                 transaction_hash, key_id, response_aead_nonce,
+                 response_ciphertext, retention_expires_at,
+                 evaluation_expires_at, purge_after, created_at)
+             SELECT decode(repeat(marker, 32), 'hex'),
+                    decode(repeat(request_marker, 32), 'hex'),
+                    decode(repeat(evaluation_marker, 32), 'hex'),
+                    decode(repeat(transaction_marker, 32), 'hex'),
+                    decode(repeat('c9', 32), 'hex'),
+                    decode(repeat('ca', 12), 'hex'),
+                    decode(repeat('cb', 17), 'hex'),
+                    pg_catalog.statement_timestamp() + lifetime,
+                    pg_catalog.statement_timestamp() + lifetime,
+                    pg_catalog.statement_timestamp() + lifetime,
+                    clock_timestamp() - interval '2 seconds'
+               FROM (VALUES
+                    ('c0', 'c1', 'c2', 'c3', interval '-1 second'),
+                    ('c4', 'c5', 'c6', 'c7', interval '5 minutes'))
+                    AS rows(marker, request_marker, evaluation_marker,
+                            transaction_marker, lifetime);",
         )
         .await?;
     let prune = runtime
@@ -2364,7 +3271,7 @@ async fn assert_retention_contract(
         .await?;
     let pruned: i64 = prune.get("deleted_count");
     assert_eq!(
-        pruned, 10,
+        pruned, 13,
         "each typed state table must prune its expired row"
     );
     assert!(
@@ -2380,15 +3287,18 @@ async fn assert_retention_contract(
                 (SELECT count(*) FROM registry_notary_private.batch_idempotency) +
                 (SELECT count(*) FROM registry_notary_private.credential_status) +
                 (SELECT count(*) FROM registry_notary_private.machine_quota) +
+                (SELECT count(*) FROM registry_notary_private.machine_quota_operation) +
                 (SELECT count(*) FROM registry_notary_private.subject_access_quota) +
                 (SELECT count(*) FROM registry_notary_private.preauthorization_login_state) +
                 (SELECT count(*) FROM registry_notary_private.preauthorization_tx_code) +
-                (SELECT count(*) FROM registry_notary_private.oid4vci_issuance_transaction)",
+                (SELECT count(*) FROM registry_notary_private.oid4vci_issuance_transaction) +
+                (SELECT count(*) FROM registry_notary_private.issuance_evaluation_consumption) +
+                (SELECT count(*) FROM registry_notary_private.registry_client_offer)",
             &[],
         )
         .await?
         .get(0);
-    assert_eq!(remaining, 10, "retention must preserve every live row");
+    assert_eq!(remaining, 13, "retention must preserve every live row");
 
     admin
         .batch_execute(
diff --git a/crates/registry-notary-server/src/state_plane/runtime.rs b/crates/registry-notary-server/src/state_plane/runtime.rs
index ff90c4e2c9..4e512effa6 100644
--- a/crates/registry-notary-server/src/state_plane/runtime.rs
+++ b/crates/registry-notary-server/src/state_plane/runtime.rs
@@ -48,6 +48,9 @@ const MAX_ROOT_CERTIFICATE_BYTES: usize = 64 * 1024;
 /// Each serving replica prunes at most this many expired rows per state table
 /// per pass. The fixed database function rejects larger batches.
 const RETENTION_MAINTENANCE_BATCH_SIZE: i32 = 1_000;
+/// `retention_prune_v1` independently bounds one delete group per private
+/// state table. Keep this synchronized with that fixed SQL contract.
+const RETENTION_PRUNE_GROUP_COUNT: i64 = 13;
 /// Cleanup is deliberately less frequent than request-path state operations;
 /// expiry checks remain authoritative even between maintenance passes.
 const RETENTION_MAINTENANCE_CADENCE: Duration = Duration::from_secs(60);
@@ -422,7 +425,8 @@ impl NotaryPostgresStatePlaneRuntime {
         let batch_saturated: bool = row
             .try_get("batch_saturated")
             .map_err(|_| NotaryPostgresStatePlaneError::OperationUnavailable)?;
-        let maximum_deleted = i64::from(RETENTION_MAINTENANCE_BATCH_SIZE) * 9;
+        let maximum_deleted =
+            i64::from(RETENTION_MAINTENANCE_BATCH_SIZE) * RETENTION_PRUNE_GROUP_COUNT;
         if !(0..=maximum_deleted).contains(&deleted_count)
             || (batch_saturated && deleted_count < i64::from(RETENTION_MAINTENANCE_BATCH_SIZE))
         {
@@ -1241,6 +1245,7 @@ mod tests {
     #[test]
     fn retention_maintenance_uses_the_fixed_bounded_contract() {
         assert_eq!(RETENTION_MAINTENANCE_BATCH_SIZE, 1_000);
+        assert_eq!(RETENTION_PRUNE_GROUP_COUNT, 13);
         assert_eq!(RETENTION_MAINTENANCE_CADENCE, Duration::from_secs(60));
         assert_eq!(
             RETENTION_CATCH_UP_INITIAL_BACKOFF,
diff --git a/crates/registry-notary-server/src/state_plane/sensitive.rs b/crates/registry-notary-server/src/state_plane/sensitive.rs
index 3712f51d53..3493f61b73 100644
--- a/crates/registry-notary-server/src/state_plane/sensitive.rs
+++ b/crates/registry-notary-server/src/state_plane/sensitive.rs
@@ -23,8 +23,13 @@ use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
 
 use super::{NotaryPostgresStatePlaneError, NotaryPostgresStatePlaneRuntime};
 use crate::{
+    machine_quota::MachineQuotaOperationFence,
     preauth_state::{
-        CredentialMaterialization, IssuanceTransaction, LoginState, VerifiedTransactionCode,
+        decode_hash_uri, validate_registry_client_offer_structure, CredentialMaterialization,
+        IssuanceTransaction, LiveIssuanceTransaction, LoginState, PreauthorizationStateError,
+        RegistryClientOfferPreflightOutcome, RegistryClientOfferReservation,
+        RegistryClientOfferReservationOutcome, RegistryClientOfferResponse,
+        VerifiedTransactionCode,
     },
     replay::{replay_identifier_hash, replay_scope_hash},
 };
@@ -42,6 +47,9 @@ const ISSUANCE_HOLDER_CONTEXT: &[u8] = b"oid4vci-holder-thumbprint";
 const ISSUANCE_REQUEST_CONTEXT: &[u8] = b"oid4vci-credential-request";
 const ISSUANCE_RECORD_AAD_CONTEXT: &[u8] = b"registry-notary/oid4vci/transaction-aad/v1";
 const ISSUANCE_RESPONSE_AAD_CONTEXT: &[u8] = b"registry-notary/oid4vci/response-aad/v1";
+const EVALUATION_ISSUANCE_CONTEXT: &[u8] = b"oid4vci-evaluation-issuance";
+const REGISTRY_CLIENT_OFFER_RESPONSE_AAD_CONTEXT: &[u8] =
+    b"registry-notary/oid4vci/registry-client-offer-response-aad/v1";
 
 /// The configured environment variable name is retained, but its value is
 /// read only by [`PostgresSensitiveState::activate`].
@@ -298,10 +306,287 @@ impl PostgresSensitiveState {
         }
     }
 
+    #[cfg(test)]
+    pub(crate) async fn reserve_registry_client_offer(
+        &self,
+        reservation: RegistryClientOfferReservation,
+    ) -> Result<RegistryClientOfferReservationOutcome, PreauthorizationStateError> {
+        self.reserve_registry_client_offer_with_fence(reservation, None)
+            .await
+    }
+
+    pub(crate) async fn reserve_registry_client_offer_fenced(
+        &self,
+        reservation: RegistryClientOfferReservation,
+        fence: &MachineQuotaOperationFence,
+    ) -> Result<RegistryClientOfferReservationOutcome, PreauthorizationStateError> {
+        self.reserve_registry_client_offer_with_fence(reservation, Some(fence))
+            .await
+    }
+
+    async fn reserve_registry_client_offer_with_fence(
+        &self,
+        reservation: RegistryClientOfferReservation,
+        fence: Option<&MachineQuotaOperationFence>,
+    ) -> Result<RegistryClientOfferReservationOutcome, PreauthorizationStateError> {
+        validate_registry_client_offer_structure(&reservation)?;
+        if fence.is_some_and(|fence| {
+            reservation.quota_principal_hash.as_slice() != fence.principal_hash()
+        }) {
+            return Err(PreauthorizationStateError::OperationLeaseLost);
+        }
+        let idempotency_hash = decode_hash_uri(&reservation.idempotency_key_hash, "hmac-sha256:")?;
+        let request_hash = decode_hash_uri(&reservation.canonical_request_hash, "sha256:")?;
+        let evaluation_hash = self.keys.identifier_hash_fields(
+            EVALUATION_ISSUANCE_CONTEXT,
+            &[
+                reservation.evaluation_id.as_bytes(),
+                reservation.transaction.evaluation_client_id.as_bytes(),
+            ],
+        );
+        let transaction_hash = self
+            .keys
+            .identifier_hash(ISSUANCE_TRANSACTION_CONTEXT, &reservation.transaction_id);
+        let jti_hash = replay_identifier_hash(&reservation.transaction_id);
+        let transaction_expires_at = normalize_expiry(reservation.transaction_expires_at)?;
+        let code_expires_at = normalize_expiry(reservation.code_expires_at)?;
+        let retention_expires_at = normalize_expiry(reservation.retention_expires_at)?;
+        let evaluation_expires_at = normalize_expiry(reservation.evaluation_expires_at)?;
+
+        let record_aad = issuance_record_aad(
+            &transaction_hash,
+            &self.keys.key_id,
+            &reservation.transaction.credential_configuration_id,
+            &reservation.transaction.commitment,
+            transaction_expires_at,
+        )?;
+        let record_plaintext = Zeroizing::new(
+            serde_json::to_vec(&EncryptedIssuanceTransaction {
+                version: ISSUANCE_RECORD_VERSION,
+                transaction: &reservation.transaction,
+            })
+            .map_err(|_| SensitiveStateError::CryptographyUnavailable)?,
+        );
+        let (record_nonce, record_ciphertext) =
+            seal(&self.keys.aead, &record_aad, &record_plaintext)?;
+
+        let response_aad = registry_client_offer_response_aad(
+            &idempotency_hash,
+            &request_hash,
+            &self.keys.key_id,
+            retention_expires_at,
+        )?;
+        let response_plaintext = Zeroizing::new(
+            serde_json::to_vec(&reservation.response)
+                .map_err(|_| SensitiveStateError::CryptographyUnavailable)?,
+        );
+        let (response_nonce, response_ciphertext) =
+            seal(&self.keys.aead, &response_aad, &response_plaintext)?;
+
+        let pin_length = reservation
+            .transaction_code
+            .as_ref()
+            .map(|code| {
+                i16::try_from(code.pin_length).map_err(|_| PreauthorizationStateError::Unavailable)
+            })
+            .transpose()?;
+        let pin_verifier = reservation
+            .transaction_code
+            .as_ref()
+            .map(|code| self.keys.pin_verifier(&jti_hash, &code.pin));
+        let pin_verifier_parameter = pin_verifier.as_ref().map(<[u8; KEY_BYTES]>::as_slice);
+        let quota_operation_hash = fence.map(|fence| &fence.operation_hash()[..]);
+        let quota_lease_owner_hash = fence.map(|fence| &fence.lease_owner_hash()[..]);
+
+        let session = self
+            .runtime
+            .open_domain_session()
+            .await
+            .map_err(SensitiveStateError::from)?;
+        let row = session
+            .run_operation(session.client().query_one(
+                "SELECT * FROM registry_notary_api.registry_client_offer_reserve_v1(\
+                     $1::bytea, $2::bytea, $3::bytea, $4::bytea, $5::bytea, $6::bytea, \
+                     $7::text, $8::text, $9::bytea, $10::bytea, $11::timestamptz, \
+                     $12::bytea, $13::smallint, $14::timestamptz, $15::bytea, \
+                     $16::bytea, $17::timestamptz, $18::timestamptz, $19::bytea, \
+                     $20::integer, $21::integer, $22::bytea, $23::bytea)",
+                &[
+                    &&idempotency_hash[..],
+                    &&request_hash[..],
+                    &&evaluation_hash[..],
+                    &&transaction_hash[..],
+                    &&jti_hash[..],
+                    &&self.keys.key_id[..],
+                    &reservation.transaction.credential_configuration_id,
+                    &reservation.transaction.commitment,
+                    &record_nonce,
+                    &record_ciphertext,
+                    &transaction_expires_at,
+                    &pin_verifier_parameter,
+                    &pin_length,
+                    &code_expires_at,
+                    &response_nonce,
+                    &response_ciphertext,
+                    &retention_expires_at,
+                    &evaluation_expires_at,
+                    &reservation.quota_principal_hash,
+                    &reservation.quota_limit,
+                    &reservation.quota_cost,
+                    &quota_operation_hash,
+                    &quota_lease_owner_hash,
+                ],
+            ))
+            .await
+            .map_err(SensitiveStateError::from)?;
+        match row.get::<_, i16>("outcome") {
+            1 => Ok(RegistryClientOfferReservationOutcome::Created(
+                reservation.response,
+            )),
+            2 => {
+                let key_id: Vec<u8> = row.get("key_id");
+                if key_id.ct_eq(&self.keys.key_id).unwrap_u8() != 1 {
+                    return Err(SensitiveStateError::InvalidStoredRecord.into());
+                }
+                let stored_retention_expires_at: OffsetDateTime = row.get("retention_expires_at");
+                let nonce: Vec<u8> = row.get("response_aead_nonce");
+                let mut ciphertext = Zeroizing::new(row.get::<_, Vec<u8>>("response_ciphertext"));
+                let aad = registry_client_offer_response_aad(
+                    &idempotency_hash,
+                    &request_hash,
+                    &key_id,
+                    stored_retention_expires_at,
+                )?;
+                let plaintext = open(&self.keys.aead, &aad, &nonce, &mut ciphertext)?;
+                let response: RegistryClientOfferResponse = serde_json::from_slice(plaintext)
+                    .map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
+                Ok(RegistryClientOfferReservationOutcome::Replayed(response))
+            }
+            0 => Err(PreauthorizationStateError::IdempotencyConflict),
+            -1 => Err(PreauthorizationStateError::IssuanceTransactionCapacity),
+            -2 => Err(PreauthorizationStateError::EvaluationConsumed),
+            -3 => Err(PreauthorizationStateError::DuplicateIssuanceTransaction),
+            -4 => Err(PreauthorizationStateError::InvalidExpiry),
+            -5 => {
+                let retry_after_seconds: i64 = row
+                    .try_get("retry_after_seconds")
+                    .map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
+                Err(PreauthorizationStateError::MachineQuotaExceeded {
+                    retry_after_seconds: retry_after_seconds.max(1) as u64,
+                })
+            }
+            -6 => Err(PreauthorizationStateError::OperationLeaseLost),
+            _ => Err(SensitiveStateError::InvalidStoredRecord.into()),
+        }
+    }
+
+    pub(crate) async fn registry_client_offer_preflight(
+        &self,
+        evaluation_id: &str,
+        evaluation_client_id: &str,
+        idempotency_key_hash: &str,
+        canonical_request_hash: &str,
+    ) -> Result<RegistryClientOfferPreflightOutcome, PreauthorizationStateError> {
+        if evaluation_id.is_empty() || evaluation_client_id.is_empty() {
+            return Err(PreauthorizationStateError::Unavailable);
+        }
+        let idempotency_hash = decode_hash_uri(idempotency_key_hash, "hmac-sha256:")?;
+        let request_hash = decode_hash_uri(canonical_request_hash, "sha256:")?;
+        let evaluation_hash = self.keys.identifier_hash_fields(
+            EVALUATION_ISSUANCE_CONTEXT,
+            &[evaluation_id.as_bytes(), evaluation_client_id.as_bytes()],
+        );
+        let session = self
+            .runtime
+            .open_domain_session()
+            .await
+            .map_err(SensitiveStateError::from)?;
+        let row = session
+            .run_operation(session.client().query_one(
+                "SELECT * FROM registry_notary_api.registry_client_offer_preflight_v1(\
+                     $1::bytea, $2::bytea, $3::bytea, $4::bytea)",
+                &[
+                    &&idempotency_hash[..],
+                    &&request_hash[..],
+                    &&evaluation_hash[..],
+                    &&self.keys.key_id[..],
+                ],
+            ))
+            .await
+            .map_err(SensitiveStateError::from)?;
+        match row.get::<_, i16>("outcome") {
+            1 => Ok(RegistryClientOfferPreflightOutcome::Available),
+            2 => {
+                let key_id: Vec<u8> = row.get("key_id");
+                if key_id.ct_eq(&self.keys.key_id).unwrap_u8() != 1 {
+                    return Err(SensitiveStateError::InvalidStoredRecord.into());
+                }
+                let retention_expires_at: OffsetDateTime = row.get("retention_expires_at");
+                let nonce: Vec<u8> = row.get("response_aead_nonce");
+                let mut ciphertext = Zeroizing::new(row.get::<_, Vec<u8>>("response_ciphertext"));
+                let aad = registry_client_offer_response_aad(
+                    &idempotency_hash,
+                    &request_hash,
+                    &key_id,
+                    retention_expires_at,
+                )?;
+                let plaintext = open(&self.keys.aead, &aad, &nonce, &mut ciphertext)?;
+                let response: RegistryClientOfferResponse = serde_json::from_slice(plaintext)
+                    .map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
+                Ok(RegistryClientOfferPreflightOutcome::Replayed(response))
+            }
+            0 => Ok(RegistryClientOfferPreflightOutcome::IdempotencyConflict),
+            -2 => Ok(RegistryClientOfferPreflightOutcome::EvaluationConsumed),
+            _ => Err(SensitiveStateError::InvalidStoredRecord.into()),
+        }
+    }
+
+    pub(crate) async fn reserve_evaluation_issuance(
+        &self,
+        evaluation_id: &str,
+        evaluation_client_id: &str,
+        evaluation_expires_at: OffsetDateTime,
+    ) -> Result<(), PreauthorizationStateError> {
+        if evaluation_id.is_empty() || evaluation_client_id.is_empty() {
+            return Err(PreauthorizationStateError::Unavailable);
+        }
+        if evaluation_expires_at <= OffsetDateTime::now_utc() {
+            return Err(PreauthorizationStateError::InvalidExpiry);
+        }
+        let evaluation_hash = self.keys.identifier_hash_fields(
+            EVALUATION_ISSUANCE_CONTEXT,
+            &[evaluation_id.as_bytes(), evaluation_client_id.as_bytes()],
+        );
+        let evaluation_expires_at = normalize_expiry(evaluation_expires_at)?;
+        let session = self
+            .runtime
+            .open_domain_session()
+            .await
+            .map_err(SensitiveStateError::from)?;
+        let row = session
+            .run_operation(session.client().query_one(
+                "SELECT registry_notary_api.evaluation_issuance_consume_v1(\
+                     $1::bytea, $2::bytea, $3::timestamptz)",
+                &[
+                    &&evaluation_hash[..],
+                    &&self.keys.key_id[..],
+                    &evaluation_expires_at,
+                ],
+            ))
+            .await
+            .map_err(SensitiveStateError::from)?;
+        match row.get::<_, i16>(0) {
+            1 => Ok(()),
+            0 => Err(PreauthorizationStateError::EvaluationConsumed),
+            -1 => Err(PreauthorizationStateError::IssuanceTransactionCapacity),
+            _ => Err(SensitiveStateError::InvalidStoredRecord.into()),
+        }
+    }
+
     pub(crate) async fn issuance_transaction(
         &self,
         transaction_id: &str,
-    ) -> Result<Option<IssuanceTransaction>, SensitiveStateError> {
+    ) -> Result<Option<LiveIssuanceTransaction>, SensitiveStateError> {
         let transaction_hash = self
             .keys
             .identifier_hash(ISSUANCE_TRANSACTION_CONTEXT, transaction_id);
@@ -312,8 +597,13 @@ impl PostgresSensitiveState {
                 &[&&transaction_hash[..]],
             ))
             .await?;
-        row.map(|row| self.decrypt_issuance_transaction(&transaction_hash, &row))
-            .transpose()
+        row.map(|row| {
+            Ok(LiveIssuanceTransaction {
+                transaction: self.decrypt_issuance_transaction(&transaction_hash, &row)?,
+                expires_at: row.get("expires_at"),
+            })
+        })
+        .transpose()
     }
 
     pub(crate) async fn bind_issuance_nonce(
@@ -699,6 +989,17 @@ impl SensitiveStateKeys {
         hmac_framed(&self.identifier, &[domain, value.as_bytes()])
     }
 
+    pub(crate) fn identifier_hash_fields(
+        &self,
+        domain: &[u8],
+        fields: &[&[u8]],
+    ) -> [u8; KEY_BYTES] {
+        let mut framed = Vec::with_capacity(fields.len() + 1);
+        framed.push(domain);
+        framed.extend_from_slice(fields);
+        hmac_framed(&self.identifier, &framed)
+    }
+
     pub(crate) fn login_state_hash(&self, opaque_state: &str) -> [u8; KEY_BYTES] {
         self.identifier_hash(STATE_IDENTIFIER_CONTEXT, opaque_state)
     }
@@ -839,6 +1140,25 @@ fn issuance_response_aad(
     Ok(aad)
 }
 
+fn registry_client_offer_response_aad(
+    idempotency_hash: &[u8; KEY_BYTES],
+    request_hash: &[u8; KEY_BYTES],
+    key_id: &[u8],
+    retention_expires_at: OffsetDateTime,
+) -> Result<Vec<u8>, SensitiveStateError> {
+    if key_id.len() != KEY_BYTES {
+        return Err(SensitiveStateError::InvalidStoredRecord);
+    }
+    let mut aad = Vec::with_capacity(144);
+    aad.extend_from_slice(REGISTRY_CLIENT_OFFER_RESPONSE_AAD_CONTEXT);
+    aad.push(ISSUANCE_RECORD_VERSION);
+    aad.extend_from_slice(idempotency_hash);
+    aad.extend_from_slice(request_hash);
+    aad.extend_from_slice(key_id);
+    aad.extend_from_slice(&retention_expires_at.unix_timestamp().to_be_bytes());
+    Ok(aad)
+}
+
 fn append_aad_text(aad: &mut Vec<u8>, value: &str) -> Result<(), SensitiveStateError> {
     let length =
         u32::try_from(value.len()).map_err(|_| SensitiveStateError::InvalidStoredRecord)?;
@@ -913,6 +1233,16 @@ mod tests {
             keys.login_state_hash("same"),
             replay_identifier_hash("same")
         );
+        assert_ne!(
+            keys.identifier_hash_fields(
+                EVALUATION_ISSUANCE_CONTEXT,
+                &[b"evaluation", b"client-one"],
+            ),
+            keys.identifier_hash_fields(
+                EVALUATION_ISSUANCE_CONTEXT,
+                &[b"evaluation", b"client-two"],
+            )
+        );
         assert_ne!(test_keys(7).key_id, test_keys(8).key_id);
     }
 
@@ -971,6 +1301,32 @@ mod tests {
         }
     }
 
+    #[test]
+    fn registry_client_offer_aad_binds_key_request_and_retention() {
+        let keys = test_keys(9);
+        let expiry = OffsetDateTime::from_unix_timestamp(1_900_000_000).unwrap();
+        let first =
+            registry_client_offer_response_aad(&[1; 32], &[2; 32], &keys.key_id, expiry).unwrap();
+        assert_ne!(
+            first,
+            registry_client_offer_response_aad(&[3; 32], &[2; 32], &keys.key_id, expiry).unwrap()
+        );
+        assert_ne!(
+            first,
+            registry_client_offer_response_aad(&[1; 32], &[4; 32], &keys.key_id, expiry).unwrap()
+        );
+        assert_ne!(
+            first,
+            registry_client_offer_response_aad(
+                &[1; 32],
+                &[2; 32],
+                &keys.key_id,
+                expiry + time::Duration::seconds(1),
+            )
+            .unwrap()
+        );
+    }
+
     #[test]
     fn debug_and_errors_do_not_disclose_sensitive_values() {
         let config = SensitiveStateKeyConfig::new("SENTINEL_SECRET_ENV").unwrap();
diff --git a/crates/registry-notary/tests/config_schema.rs b/crates/registry-notary/tests/config_schema.rs
index f6da22049a..a47a1a9ca2 100644
--- a/crates/registry-notary/tests/config_schema.rs
+++ b/crates/registry-notary/tests/config_schema.rs
@@ -816,7 +816,7 @@ fn product_owned_documentation_intent_has_exact_runtime_key_inventory() {
     let assignments = intent["assignments"]
         .as_array()
         .expect("Notary intent assignments are an array");
-    assert_eq!(assignments.len(), 530);
+    assert_eq!(assignments.len(), 536);
     let assigned_paths = assignments
         .iter()
         .map(|assignment| {
@@ -835,6 +835,6 @@ fn product_owned_documentation_intent_has_exact_runtime_key_inventory() {
             .iter()
             .filter(|assignment| assignment["path_kind"] == "map_value")
             .count(),
-        9
+        10
     );
 }
diff --git a/crates/registry-platform-httputil/src/destination/json.rs b/crates/registry-platform-httputil/src/destination/json.rs
index 165b0871cc..fb40cf515d 100644
--- a/crates/registry-platform-httputil/src/destination/json.rs
+++ b/crates/registry-platform-httputil/src/destination/json.rs
@@ -2,7 +2,8 @@
 //! Closed, platform-owned JSON decoding for registry-data responses.
 //!
 //! The decoder consumes opaque destination data, validates the complete JSON
-//! value, and releases only declared bounded scalar projections.
+//! value, and releases only declared bounded projections. Composite projections
+//! are released only as canonical JSON bytes from recursively closed schemas.
 //!
 //! Successful parse-tree strings and raw body bytes have zeroizing owners.
 //! Rejected parses can create temporary allocations inside parser dependencies;
diff --git a/crates/registry-platform-httputil/src/destination/json/contract.rs b/crates/registry-platform-httputil/src/destination/json/contract.rs
index 0ce48c0c90..de665754de 100644
--- a/crates/registry-platform-httputil/src/destination/json/contract.rs
+++ b/crates/registry-platform-httputil/src/destination/json/contract.rs
@@ -20,7 +20,7 @@ pub const MAX_CLOSED_JSON_EXPANDED_NODES: usize = 4_096;
 pub const MAX_CLOSED_JSON_OBJECT_FIELDS: usize = 32;
 /// Maximum items in one schema-bounded response array.
 pub const MAX_CLOSED_JSON_ARRAY_ITEMS: u16 = 256;
-/// Maximum scalar projections released from one record.
+/// Maximum projections released from one record.
 pub const MAX_CLOSED_JSON_PROJECTIONS: usize = 64;
 /// Maximum bytes in a field, projection name, or decoded pointer token.
 pub const MAX_CLOSED_JSON_NAME_BYTES: usize = 128;
@@ -41,7 +41,7 @@ pub enum ClosedJsonDecoderBuildError {
     InvalidSchema,
     #[error("closed JSON record normalization does not match its schema")]
     InvalidNormalization,
-    #[error("closed JSON scalar projection is invalid")]
+    #[error("closed JSON projection is invalid")]
     InvalidProjection,
 }
 
@@ -270,7 +270,11 @@ pub enum ClosedJsonRecordRoot {
     ObjectArrayProbeTwo { field_index: usize },
 }
 
-/// One named decoded pointer to a scalar relative to the normalized record.
+/// One named decoded pointer relative to the normalized record.
+///
+/// Scalar targets retain their typed projection. Object and array targets are
+/// admitted only when their complete subtree rejects unknown object members,
+/// and are released as canonical JSON bytes.
 pub struct ClosedJsonScalarProjection {
     name: Box<str>,
     tokens: Box<[Box<str>]>,
@@ -339,7 +343,7 @@ pub struct ClosedJsonDecoder {
 }
 
 impl ClosedJsonDecoder {
-    /// Validate the schema, normalization, and scalar projections together.
+    /// Validate the schema, normalization, and projections together.
     pub fn new(
         schema: ClosedJsonSchema,
         root: ClosedJsonRecordRoot,
@@ -490,6 +494,7 @@ pub(super) struct CompiledScalarProjection {
     pub(super) name: Box<str>,
     pub(super) steps: Box<[ProjectionStep]>,
     pub(super) scalar: ScalarContract,
+    pub(super) missing_allowed: bool,
 }
 
 pub(super) struct CompiledPresenceProjection {
@@ -535,17 +540,9 @@ pub(super) enum ScalarContract {
         minimum: i64,
         maximum: i64,
     },
-}
-
-impl ScalarContract {
-    pub(super) const fn nullable(self) -> bool {
-        match self {
-            Self::String { nullable, .. }
-            | Self::Boolean { nullable }
-            | Self::Integer { nullable, .. }
-            | Self::Number { nullable, .. } => nullable,
-        }
-    }
+    CanonicalJson {
+        nullable: bool,
+    },
 }
 
 fn valid_name(value: &str) -> bool {
@@ -798,11 +795,13 @@ fn compile_projection(
     record_schema: &ClosedJsonSchema,
     projection: ClosedJsonScalarProjection,
 ) -> Result<CompiledScalarProjection, ClosedJsonDecoderBuildError> {
-    let (projected_schema, steps) = compile_projection_steps(record_schema, &projection.tokens)?;
+    let (projected_schema, steps, missing_allowed) =
+        compile_projection_steps(record_schema, &projection.tokens)?;
     Ok(CompiledScalarProjection {
         name: projection.name,
         steps,
         scalar: scalar_contract(projected_schema)?,
+        missing_allowed,
     })
 }
 
@@ -810,7 +809,7 @@ fn compile_presence_projection(
     record_schema: &ClosedJsonSchema,
     projection: ClosedJsonPresenceProjection,
 ) -> Result<CompiledPresenceProjection, ClosedJsonDecoderBuildError> {
-    let (_, steps) = compile_projection_steps(record_schema, &projection.tokens)?;
+    let (_, steps, _) = compile_projection_steps(record_schema, &projection.tokens)?;
     Ok(CompiledPresenceProjection {
         name: projection.name,
         steps,
@@ -820,25 +819,39 @@ fn compile_presence_projection(
 fn compile_projection_steps<'schema>(
     record_schema: &'schema ClosedJsonSchema,
     tokens: &[Box<str>],
-) -> Result<(&'schema ClosedJsonSchema, Box<[ProjectionStep]>), ClosedJsonDecoderBuildError> {
+) -> Result<(&'schema ClosedJsonSchema, Box<[ProjectionStep]>, bool), ClosedJsonDecoderBuildError> {
     let mut current = record_schema;
     let mut steps = Vec::with_capacity(tokens.len());
-    for token in tokens {
+    let mut missing_allowed = false;
+    for (token_index, token) in tokens.iter().enumerate() {
+        let has_descendants = token_index + 1 < tokens.len();
         current = match &current.node {
-            ClosedJsonSchemaNode::Object { fields, .. } => {
+            ClosedJsonSchemaNode::Object {
+                nullable, fields, ..
+            } => {
                 let field = fields
                     .iter()
                     .find(|field| field.name.as_ref() == token.as_ref())
                     .ok_or(ClosedJsonDecoderBuildError::InvalidProjection)?;
+                // A nullable parent or an absent optional ancestor collapses
+                // the complete projection to null. An optional terminal field
+                // does so only when that field's own schema is nullable.
+                missing_allowed |= *nullable || (!field.required && has_descendants);
                 steps.push(ProjectionStep::Object(field.name.clone()));
                 &field.schema
             }
             ClosedJsonSchemaNode::Array {
-                max_items, items, ..
+                nullable,
+                max_items,
+                items,
             } => {
                 let index = canonical_array_index(token)
                     .filter(|index| *index < usize::from(*max_items))
                     .ok_or(ClosedJsonDecoderBuildError::InvalidProjection)?;
+                // Array cardinality is bounded above, not fixed. A missing
+                // ancestor item collapses the projection, while a terminal
+                // missing item requires a nullable item schema.
+                missing_allowed |= *nullable || has_descendants;
                 steps.push(ProjectionStep::Array(index));
                 items
             }
@@ -850,7 +863,8 @@ fn compile_projection_steps<'schema>(
             }
         };
     }
-    Ok((current, steps.into_boxed_slice()))
+    missing_allowed |= current.nullable();
+    Ok((current, steps.into_boxed_slice(), missing_allowed))
 }
 
 fn canonical_array_index(token: &str) -> Option<usize> {
@@ -894,6 +908,12 @@ fn scalar_contract(
             minimum,
             maximum,
         }),
+        ClosedJsonSchemaNode::Object { nullable, .. }
+        | ClosedJsonSchemaNode::Array { nullable, .. }
+            if !schema_tolerates_unknown_fields(schema) =>
+        {
+            Ok(ScalarContract::CanonicalJson { nullable })
+        }
         ClosedJsonSchemaNode::Object { .. } | ClosedJsonSchemaNode::Array { .. } => {
             Err(ClosedJsonDecoderBuildError::InvalidProjection)
         }
diff --git a/crates/registry-platform-httputil/src/destination/json/decode.rs b/crates/registry-platform-httputil/src/destination/json/decode.rs
index 891e83e8ce..1f9a19abff 100644
--- a/crates/registry-platform-httputil/src/destination/json/decode.rs
+++ b/crates/registry-platform-httputil/src/destination/json/decode.rs
@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
-//! Sensitive runtime decoding and bounded scalar projection.
+//! Sensitive runtime decoding and bounded projection.
 use std::fmt;
 
-use registry_platform_canonical_json::parse_json_strict;
+use registry_platform_canonical_json::{canonicalize_json, parse_json_strict};
 use serde_json::Value;
 use thiserror::Error;
 use zeroize::Zeroizing;
@@ -69,7 +69,7 @@ pub enum ClosedJsonDecodeError {
     ResponseContractViolation,
     #[error("destination response exceeds the probe-two cardinality bound")]
     CardinalityViolation,
-    #[error("destination response violates its scalar projection contract")]
+    #[error("destination response violates its projection contract")]
     ProjectionContractViolation,
 }
 /// Cardinality plus the only projected record that may be published.
@@ -101,7 +101,7 @@ impl fmt::Debug for ClosedJsonOutcome {
     }
 }
 
-/// One record containing only reviewed scalar projections.
+/// One record containing only reviewed bounded projections.
 pub struct ProjectedJsonRecord {
     fields: Box<[ProjectedJsonField]>,
 }
@@ -145,7 +145,7 @@ impl fmt::Debug for ProjectedJsonRecord {
     }
 }
 
-/// One declared projection name and bounded scalar value.
+/// One declared projection name and bounded value.
 pub struct ProjectedJsonField {
     name: Box<str>,
     value: ProjectedJsonScalar,
@@ -178,13 +178,17 @@ impl fmt::Debug for ProjectedJsonField {
     }
 }
 
-/// One schema-validated scalar. Projected strings retain a zeroizing owner.
+/// One schema-validated projection.
+///
+/// Projected strings and canonical composite JSON retain zeroizing owners.
+/// Composite values never expose their parsed [`Value`] representation.
 pub enum ProjectedJsonScalar {
     Null,
     String(Zeroizing<String>),
     Boolean(bool),
     Integer(i64),
     Number(f64),
+    CanonicalJson(Zeroizing<Vec<u8>>),
 }
 
 impl fmt::Debug for ProjectedJsonScalar {
@@ -195,6 +199,7 @@ impl fmt::Debug for ProjectedJsonScalar {
             Self::Boolean(_) => "boolean",
             Self::Integer(_) => "integer",
             Self::Number(_) => "number",
+            Self::CanonicalJson(_) => "canonical_json",
         };
         formatter
             .debug_struct("ProjectedJsonScalar")
@@ -330,8 +335,7 @@ fn project_field(
         };
         let Some(next) = next else {
             return projection
-                .scalar
-                .nullable()
+                .missing_allowed
                 .then(|| ProjectedJsonField {
                     name: projection.name.clone(),
                     value: ProjectedJsonScalar::Null,
@@ -372,7 +376,8 @@ fn project_scalar(
             ScalarContract::String { nullable, .. }
             | ScalarContract::Boolean { nullable }
             | ScalarContract::Integer { nullable, .. }
-            | ScalarContract::Number { nullable, .. } => nullable,
+            | ScalarContract::Number { nullable, .. }
+            | ScalarContract::CanonicalJson { nullable } => nullable,
         };
         return nullable
             .then_some(ProjectedJsonScalar::Null)
@@ -409,6 +414,12 @@ fn project_scalar(
             .filter(|number| *number >= minimum as f64 && *number <= maximum as f64)
             .map(ProjectedJsonScalar::Number)
             .ok_or(ClosedJsonDecodeError::ProjectionContractViolation),
+        (ScalarContract::CanonicalJson { .. }, Value::Object(_) | Value::Array(_)) => {
+            canonicalize_json(value)
+                .map(Zeroizing::new)
+                .map(ProjectedJsonScalar::CanonicalJson)
+                .map_err(|_| ClosedJsonDecodeError::ProjectionContractViolation)
+        }
         _ => Err(ClosedJsonDecodeError::ProjectionContractViolation),
     }
 }
diff --git a/crates/registry-platform-httputil/src/destination/json/tests.rs b/crates/registry-platform-httputil/src/destination/json/tests.rs
index 610f3b70f8..a6c81b7f2e 100644
--- a/crates/registry-platform-httputil/src/destination/json/tests.rs
+++ b/crates/registry-platform-httputil/src/destination/json/tests.rs
@@ -348,6 +348,133 @@ fn all_scalar_kinds_are_validated_and_projected() {
     ));
 }
 
+#[test]
+fn closed_object_and_array_projections_release_exact_canonical_json() {
+    let decoder = ClosedJsonDecoder::new(
+        object(vec![
+            field(
+                "object",
+                true,
+                object(vec![
+                    field("z", true, integer(false, 0, 9)),
+                    field("a", true, string(false, 16)),
+                ]),
+            ),
+            field(
+                "array",
+                true,
+                ClosedJsonSchema::array(
+                    false,
+                    2,
+                    object(vec![
+                        field("z", true, ClosedJsonSchema::boolean(false)),
+                        field("a", true, integer(false, 0, 9)),
+                    ]),
+                )
+                .unwrap(),
+            ),
+        ]),
+        ClosedJsonRecordRoot::Object,
+        vec![
+            projection("projected_object", &["object"]),
+            projection("projected_array", &["array"]),
+        ],
+    )
+    .unwrap();
+
+    let ClosedJsonOutcome::One(record) = decoder
+        .decode(body(
+            br#"{"object":{"z":2,"a":"SECRET"},"array":[{"z":true,"a":1},{"a":2,"z":false}]}"#,
+        ))
+        .unwrap()
+    else {
+        panic!("one root object expected");
+    };
+    assert!(matches!(
+        record.get("projected_object"),
+        Some(ProjectedJsonScalar::CanonicalJson(bytes))
+            if bytes.as_slice() == br#"{"a":"SECRET","z":2}"#
+    ));
+    assert!(matches!(
+        record.get("projected_array"),
+        Some(ProjectedJsonScalar::CanonicalJson(bytes))
+            if bytes.as_slice() == br#"[{"a":1,"z":true},{"a":2,"z":false}]"#
+    ));
+    let diagnostic = format!(
+        "{record:?} {:?}",
+        record
+            .get("projected_object")
+            .expect("object projection is present")
+    );
+    assert!(diagnostic.contains("canonical_json"));
+    assert!(!diagnostic.contains("SECRET"));
+}
+
+#[test]
+fn composite_projection_preserves_closed_schema_and_response_bounds() {
+    let decoder = ClosedJsonDecoder::new(
+        object(vec![field(
+            "payload",
+            true,
+            object(vec![
+                field("name", true, string(false, 4)),
+                field(
+                    "items",
+                    true,
+                    ClosedJsonSchema::array(
+                        false,
+                        2,
+                        object(vec![field("label", true, string(false, 4))]),
+                    )
+                    .unwrap(),
+                ),
+            ]),
+        )]),
+        ClosedJsonRecordRoot::Object,
+        vec![projection("payload", &["payload"])],
+    )
+    .unwrap();
+
+    for invalid in [
+        br#"{"payload":{"name":"safe","items":[],"extra":"SECRET"}}"#.as_slice(),
+        br#"{"payload":{"name":"safe","items":[{"label":"one","extra":true}]}}"#.as_slice(),
+        br#"{"payload":{"name":"safe","items":[{"label":"one"},{"label":"two"},{"label":"tri"}]}}"#
+            .as_slice(),
+        br#"{"payload":{"name":"safe","items":[{"label":"large"}]}}"#.as_slice(),
+        br#"{"payload":{"name":"safe","items":[[[[[["deep"]]]]]]}}"#.as_slice(),
+    ] {
+        assert_eq!(
+            decoder.decode(body(invalid)).unwrap_err(),
+            ClosedJsonDecodeError::ResponseContractViolation
+        );
+    }
+}
+
+#[test]
+fn composite_projection_rejects_any_subtree_that_tolerates_unknown_fields() {
+    let open_nested = ClosedJsonSchema::object_with_unknown_field_policy(
+        false,
+        false,
+        vec![field("declared", true, string(false, 8))],
+    )
+    .unwrap();
+    let schema = object(vec![field(
+        "payload",
+        true,
+        object(vec![field("nested", true, open_nested)]),
+    )]);
+
+    assert_eq!(
+        ClosedJsonDecoder::new(
+            schema,
+            ClosedJsonRecordRoot::Object,
+            vec![projection("payload", &["payload"])],
+        )
+        .unwrap_err(),
+        ClosedJsonDecoderBuildError::InvalidProjection
+    );
+}
+
 #[test]
 fn presence_projection_distinguishes_null_from_a_non_null_object_without_releasing_it() {
     let decoder = ClosedJsonDecoder::new_with_presence(
@@ -413,7 +540,11 @@ fn schema_compilation_rejects_local_depth_expansion_and_normalization_errors() {
         ClosedJsonDecoderBuildError::InvalidSchema
     );
     assert!(ClosedJsonSchema::array(false, 0, string(false, 1)).is_err());
+    assert!(
+        ClosedJsonSchema::array(false, MAX_CLOSED_JSON_ARRAY_ITEMS + 1, string(false, 1)).is_err()
+    );
     assert!(ClosedJsonSchema::string(false, 0).is_err());
+    assert!(ClosedJsonSchema::string(false, MAX_CLOSED_JSON_STRING_BYTES + 1).is_err());
     assert!(ClosedJsonSchema::integer(false, 2, 1).is_err());
     assert_eq!(
         ClosedJsonSchema::object(
@@ -508,10 +639,9 @@ fn schema_compilation_rejects_local_depth_expansion_and_normalization_errors() {
 }
 
 #[test]
-fn projection_compilation_rejects_missing_composite_noncanonical_and_duplicates() {
+fn projection_compilation_rejects_missing_noncanonical_and_duplicates() {
     for projections in [
         vec![projection("missing", &["missing"])],
-        vec![projection("object", &["nested"])],
         vec![projection("bad_index", &["nested", "values", "01"])],
         vec![
             projection("one", &["status"]),
diff --git a/crates/registry-relay/CHANGELOG.md b/crates/registry-relay/CHANGELOG.md
index 615c6c2e36..acb76e7836 100644
--- a/crates/registry-relay/CHANGELOG.md
+++ b/crates/registry-relay/CHANGELOG.md
@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+- Consultation public contracts can now declare recursive closed object and
+  array outputs. Composite schemas, required fields, item limits, and canonical
+  serialized-size limits are compiler-validated and hash-bound, and Relay
+  rejects unknown keys, wrong nested types, excessive structures, and
+  over-bound values before publishing a match.
+
 ## 0.15.2 - 2026-07-28
 
 - No user-visible Registry Relay changes. This release fixes forward from the
diff --git a/crates/registry-relay/docs/configuration.md b/crates/registry-relay/docs/configuration.md
index 68ac8b8ea4..f031a5ecee 100644
--- a/crates/registry-relay/docs/configuration.md
+++ b/crates/registry-relay/docs/configuration.md
@@ -768,6 +768,32 @@ artifact hash where applicable and its raw SHA-256 digest. Non-local profiles
 must receive the files through the verified signed Config Bundle path. Relay
 does not discover, download, or hot-reload consultation profiles.
 
+### Structured consultation outputs
+
+A consultation public contract can declare scalar, object, and array outputs.
+An object declares every child under `fields` with `required` and `schema`.
+An array declares one recursive `items` schema and `max_items`. Every object
+and array declares `max_bytes` for its complete canonical serialized value.
+The compiler binds this recursive schema into the public contract hash and the
+physical projection digest.
+
+The schema is closed and bounded. A contract can declare no more than 32
+top-level outputs or fields in one object, 256 items in one array, 8 levels,
+256 schema nodes, 4,096 expanded nodes, and 65,536 canonical serialized bytes
+in one structured value. Unknown object keys, missing required fields, wrong
+nested types, overlong arrays, and over-bound values are rejected before Relay
+publishes a `match` result.
+
+Use project authoring to produce the integration pack and public contract. For
+example, the synthetic OpenCRVS integration declares `parents` as an array of
+at most two closed objects. Each object releases only `type`, `name`, and an
+optional nullable `identifier`; the reviewed Rhai adapter constructs those
+fields rather than returning the source parent record.
+
+Notary must pin the same recursive output contract. Changing a field,
+requirement, type, item limit, or byte limit changes the contract hash and
+requires a coordinated Relay and Notary generation.
+
 Each private destination binding defaults to
 `dns_family: dual_stack_strict`: Relay requires definitive A and AAAA lookup
 outcomes before it connects. For a domain destination intentionally operated
diff --git a/crates/registry-relay/docs/release-notes.md b/crates/registry-relay/docs/release-notes.md
index caea62f7b5..5f61fe90a2 100644
--- a/crates/registry-relay/docs/release-notes.md
+++ b/crates/registry-relay/docs/release-notes.md
@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+- Consultation profiles can publish recursive closed object and array outputs.
+  Relay compiler validation and runtime projection enforce the declared child
+  fields, nested types, item counts, canonical serialized-size limits, and
+  global depth and node bounds before a match is published. Every recursive
+  schema detail is part of the public contract hash.
+
 ## 0.15.2
 
 - Registry Relay has no user-visible changes. This release fixes forward from
diff --git a/crates/registry-relay/src/consultation/executor.rs b/crates/registry-relay/src/consultation/executor.rs
index 376a65c391..5bd4ef10cd 100644
--- a/crates/registry-relay/src/consultation/executor.rs
+++ b/crates/registry-relay/src/consultation/executor.rs
@@ -26,9 +26,9 @@ use async_trait::async_trait;
 use serde_json::Value as JsonValue;
 
 use crate::rhai_worker::{
-    HostFailure, OutputSchema as RhaiOutputSchema, OutputType as RhaiOutputType, ScriptFailure,
-    SourceCall, SourceHost, SourceResponse, TypedValue as RhaiTypedValue, WorkerLimits,
-    WorkerOutcome, WorkerOutput, WorkerProcess, WorkerRequest,
+    HostFailure, OutputSchema as RhaiOutputSchema, ScriptFailure, SourceCall, SourceHost,
+    SourceResponse, TypedValue as RhaiTypedValue, WorkerLimits, WorkerOutcome, WorkerOutput,
+    WorkerProcess, WorkerRequest,
 };
 
 use crate::source_backend::{
@@ -39,10 +39,10 @@ use crate::source_plan::runtime_profile::CompiledConsentProfile;
 use crate::source_plan::{
     CompiledBasicSourceCredentialProvider, CompiledBodyTemplate, CompiledInputRole,
     CompiledOAuthSourceCredentialProvider, CompiledOperation, CompiledRequestCodec,
-    CompiledResponseFormat, CompiledRhaiOutputType, CompiledSelectorLocation,
-    CompiledSelectorSource, CompiledSourceAuth, CompiledSourcePlan,
-    CompiledStaticBearerSourceCredentialProvider, CompiledStatusOutcome, CompiledStepPredicate,
-    CompiledValueExpression, ParsedOAuth2AccessToken, ReadMethod, SourcePlanKind,
+    CompiledResponseFormat, CompiledSelectorLocation, CompiledSelectorSource, CompiledSourceAuth,
+    CompiledSourcePlan, CompiledStaticBearerSourceCredentialProvider, CompiledStatusOutcome,
+    CompiledStepPredicate, CompiledValueExpression, ParsedOAuth2AccessToken, ReadMethod,
+    SourcePlanKind,
 };
 use crate::state_plane::{
     AuditedConsultationDispatch, KnownConsultationCompletionFacts, KnownFailureClass,
@@ -1067,35 +1067,8 @@ fn build_rhai_request(
     for output in plan.rhai_outputs() {
         request.output_schema.insert(
             output.name().to_owned(),
-            RhaiOutputSchema {
-                output_type: match output.output_type() {
-                    CompiledRhaiOutputType::String { .. } => RhaiOutputType::String,
-                    CompiledRhaiOutputType::Boolean => RhaiOutputType::Boolean,
-                    CompiledRhaiOutputType::Integer { .. } => RhaiOutputType::Integer,
-                    CompiledRhaiOutputType::Date => RhaiOutputType::Date,
-                },
-                nullable: output.nullable(),
-                max_bytes: match output.output_type() {
-                    CompiledRhaiOutputType::String { max_bytes } => {
-                        Some(usize::try_from(max_bytes).map_err(|_| ConcreteExecutorUnfinished)?)
-                    }
-                    CompiledRhaiOutputType::Boolean
-                    | CompiledRhaiOutputType::Integer { .. }
-                    | CompiledRhaiOutputType::Date => None,
-                },
-                minimum: match output.output_type() {
-                    CompiledRhaiOutputType::Integer { minimum, .. } => Some(minimum),
-                    CompiledRhaiOutputType::String { .. }
-                    | CompiledRhaiOutputType::Boolean
-                    | CompiledRhaiOutputType::Date => None,
-                },
-                maximum: match output.output_type() {
-                    CompiledRhaiOutputType::Integer { maximum, .. } => Some(maximum),
-                    CompiledRhaiOutputType::String { .. }
-                    | CompiledRhaiOutputType::Boolean
-                    | CompiledRhaiOutputType::Date => None,
-                },
-            },
+            RhaiOutputSchema::from_compiled(output.output_type())
+                .map_err(|_| ConcreteExecutorUnfinished)?,
         );
     }
     if signed_dci_script_host_required(plan).map_err(|_| ConcreteExecutorUnfinished)? {
@@ -1118,6 +1091,14 @@ fn rhai_output_value(
         RhaiTypedValue::Integer { value } => {
             Ok(value.map_or(ProjectedJsonScalar::Null, ProjectedJsonScalar::Integer))
         }
+        RhaiTypedValue::Object { value } | RhaiTypedValue::Array { value } => {
+            value.map_or(Ok(ProjectedJsonScalar::Null), |value| {
+                canonicalize_json(&value)
+                    .map(Zeroizing::new)
+                    .map(ProjectedJsonScalar::CanonicalJson)
+                    .map_err(|_| ConcreteExecutorUnfinished)
+            })
+        }
     }
 }
 
@@ -2020,9 +2001,9 @@ fn render_text_expression<'a>(
             ProjectedJsonScalar::String(value) => Ok(Cow::Borrowed(value.as_str())),
             ProjectedJsonScalar::Boolean(value) => Ok(Cow::Owned(value.to_string())),
             ProjectedJsonScalar::Integer(value) => Ok(Cow::Owned(value.to_string())),
-            ProjectedJsonScalar::Null | ProjectedJsonScalar::Number(_) => {
-                Err(ConcreteExecutorUnfinished)
-            }
+            ProjectedJsonScalar::Null
+            | ProjectedJsonScalar::Number(_)
+            | ProjectedJsonScalar::CanonicalJson(_) => Err(ConcreteExecutorUnfinished),
         },
     }
 }
@@ -2073,7 +2054,9 @@ fn render_body_node(
                 ProjectedJsonScalar::Integer(value) => {
                     append_body_bytes(output, value.to_string().as_bytes(), limit)
                 }
-                ProjectedJsonScalar::Number(_) => Err(ConcreteExecutorUnfinished),
+                ProjectedJsonScalar::Number(_) | ProjectedJsonScalar::CanonicalJson(_) => {
+                    Err(ConcreteExecutorUnfinished)
+                }
             },
             _ => {
                 let value = render_text_expression(bound, expression, memory)?;
diff --git a/crates/registry-relay/src/consultation/offline_fixture.rs b/crates/registry-relay/src/consultation/offline_fixture.rs
index faa8b2cedb..5dfa79dfba 100644
--- a/crates/registry-relay/src/consultation/offline_fixture.rs
+++ b/crates/registry-relay/src/consultation/offline_fixture.rs
@@ -11,6 +11,7 @@ use std::path::{Path, PathBuf};
 use std::sync::{Arc, Mutex};
 
 use async_trait::async_trait;
+use registry_platform_crypto::canonicalize_json;
 use registry_platform_httputil::destination::json::{
     decode_script_fixture_json, decode_script_fixture_text, ClosedJsonDecodeError,
     ClosedJsonOutcome, ProjectedJsonScalar,
@@ -24,15 +25,14 @@ use thiserror::Error;
 use zeroize::Zeroizing;
 
 use crate::rhai_worker::{
-    HostFailure, OutputSchema as RhaiOutputSchema, OutputType as RhaiOutputType, ScriptFailure,
-    SourceCall, SourceHost, SourceResponse, TypedValue as RhaiTypedValue, WorkerLimits,
-    WorkerOutcome, WorkerOutput, WorkerProcess, WorkerRequest,
+    HostFailure, OutputSchema as RhaiOutputSchema, ScriptFailure, SourceCall, SourceHost,
+    SourceResponse, TypedValue as RhaiTypedValue, WorkerLimits, WorkerOutcome, WorkerOutput,
+    WorkerProcess, WorkerRequest,
 };
 use crate::source_backend::decode_snapshot_rows;
 use crate::source_plan::{
-    CompiledInputType, CompiledInputValue, CompiledRhaiOutputType, CompiledSourcePlan,
-    CompiledSourcePlanRegistry, CompiledStatusOutcome, SourcePlanArtifactBundle,
-    SourcePlanCompileError, SourcePlanKind,
+    CompiledInputType, CompiledInputValue, CompiledSourcePlan, CompiledSourcePlanRegistry,
+    CompiledStatusOutcome, SourcePlanArtifactBundle, SourcePlanCompileError, SourcePlanKind,
 };
 
 use super::executor::{
@@ -1291,25 +1291,10 @@ fn build_rhai_request(
         );
     }
     for output in plan.rhai_outputs() {
-        let (output_type, max_bytes, minimum, maximum) = match output.output_type() {
-            CompiledRhaiOutputType::String { max_bytes } => {
-                (RhaiOutputType::String, Some(max_bytes as usize), None, None)
-            }
-            CompiledRhaiOutputType::Boolean => (RhaiOutputType::Boolean, None, None, None),
-            CompiledRhaiOutputType::Integer { minimum, maximum } => {
-                (RhaiOutputType::Integer, None, Some(minimum), Some(maximum))
-            }
-            CompiledRhaiOutputType::Date => (RhaiOutputType::Date, None, None, None),
-        };
         request.output_schema.insert(
             output.name().to_owned(),
-            RhaiOutputSchema {
-                output_type,
-                nullable: output.nullable(),
-                max_bytes,
-                minimum,
-                maximum,
-            },
+            RhaiOutputSchema::from_compiled(output.output_type())
+                .map_err(|_| OfflineFixtureError::SourceResponseMalformed)?,
         );
     }
     if super::executor::signed_dci_script_host_required(plan)
@@ -1350,6 +1335,14 @@ fn rhai_output(value: RhaiTypedValue) -> Result<ProjectedJsonScalar, OfflineFixt
         RhaiTypedValue::Integer { value } => {
             value.map_or(ProjectedJsonScalar::Null, ProjectedJsonScalar::Integer)
         }
+        RhaiTypedValue::Object { value } | RhaiTypedValue::Array { value } => {
+            value.map_or(Ok(ProjectedJsonScalar::Null), |value| {
+                canonicalize_json(&value)
+                    .map(Zeroizing::new)
+                    .map(ProjectedJsonScalar::CanonicalJson)
+                    .map_err(|_| OfflineFixtureError::SourceResponseMalformed)
+            })?
+        }
     })
 }
 
@@ -1464,7 +1457,9 @@ fn render_offline_text(
             ProjectedJsonScalar::String(value) => value.to_string(),
             ProjectedJsonScalar::Boolean(value) => value.to_string(),
             ProjectedJsonScalar::Integer(value) => value.to_string(),
-            ProjectedJsonScalar::Null | ProjectedJsonScalar::Number(_) => {
+            ProjectedJsonScalar::Null
+            | ProjectedJsonScalar::Number(_)
+            | ProjectedJsonScalar::CanonicalJson(_) => {
                 return Err(OfflineFixtureError::ExecutionContractViolation)
             }
         },
@@ -1525,6 +1520,8 @@ fn projected_scalar_json(value: &ProjectedJsonScalar) -> Result<Value, OfflineFi
         ProjectedJsonScalar::Number(value) => serde_json::Number::from_f64(*value)
             .map(Value::Number)
             .ok_or(OfflineFixtureError::ExecutionContractViolation)?,
+        ProjectedJsonScalar::CanonicalJson(value) => serde_json::from_slice(value)
+            .map_err(|_| OfflineFixtureError::ExecutionContractViolation)?,
     })
 }
 
@@ -2091,15 +2088,36 @@ fn execute_snapshot(
 }
 
 fn snapshot_projected_value(
-    shape: crate::source_plan::runtime_profile::CompiledOutputShape,
+    shape: &crate::source_plan::runtime_profile::CompiledOutputShape,
     name: &str,
     fields: &serde_json::Map<String, Value>,
 ) -> Result<ProjectedJsonScalar, OfflineFixtureError> {
-    let _ = shape;
-    fields
+    let value = fields
         .get(name)
-        .map(json_scalar)
-        .ok_or(OfflineFixtureError::SourceResponseMalformed)
+        .ok_or(OfflineFixtureError::SourceResponseMalformed)?;
+    match (shape, value) {
+        (_, Value::Null) => Ok(ProjectedJsonScalar::Null),
+        (
+            crate::source_plan::runtime_profile::CompiledOutputShape::Object { .. },
+            Value::Object(_),
+        )
+        | (
+            crate::source_plan::runtime_profile::CompiledOutputShape::Array { .. },
+            Value::Array(_),
+        ) => canonicalize_json(value)
+            .map(Zeroizing::new)
+            .map(ProjectedJsonScalar::CanonicalJson)
+            .map_err(|_| OfflineFixtureError::SourceResponseMalformed),
+        (
+            crate::source_plan::runtime_profile::CompiledOutputShape::Object { .. }
+            | crate::source_plan::runtime_profile::CompiledOutputShape::Array { .. },
+            _,
+        )
+        | (_, Value::Object(_) | Value::Array(_)) => {
+            Err(OfflineFixtureError::SourceResponseMalformed)
+        }
+        _ => Ok(json_scalar(value)),
+    }
 }
 
 fn require_basic_success(
@@ -2191,6 +2209,9 @@ fn scalar_value(value: &ProjectedJsonScalar) -> Value {
         ProjectedJsonScalar::Number(value) => {
             serde_json::Number::from_f64(*value).map_or(Value::Null, Value::Number)
         }
+        ProjectedJsonScalar::CanonicalJson(value) => {
+            serde_json::from_slice(value).unwrap_or(Value::Null)
+        }
     }
 }
 
@@ -2817,7 +2838,7 @@ mod tests {
             ("eligible".to_owned(), Value::Bool(true)),
         ]);
         let status = snapshot_projected_value(
-            crate::source_plan::runtime_profile::CompiledOutputShape::String {
+            &crate::source_plan::runtime_profile::CompiledOutputShape::String {
                 nullable: true,
                 max_bytes: 32,
             },
@@ -2831,7 +2852,7 @@ mod tests {
         ));
         assert!(matches!(
             snapshot_projected_value(
-                crate::source_plan::runtime_profile::CompiledOutputShape::Boolean {
+                &crate::source_plan::runtime_profile::CompiledOutputShape::Boolean {
                     nullable: true,
                 },
                 "missing",
diff --git a/crates/registry-relay/src/consultation/response.rs b/crates/registry-relay/src/consultation/response.rs
index a9e8255080..279bf66fd0 100644
--- a/crates/registry-relay/src/consultation/response.rs
+++ b/crates/registry-relay/src/consultation/response.rs
@@ -9,6 +9,7 @@ use std::collections::BTreeMap;
 use std::fmt;
 use std::io::{self, Write};
 
+use registry_platform_crypto::canonicalize_json;
 use registry_platform_httputil::destination::json::ProjectedJsonScalar;
 use serde::de::Error as _;
 use serde::ser::{SerializeMap, Serializer};
@@ -117,6 +118,7 @@ enum BatchTerminalScalar {
     String(Zeroizing<String>),
     Boolean(bool),
     Integer(i64),
+    CanonicalJson(Zeroizing<Vec<u8>>),
 }
 
 impl Serialize for BatchTerminalScalar {
@@ -129,6 +131,11 @@ impl Serialize for BatchTerminalScalar {
             Self::String(value) => serializer.serialize_str(value),
             Self::Boolean(value) => serializer.serialize_bool(*value),
             Self::Integer(value) => serializer.serialize_i64(*value),
+            Self::CanonicalJson(value) => {
+                let value: serde_json::Value =
+                    serde_json::from_slice(value).map_err(serde::ser::Error::custom)?;
+                value.serialize(serializer)
+            }
         }
     }
 }
@@ -147,7 +154,10 @@ impl<'de> Deserialize<'de> for BatchTerminalScalar {
                 .as_i64()
                 .map(Self::Integer)
                 .ok_or_else(|| D::Error::custom("batch terminal scalar is not a signed integer")),
-            _ => Err(D::Error::custom("batch terminal value is not a scalar")),
+            serde_json::Value::Array(_) | serde_json::Value::Object(_) => canonicalize_json(&value)
+                .map(Zeroizing::new)
+                .map(Self::CanonicalJson)
+                .map_err(D::Error::custom),
         }
     }
 }
@@ -184,22 +194,28 @@ impl ValidatedOutputMap {
                 (
                     CompiledOutputShape::String { max_bytes, .. },
                     ProjectedJsonScalar::String(value),
-                ) => value.as_str().len() <= usize::try_from(max_bytes).unwrap_or(usize::MAX),
+                ) => value.as_str().len() <= usize::try_from(*max_bytes).unwrap_or(usize::MAX),
                 (CompiledOutputShape::Boolean { .. }, ProjectedJsonScalar::Boolean(_)) => true,
                 (
                     CompiledOutputShape::Integer {
                         minimum, maximum, ..
                     },
                     ProjectedJsonScalar::Integer(value),
-                ) => (minimum..=maximum).contains(value),
+                ) => (*minimum..=*maximum).contains(value),
                 (CompiledOutputShape::Date { .. }, ProjectedJsonScalar::String(value)) => {
                     valid_full_date(value)
                 }
+                (
+                    CompiledOutputShape::Object { .. } | CompiledOutputShape::Array { .. },
+                    ProjectedJsonScalar::CanonicalJson(value),
+                ) => canonical_output_matches_shape(value, output.shape()),
                 (
                     CompiledOutputShape::String { nullable: true, .. }
                     | CompiledOutputShape::Boolean { nullable: true }
                     | CompiledOutputShape::Integer { nullable: true, .. }
-                    | CompiledOutputShape::Date { nullable: true },
+                    | CompiledOutputShape::Date { nullable: true }
+                    | CompiledOutputShape::Object { nullable: true, .. }
+                    | CompiledOutputShape::Array { nullable: true, .. },
                     ProjectedJsonScalar::Null,
                 ) => true,
                 _ => false,
@@ -564,7 +580,7 @@ impl BatchTerminalPayload {
                     (
                         CompiledOutputShape::String { max_bytes, .. },
                         BatchTerminalScalar::String(value),
-                    ) => value.len() <= usize::try_from(max_bytes).unwrap_or(usize::MAX),
+                    ) => value.len() <= usize::try_from(*max_bytes).unwrap_or(usize::MAX),
                     (CompiledOutputShape::Date { .. }, BatchTerminalScalar::String(value)) => {
                         valid_full_date(value)
                     }
@@ -574,12 +590,18 @@ impl BatchTerminalPayload {
                             minimum, maximum, ..
                         },
                         BatchTerminalScalar::Integer(value),
-                    ) => (minimum..=maximum).contains(value),
+                    ) => (*minimum..=*maximum).contains(value),
+                    (
+                        CompiledOutputShape::Object { .. } | CompiledOutputShape::Array { .. },
+                        BatchTerminalScalar::CanonicalJson(value),
+                    ) => canonical_output_matches_shape(value, field.shape()),
                     (
                         CompiledOutputShape::String { nullable: true, .. }
                         | CompiledOutputShape::Boolean { nullable: true }
                         | CompiledOutputShape::Integer { nullable: true, .. }
-                        | CompiledOutputShape::Date { nullable: true },
+                        | CompiledOutputShape::Date { nullable: true }
+                        | CompiledOutputShape::Object { nullable: true, .. }
+                        | CompiledOutputShape::Array { nullable: true, .. },
                         BatchTerminalScalar::Null,
                     ) => true,
                     _ => false,
@@ -720,6 +742,9 @@ impl ProjectedRecord<'_> {
                         }
                         ProjectedJsonScalar::Boolean(value) => BatchTerminalScalar::Boolean(*value),
                         ProjectedJsonScalar::Integer(value) => BatchTerminalScalar::Integer(*value),
+                        ProjectedJsonScalar::CanonicalJson(value) => {
+                            BatchTerminalScalar::CanonicalJson(Zeroizing::new(value.to_vec()))
+                        }
                         ProjectedJsonScalar::Number(_) => {
                             return Err(ConsultationResponseError::Serialization);
                         }
@@ -775,9 +800,10 @@ fn terminal_scalar_from_json(
             .as_i64()
             .map(BatchTerminalScalar::Integer)
             .ok_or(ConsultationResponseError::Serialization),
-        serde_json::Value::Array(_) | serde_json::Value::Object(_) => {
-            Err(ConsultationResponseError::Serialization)
-        }
+        serde_json::Value::Array(_) | serde_json::Value::Object(_) => canonicalize_json(value)
+            .map(Zeroizing::new)
+            .map(BatchTerminalScalar::CanonicalJson)
+            .map_err(|_| ConsultationResponseError::Serialization),
     }
 }
 
@@ -911,6 +937,11 @@ impl Serialize for ProjectedScalar<'_> {
             ProjectedJsonScalar::Boolean(value) => serializer.serialize_bool(*value),
             ProjectedJsonScalar::Integer(value) => serializer.serialize_i64(*value),
             ProjectedJsonScalar::Number(value) => serializer.serialize_f64(*value),
+            ProjectedJsonScalar::CanonicalJson(value) => {
+                let value: serde_json::Value =
+                    serde_json::from_slice(value).map_err(serde::ser::Error::custom)?;
+                value.serialize(serializer)
+            }
         }
     }
 }
@@ -921,6 +952,72 @@ struct BoundedResponseWriter<'a> {
     exceeded: bool,
 }
 
+fn canonical_output_matches_shape(bytes: &[u8], shape: &CompiledOutputShape) -> bool {
+    let Ok(value) = serde_json::from_slice::<serde_json::Value>(bytes) else {
+        return false;
+    };
+    canonicalize_json(&value).is_ok_and(|canonical| canonical == bytes)
+        && json_output_matches_shape(&value, shape)
+}
+
+fn json_output_matches_shape(value: &serde_json::Value, shape: &CompiledOutputShape) -> bool {
+    if value.is_null() {
+        return shape.nullable();
+    }
+    match (value, shape) {
+        (serde_json::Value::String(value), CompiledOutputShape::String { max_bytes, .. }) => {
+            value.len() <= usize::try_from(*max_bytes).unwrap_or(usize::MAX)
+        }
+        (serde_json::Value::String(value), CompiledOutputShape::Date { .. }) => {
+            valid_full_date(value)
+        }
+        (serde_json::Value::Bool(_), CompiledOutputShape::Boolean { .. }) => true,
+        (
+            serde_json::Value::Number(value),
+            CompiledOutputShape::Integer {
+                minimum, maximum, ..
+            },
+        ) => value
+            .as_i64()
+            .is_some_and(|value| (*minimum..=*maximum).contains(&value)),
+        (
+            serde_json::Value::Object(value),
+            CompiledOutputShape::Object {
+                max_bytes, fields, ..
+            },
+        ) => {
+            canonicalize_json(&serde_json::Value::Object(value.clone())).is_ok_and(|encoded| {
+                encoded.len() <= usize::try_from(*max_bytes).unwrap_or(usize::MAX)
+            }) && !value
+                .keys()
+                .any(|name| !fields.iter().any(|field| field.name() == name))
+                && fields.iter().all(|field| {
+                    value.get(field.name()).map_or(!field.required(), |value| {
+                        json_output_matches_shape(value, field.shape())
+                    })
+                })
+        }
+        (
+            serde_json::Value::Array(value),
+            CompiledOutputShape::Array {
+                max_bytes,
+                max_items,
+                items,
+                ..
+            },
+        ) => {
+            value.len() <= usize::from(*max_items)
+                && canonicalize_json(&serde_json::Value::Array(value.clone())).is_ok_and(
+                    |encoded| encoded.len() <= usize::try_from(*max_bytes).unwrap_or(usize::MAX),
+                )
+                && value
+                    .iter()
+                    .all(|value| json_output_matches_shape(value, items))
+        }
+        _ => false,
+    }
+}
+
 impl<'a> BoundedResponseWriter<'a> {
     fn new(bytes: &'a mut Zeroizing<Vec<u8>>, limit: usize) -> Self {
         Self {
@@ -1140,6 +1237,78 @@ mod tests {
         .is_err());
     }
 
+    #[test]
+    fn structured_output_remains_an_exact_json_value_in_live_and_replay_payloads() {
+        let plan = crate::source_plan::structured_output_plan_fixture();
+        let structured = json!({
+            "registration_number": "2026-000042",
+            "parents": [
+                {
+                    "name": {"family": "Lovelace", "given": "Ada"},
+                    "relationship": "mother"
+                },
+                {
+                    "name": {"family": "King", "given": "William"},
+                    "relationship": "father"
+                }
+            ]
+        });
+        let canonical = canonicalize_json(&structured).expect("canonical structured output");
+        let outputs = ValidatedOutputMap::try_new(
+            plan.runtime_profile(),
+            vec![(
+                "status".into(),
+                ProjectedJsonScalar::CanonicalJson(Zeroizing::new(canonical)),
+            )],
+        )
+        .expect("schema-validated structured output");
+        let response = PublishableConsultationResponse::from_validated_live_result(
+            ConsultationId::generate(),
+            Some(NotaryEvaluationId::try_parse("01JYZZZZZZZZZZZZZZZZZZZZZZ").unwrap()),
+            plan.runtime_profile(),
+            ConsultationOutcome::Match,
+            Some(&outputs),
+            1_752_148_800_120,
+        )
+        .expect("structured response");
+        let public: Value = serde_json::from_slice(response.bytes_for_test()).unwrap();
+        assert_eq!(public["outputs"]["status"], structured);
+        let terminal: Value =
+            serde_json::from_str(response.batch_terminal_json().unwrap().as_str()).unwrap();
+        assert_eq!(terminal["outputs"]["status"], structured);
+
+        for invalid in [
+            json!({
+                "registration_number": "2026-000042",
+                "parents": [],
+                "undeclared": true
+            }),
+            json!({
+                "registration_number": 42,
+                "parents": []
+            }),
+            json!({
+                "registration_number": "2026-000042",
+                "parents": [
+                    {"name": {"family": "A", "given": "B"}, "relationship": "mother"},
+                    {"name": {"family": "C", "given": "D"}, "relationship": "father"},
+                    {"name": {"family": "E", "given": "F"}, "relationship": "guardian"}
+                ]
+            }),
+        ] {
+            assert!(ValidatedOutputMap::try_new(
+                plan.runtime_profile(),
+                vec![(
+                    "status".into(),
+                    ProjectedJsonScalar::CanonicalJson(Zeroizing::new(
+                        canonicalize_json(&invalid).unwrap(),
+                    )),
+                )],
+            )
+            .is_err());
+        }
+    }
+
     #[test]
     fn snapshot_projection_releases_only_declared_physical_fields() {
         let fields = serde_json::Map::from_iter([(
diff --git a/crates/registry-relay/src/rhai_worker.rs b/crates/registry-relay/src/rhai_worker.rs
index 8a9743f001..03a961d301 100644
--- a/crates/registry-relay/src/rhai_worker.rs
+++ b/crates/registry-relay/src/rhai_worker.rs
@@ -20,6 +20,7 @@ use std::{
 };
 
 use async_trait::async_trait;
+use registry_platform_crypto::canonicalize_json;
 use rhai::{
     packages::{
         BasicArrayPackage, BasicMapPackage, BasicMathPackage, CorePackage, LogicPackage,
@@ -49,6 +50,7 @@ const PROTOCOL_VERSION: u8 = 1;
 const MAX_IPC_FRAME_BYTES: usize = 9 * 1024 * 1024;
 const MAX_SCRIPT_BYTES: usize = 128 * 1024;
 const MAX_NAMES: usize = 64;
+const MAX_OUTPUT_NAMES: usize = 32;
 const MAX_NAME_BYTES: usize = 128;
 const MAX_VALUE_STRING_BYTES: usize = 8 * 1024 * 1024;
 const MIN_OUTPUT_BYTES: usize = 256;
@@ -63,6 +65,11 @@ const MAX_COLLECTION_ITEMS: usize = 4_096;
 const MAX_WALL_TIME_MS: u64 = 60_000;
 const MAX_SOURCE_CALLS: u32 = 16;
 const MAX_JSON_INTEROPERABLE_INTEGER: i64 = (1_i64 << 53) - 1;
+const MAX_OUTPUT_SCHEMA_DEPTH: usize = 8;
+const MAX_OUTPUT_SCHEMA_NODES: usize = 256;
+const MAX_OUTPUT_SCHEMA_EXPANDED_NODES: usize = 4_096;
+const MAX_OUTPUT_OBJECT_FIELDS: usize = 32;
+const MAX_OUTPUT_ARRAY_ITEMS: usize = 256;
 const WORKER_STARTUP_GRACE: Duration = if cfg!(debug_assertions) {
     Duration::from_secs(10)
 } else {
@@ -112,21 +119,137 @@ pub enum OutputType {
     Boolean,
     Integer,
     Date,
+    Object,
+    Array,
 }
 
-/// Expected type and semantic bounds for one output.
-#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+/// One field of a closed structured output object.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
 #[serde(deny_unknown_fields)]
-pub struct OutputSchema {
-    pub output_type: OutputType,
-    #[serde(default)]
-    pub nullable: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub max_bytes: Option<usize>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub minimum: Option<i64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub maximum: Option<i64>,
+pub struct OutputObjectField {
+    pub required: bool,
+    pub schema: Box<OutputSchema>,
+}
+
+/// Expected recursive type and semantic bounds for one output.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
+pub enum OutputSchema {
+    String {
+        nullable: bool,
+        max_bytes: usize,
+    },
+    Boolean {
+        nullable: bool,
+    },
+    Integer {
+        nullable: bool,
+        minimum: i64,
+        maximum: i64,
+    },
+    Date {
+        nullable: bool,
+    },
+    Object {
+        nullable: bool,
+        max_bytes: usize,
+        fields: BTreeMap<String, OutputObjectField>,
+    },
+    Array {
+        nullable: bool,
+        max_bytes: usize,
+        max_items: usize,
+        items: Box<OutputSchema>,
+    },
+}
+
+impl OutputSchema {
+    fn output_type(&self) -> OutputType {
+        match self {
+            Self::String { .. } => OutputType::String,
+            Self::Boolean { .. } => OutputType::Boolean,
+            Self::Integer { .. } => OutputType::Integer,
+            Self::Date { .. } => OutputType::Date,
+            Self::Object { .. } => OutputType::Object,
+            Self::Array { .. } => OutputType::Array,
+        }
+    }
+
+    const fn nullable(&self) -> bool {
+        match self {
+            Self::String { nullable, .. }
+            | Self::Boolean { nullable }
+            | Self::Integer { nullable, .. }
+            | Self::Date { nullable }
+            | Self::Object { nullable, .. }
+            | Self::Array { nullable, .. } => *nullable,
+        }
+    }
+
+    pub(crate) fn from_compiled(
+        shape: &crate::source_plan::runtime_profile::CompiledOutputShape,
+    ) -> Result<Self, WorkerError> {
+        use crate::source_plan::runtime_profile::CompiledOutputShape;
+
+        Ok(match shape {
+            CompiledOutputShape::String {
+                nullable,
+                max_bytes,
+            } => Self::String {
+                nullable: *nullable,
+                max_bytes: usize::try_from(*max_bytes)
+                    .map_err(|_| WorkerError::ContractViolation)?,
+            },
+            CompiledOutputShape::Boolean { nullable } => Self::Boolean {
+                nullable: *nullable,
+            },
+            CompiledOutputShape::Integer {
+                nullable,
+                minimum,
+                maximum,
+            } => Self::Integer {
+                nullable: *nullable,
+                minimum: *minimum,
+                maximum: *maximum,
+            },
+            CompiledOutputShape::Date { nullable } => Self::Date {
+                nullable: *nullable,
+            },
+            CompiledOutputShape::Object {
+                nullable,
+                max_bytes,
+                fields,
+            } => Self::Object {
+                nullable: *nullable,
+                max_bytes: usize::try_from(*max_bytes)
+                    .map_err(|_| WorkerError::ContractViolation)?,
+                fields: fields
+                    .iter()
+                    .map(|field| {
+                        Ok((
+                            field.name().to_owned(),
+                            OutputObjectField {
+                                required: field.required(),
+                                schema: Box::new(Self::from_compiled(field.shape())?),
+                            },
+                        ))
+                    })
+                    .collect::<Result<_, WorkerError>>()?,
+            },
+            CompiledOutputShape::Array {
+                nullable,
+                max_bytes,
+                max_items,
+                items,
+            } => Self::Array {
+                nullable: *nullable,
+                max_bytes: usize::try_from(*max_bytes)
+                    .map_err(|_| WorkerError::ContractViolation)?,
+                max_items: usize::from(*max_items),
+                items: Box::new(Self::from_compiled(items)?),
+            },
+        })
+    }
 }
 
 /// A typed value crossing the process boundary.
@@ -137,6 +260,8 @@ pub enum TypedValue {
     Boolean { value: Option<bool> },
     Integer { value: Option<i64> },
     Date { value: Option<String> },
+    Object { value: Option<Value> },
+    Array { value: Option<Value> },
 }
 
 impl std::fmt::Debug for TypedValue {
@@ -156,6 +281,8 @@ impl TypedValue {
             Self::Boolean { .. } => OutputType::Boolean,
             Self::Integer { .. } => OutputType::Integer,
             Self::Date { .. } => OutputType::Date,
+            Self::Object { .. } => OutputType::Object,
+            Self::Array { .. } => OutputType::Array,
         }
     }
 
@@ -164,6 +291,7 @@ impl TypedValue {
             Self::String { value } | Self::Date { value } => value.is_none(),
             Self::Boolean { value } => value.is_none(),
             Self::Integer { value } => value.is_none(),
+            Self::Object { value } | Self::Array { value } => value.is_none(),
         }
     }
 
@@ -182,6 +310,12 @@ impl TypedValue {
             {
                 Err(WorkerError::ContractViolation)
             }
+            Self::Object { value: Some(value) } if !value.is_object() => {
+                Err(WorkerError::ContractViolation)
+            }
+            Self::Array { value: Some(value) } if !value.is_array() => {
+                Err(WorkerError::ContractViolation)
+            }
             _ => Ok(()),
         }
     }
@@ -193,6 +327,7 @@ impl TypedValue {
                 .map_or(Value::Null, |value| value.clone().into()),
             Self::Boolean { value } => value.map_or(Value::Null, Value::Bool),
             Self::Integer { value } => value.map_or(Value::Null, Into::into),
+            Self::Object { value } | Self::Array { value } => value.clone().unwrap_or(Value::Null),
         }
     }
 }
@@ -1394,7 +1529,7 @@ fn validate_request(request: &WorkerRequest) -> Result<(), WorkerError> {
         || request.script.is_empty()
         || request.script.len() > MAX_SCRIPT_BYTES
         || request.input.len() > MAX_NAMES
-        || request.output_schema.len() > MAX_NAMES
+        || request.output_schema.len() > MAX_OUTPUT_NAMES
     {
         return Err(WorkerError::ContractViolation);
     }
@@ -1409,8 +1544,21 @@ fn validate_request(request: &WorkerRequest) -> Result<(), WorkerError> {
     for value in request.input.values() {
         value.validate(request.limits.max_string_bytes)?;
     }
+    let mut schema_nodes = 0_usize;
+    let mut expanded_nodes = 0_usize;
     for schema in request.output_schema.values() {
-        validate_output_schema(schema, request.limits.max_string_bytes)?;
+        let expanded = validate_output_schema(
+            schema,
+            request.limits.max_string_bytes,
+            1,
+            &mut schema_nodes,
+        )?;
+        expanded_nodes = expanded_nodes
+            .checked_add(expanded)
+            .ok_or(WorkerError::ContractViolation)?;
+        if expanded_nodes > MAX_OUTPUT_SCHEMA_EXPANDED_NODES {
+            return Err(WorkerError::ContractViolation);
+        }
     }
     Ok(())
 }
@@ -1418,27 +1566,69 @@ fn validate_request(request: &WorkerRequest) -> Result<(), WorkerError> {
 fn validate_output_schema(
     schema: &OutputSchema,
     max_string_bytes: usize,
-) -> Result<(), WorkerError> {
-    let valid = match schema.output_type {
-        OutputType::String => {
-            schema
-                .max_bytes
-                .is_some_and(|value| (1..=max_string_bytes).contains(&value))
-                && schema.minimum.is_none()
-                && schema.maximum.is_none()
-        }
-        OutputType::Integer => {
-            schema.max_bytes.is_none()
-                && matches!((schema.minimum, schema.maximum), (Some(minimum), Some(maximum))
-                    if minimum <= maximum
-                        && minimum >= -MAX_JSON_INTEROPERABLE_INTEGER
-                        && maximum <= MAX_JSON_INTEROPERABLE_INTEGER)
-        }
-        OutputType::Boolean | OutputType::Date => {
-            schema.max_bytes.is_none() && schema.minimum.is_none() && schema.maximum.is_none()
+    depth: usize,
+    nodes: &mut usize,
+) -> Result<usize, WorkerError> {
+    *nodes = nodes.checked_add(1).ok_or(WorkerError::ContractViolation)?;
+    if depth > MAX_OUTPUT_SCHEMA_DEPTH || *nodes > MAX_OUTPUT_SCHEMA_NODES {
+        return Err(WorkerError::ContractViolation);
+    }
+    match schema {
+        OutputSchema::String { max_bytes, .. }
+            if (1..=max_string_bytes.min(MAX_OUTPUT_BYTES)).contains(max_bytes) =>
+        {
+            Ok(1)
+        }
+        OutputSchema::Boolean { .. } | OutputSchema::Date { .. } => Ok(1),
+        OutputSchema::Integer {
+            minimum, maximum, ..
+        } if minimum <= maximum
+            && *minimum >= -MAX_JSON_INTEROPERABLE_INTEGER
+            && *maximum <= MAX_JSON_INTEROPERABLE_INTEGER =>
+        {
+            Ok(1)
         }
-    };
-    valid.then_some(()).ok_or(WorkerError::ContractViolation)
+        OutputSchema::Object {
+            max_bytes, fields, ..
+        } => {
+            if !(1..=MAX_OUTPUT_BYTES).contains(max_bytes)
+                || fields.is_empty()
+                || fields.len() > MAX_OUTPUT_OBJECT_FIELDS
+            {
+                return Err(WorkerError::ContractViolation);
+            }
+            let mut expanded = 1_usize;
+            for (name, field) in fields {
+                validate_output_field_name(name)?;
+                let child =
+                    validate_output_schema(&field.schema, max_string_bytes, depth + 1, nodes)?;
+                expanded = expanded
+                    .checked_add(child)
+                    .ok_or(WorkerError::ContractViolation)?;
+            }
+            Ok(expanded)
+        }
+        OutputSchema::Array {
+            max_bytes,
+            max_items,
+            items,
+            ..
+        } => {
+            if !(1..=MAX_OUTPUT_BYTES).contains(max_bytes)
+                || !(1..=MAX_OUTPUT_ARRAY_ITEMS).contains(max_items)
+            {
+                return Err(WorkerError::ContractViolation);
+            }
+            let child = validate_output_schema(items, max_string_bytes, depth + 1, nodes)?;
+            max_items
+                .checked_mul(child)
+                .and_then(|expanded| expanded.checked_add(1))
+                .ok_or(WorkerError::ContractViolation)
+        }
+        OutputSchema::String { .. } | OutputSchema::Integer { .. } => {
+            Err(WorkerError::ContractViolation)
+        }
+    }
 }
 
 fn validate_name(name: &str) -> Result<(), WorkerError> {
@@ -1453,6 +1643,13 @@ fn validate_name(name: &str) -> Result<(), WorkerError> {
     Ok(())
 }
 
+fn validate_output_field_name(name: &str) -> Result<(), WorkerError> {
+    if name.is_empty() || name.len() > MAX_NAME_BYTES || name.chars().any(char::is_control) {
+        return Err(WorkerError::ContractViolation);
+    }
+    Ok(())
+}
+
 fn validate_entrypoint(entrypoint: &str) -> Result<(), WorkerError> {
     let mut bytes = entrypoint.bytes();
     if !matches!(bytes.next(), Some(b'a'..=b'z'))
@@ -1496,23 +1693,94 @@ fn validate_typed_output(
         .output_schema
         .get(name)
         .ok_or(WorkerError::ContractViolation)?;
-    if value.output_type() != schema.output_type || (value.is_null() && !schema.nullable) {
+    if value.output_type() != schema.output_type() || (value.is_null() && !schema.nullable()) {
         return Err(WorkerError::ContractViolation);
     }
     value.validate(request.limits.max_string_bytes)?;
-    let within_bound = match (value, schema.output_type) {
-        (TypedValue::String { value: Some(value) }, OutputType::String) => schema
-            .max_bytes
-            .is_some_and(|maximum| value.len() <= maximum),
-        (TypedValue::Integer { value: Some(value) }, OutputType::Integer) => matches!(
-            (schema.minimum, schema.maximum),
-            (Some(minimum), Some(maximum)) if (minimum..=maximum).contains(value)
-        ),
-        _ => true,
-    };
-    within_bound
-        .then_some(())
-        .ok_or(WorkerError::ContractViolation)
+    let json = value.as_script_value();
+    validate_output_value(&json, schema)
+}
+
+fn validate_output_value(value: &Value, schema: &OutputSchema) -> Result<(), WorkerError> {
+    if value.is_null() {
+        return schema
+            .nullable()
+            .then_some(())
+            .ok_or(WorkerError::ContractViolation);
+    }
+    match (value, schema) {
+        (Value::String(value), OutputSchema::String { max_bytes, .. })
+            if value.len() <= *max_bytes =>
+        {
+            Ok(())
+        }
+        (Value::String(value), OutputSchema::Date { .. })
+            if value.len() == 10
+                && Date::parse(
+                    value,
+                    &time::macros::format_description!("[year]-[month]-[day]"),
+                )
+                .is_ok() =>
+        {
+            Ok(())
+        }
+        (Value::Bool(_), OutputSchema::Boolean { .. }) => Ok(()),
+        (
+            Value::Number(value),
+            OutputSchema::Integer {
+                minimum, maximum, ..
+            },
+        ) if value
+            .as_i64()
+            .is_some_and(|value| (*minimum..=*maximum).contains(&value)) =>
+        {
+            Ok(())
+        }
+        (
+            Value::Object(value),
+            OutputSchema::Object {
+                max_bytes, fields, ..
+            },
+        ) => {
+            if value.keys().any(|name| !fields.contains_key(name))
+                || fields
+                    .iter()
+                    .any(|(name, field)| field.required && !value.contains_key(name))
+                || canonicalize_json(&Value::Object(value.clone()))
+                    .ok()
+                    .is_none_or(|encoded| encoded.len() > *max_bytes)
+            {
+                return Err(WorkerError::ContractViolation);
+            }
+            for (name, child) in value {
+                let field = fields.get(name).ok_or(WorkerError::ContractViolation)?;
+                validate_output_value(child, &field.schema)?;
+            }
+            Ok(())
+        }
+        (
+            Value::Array(value),
+            OutputSchema::Array {
+                max_bytes,
+                max_items,
+                items,
+                ..
+            },
+        ) => {
+            if value.len() > *max_items
+                || canonicalize_json(&Value::Array(value.clone()))
+                    .ok()
+                    .is_none_or(|encoded| encoded.len() > *max_bytes)
+            {
+                return Err(WorkerError::ContractViolation);
+            }
+            for child in value {
+                validate_output_value(child, items)?;
+            }
+            Ok(())
+        }
+        _ => Err(WorkerError::ContractViolation),
+    }
 }
 
 fn validate_source_call(call: &SourceCall, limits: &WorkerLimits) -> Result<(), WorkerError> {
@@ -2475,17 +2743,19 @@ fn terminal_to_output(
 
 fn dynamic_to_typed(value: Dynamic, schema: &OutputSchema) -> Result<TypedValue, WorkerError> {
     if value.is_unit() {
-        if !schema.nullable {
+        if !schema.nullable() {
             return Err(WorkerError::ContractViolation);
         }
-        return Ok(match schema.output_type {
+        return Ok(match schema.output_type() {
             OutputType::String => TypedValue::String { value: None },
             OutputType::Boolean => TypedValue::Boolean { value: None },
             OutputType::Integer => TypedValue::Integer { value: None },
             OutputType::Date => TypedValue::Date { value: None },
+            OutputType::Object => TypedValue::Object { value: None },
+            OutputType::Array => TypedValue::Array { value: None },
         });
     }
-    match schema.output_type {
+    match schema.output_type() {
         OutputType::String => value
             .try_cast::<String>()
             .map(|value| TypedValue::String { value: Some(value) })
@@ -2502,6 +2772,22 @@ fn dynamic_to_typed(value: Dynamic, schema: &OutputSchema) -> Result<TypedValue,
             .try_cast::<String>()
             .map(|value| TypedValue::Date { value: Some(value) })
             .ok_or(WorkerError::ContractViolation),
+        OutputType::Object => {
+            let value =
+                from_dynamic::<Value>(&value).map_err(|_| WorkerError::ContractViolation)?;
+            value
+                .is_object()
+                .then_some(TypedValue::Object { value: Some(value) })
+                .ok_or(WorkerError::ContractViolation)
+        }
+        OutputType::Array => {
+            let value =
+                from_dynamic::<Value>(&value).map_err(|_| WorkerError::ContractViolation)?;
+            value
+                .is_array()
+                .then_some(TypedValue::Array { value: Some(value) })
+                .ok_or(WorkerError::ContractViolation)
+        }
     }
 }
 
@@ -2659,13 +2945,7 @@ mod tests {
         let mut request = WorkerRequest::v1(script, "consult", WorkerLimits::default());
         request.output_schema.insert(
             "active".to_string(),
-            OutputSchema {
-                output_type: OutputType::Boolean,
-                nullable: false,
-                max_bytes: None,
-                minimum: None,
-                maximum: None,
-            },
+            OutputSchema::Boolean { nullable: false },
         );
         request
     }
diff --git a/crates/registry-relay/src/rhai_worker/xw.rs b/crates/registry-relay/src/rhai_worker/xw.rs
index da60b2eba6..c82a823c3a 100644
--- a/crates/registry-relay/src/rhai_worker/xw.rs
+++ b/crates/registry-relay/src/rhai_worker/xw.rs
@@ -831,8 +831,8 @@ mod tests {
 
     use super::*;
     use crate::rhai_worker::{
-        evaluate_in_process, hardened_engine, BlockingTransport, OutputSchema, OutputType,
-        SourceCall, SourceResponse, TypedValue, WorkerOutcome, WorkerOutput, WorkerRequest,
+        evaluate_in_process, hardened_engine, BlockingTransport, OutputSchema, SourceCall,
+        SourceResponse, TypedValue, WorkerOutcome, WorkerOutput, WorkerRequest,
     };
 
     struct NoCallTransport;
@@ -944,12 +944,9 @@ mod tests {
         );
         request.output_schema.insert(
             "normalized".to_owned(),
-            OutputSchema {
-                output_type: OutputType::String,
+            OutputSchema::String {
                 nullable: false,
-                max_bytes: Some(64),
-                minimum: None,
-                maximum: None,
+                max_bytes: 64,
             },
         );
         assert_eq!(
@@ -986,12 +983,9 @@ mod tests {
             );
             request.output_schema.insert(
                 "normalized".to_owned(),
-                OutputSchema {
-                    output_type: OutputType::String,
+                OutputSchema::String {
                     nullable: false,
-                    max_bytes: Some(64),
-                    minimum: None,
-                    maximum: None,
+                    max_bytes: 64,
                 },
             );
             let error = evaluate_in_process(&request, Arc::new(NoCallTransport))
diff --git a/crates/registry-relay/src/source_plan/artifact/document.rs b/crates/registry-relay/src/source_plan/artifact/document.rs
index 2986ed9652..38c6c0793f 100644
--- a/crates/registry-relay/src/source_plan/artifact/document.rs
+++ b/crates/registry-relay/src/source_plan/artifact/document.rs
@@ -245,16 +245,46 @@ pub(in super::super) enum OutputTypeDocument {
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
-pub(in super::super) struct OutputFieldDocument {
-    #[serde(rename = "type")]
-    pub(in super::super) output_type: OutputTypeDocument,
-    pub(in super::super) nullable: bool,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub(in super::super) max_bytes: Option<u32>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub(in super::super) minimum: Option<i64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub(in super::super) maximum: Option<i64>,
+pub(in super::super) struct OutputObjectFieldDocument {
+    pub(in super::super) required: bool,
+    pub(in super::super) schema: Box<OutputFieldDocument>,
+}
+
+/// Recursive, closed public output schema.
+///
+/// Scalar variants retain the consultation-v1 wire shape. Composite values
+/// add an explicit serialized-value bound and closed child declarations.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
+pub(in super::super) enum OutputFieldDocument {
+    String {
+        nullable: bool,
+        max_bytes: u32,
+    },
+    Boolean {
+        nullable: bool,
+    },
+    Integer {
+        nullable: bool,
+        minimum: i64,
+        maximum: i64,
+    },
+    Date {
+        nullable: bool,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        max_bytes: Option<u32>,
+    },
+    Object {
+        nullable: bool,
+        max_bytes: u32,
+        fields: BTreeMap<String, OutputObjectFieldDocument>,
+    },
+    Array {
+        nullable: bool,
+        max_bytes: u32,
+        max_items: u16,
+        items: Box<OutputFieldDocument>,
+    },
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
@@ -347,12 +377,74 @@ pub(in super::super) enum ResponseSchemaDocument {
 
 impl ResponseSchemaDocument {
     pub(super) fn validates_public_output(&self, output: &OutputFieldDocument) -> bool {
-        match (self, &output.output_type) {
-            (Self::String { nullable, .. }, OutputTypeDocument::String)
-            | (Self::Date { nullable }, OutputTypeDocument::Date)
-            | (Self::Boolean { nullable }, OutputTypeDocument::Boolean)
-            | (Self::Integer { nullable, .. }, OutputTypeDocument::Integer) => {
-                *nullable == output.nullable
+        match (self, output) {
+            (
+                Self::String { nullable, .. },
+                OutputFieldDocument::String {
+                    nullable: output_nullable,
+                    ..
+                },
+            ) => scalar_nullability_is_compatible(*nullable, *output_nullable),
+            (
+                Self::Date { nullable },
+                OutputFieldDocument::Date {
+                    nullable: output_nullable,
+                    max_bytes,
+                },
+            ) => {
+                scalar_nullability_is_compatible(*nullable, *output_nullable)
+                    && matches!(max_bytes, None | Some(10))
+            }
+            (
+                Self::Boolean { nullable },
+                OutputFieldDocument::Boolean {
+                    nullable: output_nullable,
+                },
+            ) => scalar_nullability_is_compatible(*nullable, *output_nullable),
+            (
+                Self::Integer { nullable, .. },
+                OutputFieldDocument::Integer {
+                    nullable: output_nullable,
+                    ..
+                },
+            ) => scalar_nullability_is_compatible(*nullable, *output_nullable),
+            (
+                Self::Object {
+                    nullable,
+                    reject_unknown_fields: true,
+                    fields,
+                },
+                OutputFieldDocument::Object {
+                    nullable: output_nullable,
+                    fields: output_fields,
+                    ..
+                },
+            ) => {
+                nullable == output_nullable
+                    && fields.len() == output_fields.len()
+                    && fields.iter().all(|(name, field)| {
+                        output_fields.get(name).is_some_and(|output_field| {
+                            field.required == output_field.required
+                                && field.schema.validates_public_output(&output_field.schema)
+                        })
+                    })
+            }
+            (
+                Self::Array {
+                    nullable,
+                    max_items,
+                    items,
+                },
+                OutputFieldDocument::Array {
+                    nullable: output_nullable,
+                    max_items: output_max_items,
+                    items: output_items,
+                    ..
+                },
+            ) => {
+                nullable == output_nullable
+                    && max_items == output_max_items
+                    && items.validates_public_output(output_items)
             }
             _ => false,
         }
@@ -409,6 +501,10 @@ impl ResponseSchemaDocument {
     }
 }
 
+const fn scalar_nullability_is_compatible(source_nullable: bool, output_nullable: bool) -> bool {
+    !source_nullable || output_nullable
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub(in super::super) struct ResponseSchemaFieldDocument {
diff --git a/crates/registry-relay/src/source_plan/artifact/validation.rs b/crates/registry-relay/src/source_plan/artifact/validation.rs
index 7fbe3da20e..5281e15271 100644
--- a/crates/registry-relay/src/source_plan/artifact/validation.rs
+++ b/crates/registry-relay/src/source_plan/artifact/validation.rs
@@ -320,41 +320,97 @@ pub(super) fn validate_output(
     output: &BTreeMap<String, OutputFieldDocument>,
     acquired_fields: &BTreeSet<AcquiredField>,
 ) -> Result<(), SourcePlanArtifactError> {
-    if output.len() > MAX_ACQUIRED_FIELDS || acquired_fields.len() > MAX_ACQUIRED_FIELDS {
+    if output.len() > MAX_STATIC_COMPONENTS || acquired_fields.len() > MAX_ACQUIRED_FIELDS {
         return Err(SourcePlanArtifactError::InvalidSet);
     }
     for name in output.keys() {
         AcquiredField::try_from(name.as_str())
             .map_err(|_| SourcePlanArtifactError::InvalidIdentity)?;
     }
+    let mut schema_nodes = 0_usize;
+    let mut expanded_nodes = 0_usize;
     for field in output.values() {
-        let valid = match field.output_type {
-            OutputTypeDocument::String => {
-                field
-                    .max_bytes
-                    .is_some_and(|bound| (1..=MAX_PUBLIC_RESPONSE_BYTES).contains(&bound))
-                    && field.minimum.is_none()
-                    && field.maximum.is_none()
-            }
-            OutputTypeDocument::Integer => {
-                field.max_bytes.is_none()
-                    && matches!((field.minimum, field.maximum), (Some(min), Some(max))
-                        if min <= max
-                            && min.unsigned_abs() <= MAX_JSON_INTEROPERABLE_INTEGER
-                            && max.unsigned_abs() <= MAX_JSON_INTEROPERABLE_INTEGER)
+        let expanded = validate_output_schema(field, 1, &mut schema_nodes)?;
+        expanded_nodes = expanded_nodes
+            .checked_add(expanded)
+            .ok_or(SourcePlanArtifactError::InvalidLimits)?;
+        if expanded_nodes > MAX_RESPONSE_SCHEMA_EXPANDED_NODES {
+            return Err(SourcePlanArtifactError::InvalidLimits);
+        }
+    }
+    Ok(())
+}
+
+fn validate_output_schema(
+    schema: &OutputFieldDocument,
+    depth: usize,
+    nodes: &mut usize,
+) -> Result<usize, SourcePlanArtifactError> {
+    *nodes = nodes
+        .checked_add(1)
+        .ok_or(SourcePlanArtifactError::InvalidLimits)?;
+    if depth > MAX_RESPONSE_SCHEMA_DEPTH || *nodes > MAX_RESPONSE_SCHEMA_NODES {
+        return Err(SourcePlanArtifactError::InvalidLimits);
+    }
+    match schema {
+        OutputFieldDocument::String { max_bytes, .. }
+            if (1..=MAX_PUBLIC_RESPONSE_BYTES).contains(max_bytes) =>
+        {
+            Ok(1)
+        }
+        OutputFieldDocument::Boolean { .. } => Ok(1),
+        OutputFieldDocument::Integer {
+            minimum, maximum, ..
+        } if minimum <= maximum
+            && minimum.unsigned_abs() <= MAX_JSON_INTEROPERABLE_INTEGER
+            && maximum.unsigned_abs() <= MAX_JSON_INTEROPERABLE_INTEGER =>
+        {
+            Ok(1)
+        }
+        OutputFieldDocument::Date {
+            max_bytes: None | Some(10),
+            ..
+        } => Ok(1),
+        OutputFieldDocument::Object {
+            max_bytes, fields, ..
+        } => {
+            if !(1..=MAX_PUBLIC_RESPONSE_BYTES).contains(max_bytes)
+                || fields.is_empty()
+                || fields.len() > MAX_STATIC_COMPONENTS
+            {
+                return Err(SourcePlanArtifactError::InvalidLimits);
             }
-            OutputTypeDocument::Date => {
-                field.max_bytes == Some(10) && field.minimum.is_none() && field.maximum.is_none()
+            let mut expanded = 1_usize;
+            for (name, field) in fields {
+                validate_response_field_name(name)?;
+                let child = validate_output_schema(&field.schema, depth + 1, nodes)?;
+                expanded = expanded
+                    .checked_add(child)
+                    .ok_or(SourcePlanArtifactError::InvalidLimits)?;
             }
-            OutputTypeDocument::Boolean => {
-                field.max_bytes.is_none() && field.minimum.is_none() && field.maximum.is_none()
+            Ok(expanded)
+        }
+        OutputFieldDocument::Array {
+            max_bytes,
+            max_items,
+            items,
+            ..
+        } => {
+            if !(1..=MAX_PUBLIC_RESPONSE_BYTES).contains(max_bytes)
+                || !(1..=MAX_RESPONSE_ARRAY_ITEMS).contains(max_items)
+            {
+                return Err(SourcePlanArtifactError::InvalidLimits);
             }
-        };
-        if !valid {
-            return Err(SourcePlanArtifactError::InvalidAcquisition);
+            let child = validate_output_schema(items, depth + 1, nodes)?;
+            usize::from(*max_items)
+                .checked_mul(child)
+                .and_then(|expanded| expanded.checked_add(1))
+                .ok_or(SourcePlanArtifactError::InvalidLimits)
         }
+        OutputFieldDocument::String { .. }
+        | OutputFieldDocument::Integer { .. }
+        | OutputFieldDocument::Date { .. } => Err(SourcePlanArtifactError::InvalidLimits),
     }
-    Ok(())
 }
 
 pub(super) fn validate_authorization(
@@ -1733,22 +1789,7 @@ fn validate_http_operation(
         let declared = output
             .get(field.as_str())
             .ok_or(SourcePlanArtifactError::InvalidAcquisition)?;
-        let type_matches = match declared.output_type {
-            OutputTypeDocument::Date => matches!(raw_schema, ResponseSchemaDocument::Date {
-                nullable,
-            } if !*nullable || declared.nullable),
-            OutputTypeDocument::String => matches!(raw_schema, ResponseSchemaDocument::String {
-                nullable,
-                ..
-            } if !*nullable || declared.nullable),
-            OutputTypeDocument::Boolean => matches!(raw_schema, ResponseSchemaDocument::Boolean {
-                nullable,
-            } if !*nullable || declared.nullable),
-            OutputTypeDocument::Integer => matches!(raw_schema, ResponseSchemaDocument::Integer {
-                nullable,
-                ..
-            } if !*nullable || declared.nullable),
-        };
+        let type_matches = raw_schema.validates_public_output(declared);
         let reviewed_rhai_alias = if *plan_kind == SourcePlanKind::Script {
             operation
                 .response
@@ -1997,14 +2038,19 @@ pub(super) fn resolve_response_pointer<'a>(
         };
     }
     match current {
-        ResponseSchemaDocument::String { .. }
+        ResponseSchemaDocument::ScriptBody | ResponseSchemaDocument::Number { .. } => {
+            Err(SourcePlanArtifactError::InvalidAcquisition)
+        }
+        ResponseSchemaDocument::Object {
+            reject_unknown_fields: false,
+            ..
+        } => Err(SourcePlanArtifactError::InvalidAcquisition),
+        ResponseSchemaDocument::Object { .. }
+        | ResponseSchemaDocument::Array { .. }
+        | ResponseSchemaDocument::String { .. }
         | ResponseSchemaDocument::Date { .. }
         | ResponseSchemaDocument::Boolean { .. }
-        | ResponseSchemaDocument::Integer { .. }
-        | ResponseSchemaDocument::Number { .. } => Ok(current),
-        ResponseSchemaDocument::ScriptBody
-        | ResponseSchemaDocument::Object { .. }
-        | ResponseSchemaDocument::Array { .. } => Err(SourcePlanArtifactError::InvalidAcquisition),
+        | ResponseSchemaDocument::Integer { .. } => Ok(current),
     }
 }
 
diff --git a/crates/registry-relay/src/source_plan/compiler.rs b/crates/registry-relay/src/source_plan/compiler.rs
index 5f56304e6e..62217d98aa 100644
--- a/crates/registry-relay/src/source_plan/compiler.rs
+++ b/crates/registry-relay/src/source_plan/compiler.rs
@@ -31,7 +31,7 @@ use super::artifact::{
     InputRoleDocument, InputTypeDocument, IntegrationPackArtifact,
     MaterializationRefreshClassDocument, OAuth2ClientCredentialsRequestFormatDocument,
     OAuth2TokenCacheModeDocument, OAuth2TokenResponseSchemaDocument, OAuth2TokenTypeDocument,
-    OutputTypeDocument, PriorOutputBindingDocument, PrivateBindingArtifact,
+    OutputFieldDocument, OutputTypeDocument, PriorOutputBindingDocument, PrivateBindingArtifact,
     ProjectionMechanismDocument, PublicContractArtifact, ReadMethod, RequestCodecDocument,
     RequestSelectorLocationDocument, RequestSignerDocument, ResponseFormatDocument,
     ResponseNormalizationDocument, ResponseSchemaDocument, ScriptAuthorityDocument,
@@ -909,6 +909,7 @@ impl CompiledPriorOutputSlot {
 pub struct CompiledOutputMapping {
     field: AcquiredField,
     pointer: CompiledJsonPointer,
+    schema: super::runtime_profile::CompiledOutputShape,
 }
 
 impl CompiledOutputMapping {
@@ -920,6 +921,10 @@ impl CompiledOutputMapping {
     pub(crate) const fn extraction_pointer(&self) -> &CompiledJsonPointer {
         &self.pointer
     }
+
+    pub(crate) const fn schema(&self) -> &super::runtime_profile::CompiledOutputShape {
+        &self.schema
+    }
 }
 
 /// Concrete response-cardinality enforcement compiled from request-linked proof.
@@ -1831,18 +1836,11 @@ struct CompiledRhaiProgram {
     entrypoint: Box<str>,
 }
 
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub(crate) enum CompiledRhaiOutputType {
-    String { max_bytes: u32 },
-    Boolean,
-    Integer { minimum: i64, maximum: i64 },
-    Date,
-}
+pub(crate) type CompiledRhaiOutputType = super::runtime_profile::CompiledOutputShape;
 
 pub(crate) struct CompiledRhaiOutput {
     name: Box<str>,
     output_type: CompiledRhaiOutputType,
-    nullable: bool,
 }
 
 impl CompiledRhaiOutput {
@@ -1850,12 +1848,12 @@ impl CompiledRhaiOutput {
         &self.name
     }
 
-    pub(crate) const fn output_type(&self) -> CompiledRhaiOutputType {
-        self.output_type
+    pub(crate) const fn output_type(&self) -> &CompiledRhaiOutputType {
+        &self.output_type
     }
 
     pub(crate) const fn nullable(&self) -> bool {
-        self.nullable
+        self.output_type.nullable()
     }
 }
 
@@ -2668,28 +2666,7 @@ fn compile_one(
             .output()
             .map(|field| CompiledRhaiOutput {
                 name: field.name().into(),
-                output_type: match field.shape() {
-                    super::runtime_profile::CompiledOutputShape::String { max_bytes, .. } => {
-                        CompiledRhaiOutputType::String { max_bytes }
-                    }
-                    super::runtime_profile::CompiledOutputShape::Boolean { .. } => {
-                        CompiledRhaiOutputType::Boolean
-                    }
-                    super::runtime_profile::CompiledOutputShape::Integer {
-                        minimum,
-                        maximum,
-                        ..
-                    } => CompiledRhaiOutputType::Integer { minimum, maximum },
-                    super::runtime_profile::CompiledOutputShape::Date { .. } => {
-                        CompiledRhaiOutputType::Date
-                    }
-                },
-                nullable: match field.shape() {
-                    super::runtime_profile::CompiledOutputShape::String { nullable, .. }
-                    | super::runtime_profile::CompiledOutputShape::Boolean { nullable }
-                    | super::runtime_profile::CompiledOutputShape::Integer { nullable, .. }
-                    | super::runtime_profile::CompiledOutputShape::Date { nullable } => nullable,
-                },
+                output_type: field.shape().clone(),
             })
             .collect::<Box<[_]>>()
     } else {
@@ -3101,5 +3078,5 @@ pub(crate) use tests::{
     rhai_five_operation_two_slot_completion_seed_fixture, rhai_runtime_vector_plan_fixture,
     semantic_alias_completion_seed_fixture, shared_snapshot_registry_fixture,
     signed_dci_expiring_oauth_runtime_plan_fixture, signed_dci_script_runtime_plan_fixture,
-    snapshot_completion_seed_fixture,
+    snapshot_completion_seed_fixture, structured_output_plan_fixture,
 };
diff --git a/crates/registry-relay/src/source_plan/compiler/operation.rs b/crates/registry-relay/src/source_plan/compiler/operation.rs
index 1168c8af8d..1fcf9f075c 100644
--- a/crates/registry-relay/src/source_plan/compiler/operation.rs
+++ b/crates/registry-relay/src/source_plan/compiler/operation.rs
@@ -449,7 +449,7 @@ pub(super) fn compile_operation_descriptors(
                 }
             })?;
             let projection = compile_projection(operation)?;
-            let response = compile_response(operation)?;
+            let response = compile_response(operation, &pack.document.spec.output)?;
             let response_decoder = (response.normalization()
                 != CompiledResponseNormalization::ScriptBody)
                 .then(|| compile_closed_json_decoder(&response))
@@ -793,6 +793,7 @@ fn compile_projection(
 
 fn compile_response(
     operation: &HttpOperationDocument,
+    output_schema: &BTreeMap<String, OutputFieldDocument>,
 ) -> Result<CompiledResponse, SourcePlanCompileError> {
     let outputs = operation
         .response
@@ -803,6 +804,11 @@ fn compile_response(
                 field: AcquiredField::try_from(field.as_str())
                     .map_err(|_| SourcePlanCompileError::CompilerInvariant)?,
                 pointer: compile_json_pointer(pointer)?,
+                schema: super::super::runtime_profile::compile_output_shape(
+                    output_schema
+                        .get(field)
+                        .ok_or(SourcePlanCompileError::CompilerInvariant)?,
+                ),
             })
         })
         .collect::<Result<Box<[_]>, _>>()?;
diff --git a/crates/registry-relay/src/source_plan/compiler/tests.rs b/crates/registry-relay/src/source_plan/compiler/tests.rs
index 46cdaf12a0..91cffb3656 100644
--- a/crates/registry-relay/src/source_plan/compiler/tests.rs
+++ b/crates/registry-relay/src/source_plan/compiler/tests.rs
@@ -3325,7 +3325,396 @@ fn semantic_output_aliases_are_distinct_from_complete_raw_acquisition() {
 }
 
 #[test]
-fn full_date_fact_preserves_its_type_and_rejects_string_substitution() {
+fn scalar_public_outputs_preserve_independent_bounds_and_safe_nullability() {
+    let mut string = semantic_alias_fixture();
+    let string_source = json!({"type": "string", "nullable": false, "max_bytes": 65_536});
+    string.pack_value["spec"]["plan"]["operations"][0]["response"]["schema"]["items"]["fields"]
+        ["registration_status"]["schema"] = string_source.clone();
+    string.pack_value["spec"]["reviewed_acquisition"]["fields"]["registration_status"] =
+        string_source.clone();
+    string.pack_value["spec"]["acquisition"]["fields"]["registration_status"] =
+        string_source.clone();
+    string.contract_value["spec"]["acquisition"]["fields"]["registration_status"] = string_source;
+    string.pack_value["spec"]["output"]["status"]["nullable"] = json!(true);
+    string.contract_value["spec"]["output"]["status"]["nullable"] = json!(true);
+    string.refresh_all();
+    compile(&string).expect("broad string acquisition narrows to a nullable public output");
+
+    let mut integer = semantic_alias_fixture();
+    let integer_source =
+        json!({"type": "integer", "nullable": false, "minimum": -100, "maximum": 100});
+    let integer_output =
+        json!({"type": "integer", "nullable": true, "minimum": -10, "maximum": 10});
+    integer.pack_value["spec"]["plan"]["operations"][0]["response"]["schema"]["items"]["fields"]
+        ["registration_status"]["schema"] = integer_source.clone();
+    integer.pack_value["spec"]["reviewed_acquisition"]["fields"]["registration_status"] =
+        integer_source.clone();
+    integer.pack_value["spec"]["acquisition"]["fields"]["registration_status"] =
+        integer_source.clone();
+    integer.contract_value["spec"]["acquisition"]["fields"]["registration_status"] = integer_source;
+    integer.pack_value["spec"]["output"]["status"] = integer_output.clone();
+    integer.contract_value["spec"]["output"]["status"] = integer_output;
+    integer.refresh_all();
+    compile(&integer).expect("broad integer acquisition narrows to a nullable public output");
+
+    let mut wider_output = semantic_alias_fixture();
+    let narrow_source = json!({"type": "string", "nullable": false, "max_bytes": 32});
+    wider_output.pack_value["spec"]["plan"]["operations"][0]["response"]["schema"]["items"]
+        ["fields"]["registration_status"]["schema"] = narrow_source.clone();
+    wider_output.pack_value["spec"]["reviewed_acquisition"]["fields"]["registration_status"] =
+        narrow_source.clone();
+    wider_output.pack_value["spec"]["acquisition"]["fields"]["registration_status"] =
+        narrow_source.clone();
+    wider_output.contract_value["spec"]["acquisition"]["fields"]["registration_status"] =
+        narrow_source;
+    wider_output.refresh_all();
+    compile(&wider_output)
+        .expect("independently enforced scalar bounds remain consultation-v1 compatible");
+}
+
+#[test]
+fn scalar_public_outputs_reject_nullable_source_for_nonnullable_output() {
+    let mut nullability = semantic_alias_fixture();
+    let nullable_source = json!({"type": "string", "nullable": true, "max_bytes": 64});
+    nullability.pack_value["spec"]["plan"]["operations"][0]["response"]["schema"]["items"]
+        ["fields"]["registration_status"]["schema"] = nullable_source.clone();
+    nullability.pack_value["spec"]["reviewed_acquisition"]["fields"]["registration_status"] =
+        nullable_source.clone();
+    nullability.pack_value["spec"]["acquisition"]["fields"]["registration_status"] =
+        nullable_source.clone();
+    nullability.contract_value["spec"]["acquisition"]["fields"]["registration_status"] =
+        nullable_source;
+    nullability.refresh_all();
+    assert!(matches!(
+        compile(&nullability),
+        Err(SourcePlanCompileError::Artifact(
+            SourcePlanArtifactError::InvalidAcquisition
+        ))
+    ));
+}
+
+fn structured_output_fixture() -> Fixture {
+    let mut fixture = semantic_alias_fixture();
+    let name_response = json!({
+        "type": "object",
+        "nullable": false,
+        "reject_unknown_fields": true,
+        "fields": {
+            "family": {
+                "required": true,
+                "schema": {"type": "string", "nullable": false, "max_bytes": 128}
+            },
+            "given": {
+                "required": true,
+                "schema": {"type": "string", "nullable": false, "max_bytes": 128}
+            }
+        }
+    });
+    let response = json!({
+        "type": "object",
+        "nullable": false,
+        "reject_unknown_fields": true,
+        "fields": {
+            "registration_number": {
+                "required": true,
+                "schema": {"type": "string", "nullable": false, "max_bytes": 64}
+            },
+            "parents": {
+                "required": true,
+                "schema": {
+                    "type": "array",
+                    "nullable": false,
+                    "max_items": 2,
+                    "items": {
+                        "type": "object",
+                        "nullable": false,
+                        "reject_unknown_fields": true,
+                        "fields": {
+                            "name": {
+                                "required": true,
+                                "schema": name_response
+                            },
+                            "relationship": {
+                                "required": true,
+                                "schema": {
+                                    "type": "string",
+                                    "nullable": false,
+                                    "max_bytes": 32
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    });
+    let name_output = json!({
+        "type": "object",
+        "nullable": false,
+        "max_bytes": 512,
+        "fields": {
+            "family": {
+                "required": true,
+                "schema": {"type": "string", "nullable": false, "max_bytes": 128}
+            },
+            "given": {
+                "required": true,
+                "schema": {"type": "string", "nullable": false, "max_bytes": 128}
+            }
+        }
+    });
+    let output = json!({
+        "type": "object",
+        "nullable": false,
+        "max_bytes": 4096,
+        "fields": {
+            "registration_number": {
+                "required": true,
+                "schema": {"type": "string", "nullable": false, "max_bytes": 64}
+            },
+            "parents": {
+                "required": true,
+                "schema": {
+                    "type": "array",
+                    "nullable": false,
+                    "max_bytes": 3072,
+                    "max_items": 2,
+                    "items": {
+                        "type": "object",
+                        "nullable": false,
+                        "max_bytes": 1024,
+                        "fields": {
+                            "name": {
+                                "required": true,
+                                "schema": name_output
+                            },
+                            "relationship": {
+                                "required": true,
+                                "schema": {
+                                    "type": "string",
+                                    "nullable": false,
+                                    "max_bytes": 32
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    });
+    fixture.pack_value["spec"]["plan"]["operations"][0]["response"]["schema"]["items"]["fields"]
+        ["registration_status"]["schema"] = response.clone();
+    fixture.pack_value["spec"]["reviewed_acquisition"]["fields"]["registration_status"] =
+        response.clone();
+    fixture.pack_value["spec"]["acquisition"]["fields"]["registration_status"] = response.clone();
+    fixture.contract_value["spec"]["acquisition"]["fields"]["registration_status"] = response;
+    fixture.pack_value["spec"]["output"]["status"] = output.clone();
+    fixture.contract_value["spec"]["output"]["status"] = output;
+    fixture.refresh_all();
+    fixture
+}
+
+pub(crate) fn structured_output_plan_fixture() -> CompiledSourcePlan {
+    compile(&structured_output_fixture())
+        .expect("structured output fixture compiles")
+        .plans
+        .into_values()
+        .next()
+        .expect("one structured output plan")
+}
+
+#[test]
+fn recursive_output_schema_compiles_and_is_hash_committed() {
+    let fixture = structured_output_fixture();
+    let registry = compile(&fixture).expect("closed recursive output compiles");
+    let plan = registry.iter().next().expect("structured plan");
+    let output = plan
+        .operations()
+        .next()
+        .expect("structured operation")
+        .response()
+        .outputs()
+        .next()
+        .expect("structured output mapping");
+    assert!(matches!(
+        output.schema(),
+        crate::source_plan::runtime_profile::CompiledOutputShape::Object {
+            nullable: false,
+            max_bytes: 4096,
+            fields,
+        } if fields.iter().any(|field| {
+            field.name() == "parents"
+                && matches!(
+                    field.shape(),
+                    crate::source_plan::runtime_profile::CompiledOutputShape::Array {
+                        nullable: false,
+                        max_bytes: 3072,
+                        max_items: 2,
+                        ..
+                    }
+                )
+        })
+    ));
+
+    let mut changed_bound = fixture.clone();
+    changed_bound.pack_value["spec"]["output"]["status"]["max_bytes"] = json!(4095);
+    changed_bound.contract_value["spec"]["output"]["status"]["max_bytes"] = json!(4095);
+    changed_bound.refresh_all();
+    let changed_registry =
+        compile(&changed_bound).expect("changed structured serialized bound compiles");
+    let changed_plan = changed_registry.iter().next().expect("changed plan");
+    assert_ne!(fixture.contract_hash, changed_bound.contract_hash);
+    assert_ne!(
+        plan.runtime_profile().physical_projection_digest(),
+        changed_plan.runtime_profile().physical_projection_digest()
+    );
+}
+
+#[test]
+fn recursive_output_schema_rejects_depth_node_field_array_and_expansion_bounds() {
+    let valid = structured_output_fixture();
+
+    let mut too_many_fields = valid.clone();
+    let fields = (0..33)
+        .map(|index| {
+            (
+                format!("field_{index}"),
+                json!({
+                    "required": true,
+                    "schema": {"type": "boolean", "nullable": false}
+                }),
+            )
+        })
+        .collect::<serde_json::Map<_, _>>();
+    for document in [
+        &mut too_many_fields.pack_value,
+        &mut too_many_fields.contract_value,
+    ] {
+        document["spec"]["output"]["status"] = json!({
+            "type": "object",
+            "nullable": false,
+            "max_bytes": 4096,
+            "fields": fields.clone()
+        });
+    }
+    too_many_fields.refresh_all();
+    assert!(matches!(
+        compile(&too_many_fields),
+        Err(SourcePlanCompileError::Artifact(
+            SourcePlanArtifactError::InvalidLimits
+        ))
+    ));
+
+    let mut too_deep_schema = json!({"type": "boolean", "nullable": false});
+    for _ in 0..8 {
+        too_deep_schema = json!({
+            "type": "array",
+            "nullable": false,
+            "max_bytes": 4096,
+            "max_items": 1,
+            "items": too_deep_schema
+        });
+    }
+    let mut too_deep = valid.clone();
+    too_deep.pack_value["spec"]["output"]["status"] = too_deep_schema.clone();
+    too_deep.contract_value["spec"]["output"]["status"] = too_deep_schema;
+    too_deep.refresh_all();
+    assert!(matches!(
+        compile(&too_deep),
+        Err(SourcePlanCompileError::Artifact(
+            SourcePlanArtifactError::InvalidLimits
+        ))
+    ));
+
+    let mut too_many_items = valid.clone();
+    let array = json!({
+        "type": "array",
+        "nullable": false,
+        "max_bytes": 4096,
+        "max_items": 257,
+        "items": {"type": "boolean", "nullable": false}
+    });
+    too_many_items.pack_value["spec"]["output"]["status"] = array.clone();
+    too_many_items.contract_value["spec"]["output"]["status"] = array;
+    too_many_items.refresh_all();
+    assert!(matches!(
+        compile(&too_many_items),
+        Err(SourcePlanCompileError::Artifact(
+            SourcePlanArtifactError::InvalidLimits
+        ))
+    ));
+
+    let mut expanded = valid.clone();
+    let expanded_array = json!({
+        "type": "array",
+        "nullable": false,
+        "max_bytes": 65536,
+        "max_items": 256,
+        "items": {
+            "type": "array",
+            "nullable": false,
+            "max_bytes": 65536,
+            "max_items": 256,
+            "items": {"type": "boolean", "nullable": false}
+        }
+    });
+    expanded.pack_value["spec"]["output"]["status"] = expanded_array.clone();
+    expanded.contract_value["spec"]["output"]["status"] = expanded_array;
+    expanded.refresh_all();
+    assert!(matches!(
+        compile(&expanded),
+        Err(SourcePlanCompileError::Artifact(
+            SourcePlanArtifactError::InvalidLimits
+        ))
+    ));
+
+    let child_fields = (0..8)
+        .map(|index| {
+            (
+                format!("child_{index}"),
+                json!({
+                    "required": true,
+                    "schema": {"type": "boolean", "nullable": false}
+                }),
+            )
+        })
+        .collect::<serde_json::Map<_, _>>();
+    let node_fields = (0..32)
+        .map(|index| {
+            (
+                format!("field_{index}"),
+                json!({
+                    "required": true,
+                    "schema": {
+                        "type": "object",
+                        "nullable": false,
+                        "max_bytes": 4096,
+                        "fields": child_fields.clone()
+                    }
+                }),
+            )
+        })
+        .collect::<serde_json::Map<_, _>>();
+    let mut too_many_nodes = valid;
+    let node_schema = json!({
+        "type": "object",
+        "nullable": false,
+        "max_bytes": 65536,
+        "fields": node_fields
+    });
+    too_many_nodes.pack_value["spec"]["output"]["status"] = node_schema.clone();
+    too_many_nodes.contract_value["spec"]["output"]["status"] = node_schema;
+    too_many_nodes.refresh_all();
+    assert!(matches!(
+        compile(&too_many_nodes),
+        Err(SourcePlanCompileError::Artifact(
+            SourcePlanArtifactError::InvalidLimits
+        ))
+    ));
+}
+
+#[test]
+fn full_date_fact_accepts_legacy_bound_omission_and_rejects_string_substitution() {
     let mut valid = semantic_alias_fixture();
     let date_schema = json!({"type": "date", "nullable": false});
     valid.pack_value["spec"]["plan"]["operations"][0]["response"]["schema"]["items"]["fields"]
@@ -3339,6 +3728,39 @@ fn full_date_fact_preserves_its_type_and_rejects_string_substitution() {
     valid.contract_value["spec"]["output"]["status"]["type"] = json!("date");
     valid.contract_value["spec"]["output"]["status"]["max_bytes"] = json!(10);
     valid.refresh_all();
+
+    let mut legacy = valid.clone();
+    legacy.pack_value["spec"]["output"]["status"]
+        .as_object_mut()
+        .expect("legacy date output")
+        .remove("max_bytes");
+    legacy.contract_value["spec"]["output"]["status"]
+        .as_object_mut()
+        .expect("legacy date output")
+        .remove("max_bytes");
+    legacy.refresh_all();
+    let legacy_registry = compile(&legacy).expect("legacy date output without max_bytes compiles");
+    let legacy_plan = legacy_registry.iter().next().expect("legacy date plan");
+    let legacy_contract = parse_json_strict(legacy_plan.canonical_public_contract())
+        .expect("legacy contract remains valid JSON");
+    assert!(
+        legacy_contract["spec"]["output"]["status"]
+            .get("max_bytes")
+            .is_none(),
+        "legacy date wire shape remains omitted"
+    );
+
+    let mut invalid_bound = valid.clone();
+    invalid_bound.pack_value["spec"]["output"]["status"]["max_bytes"] = json!(11);
+    invalid_bound.contract_value["spec"]["output"]["status"]["max_bytes"] = json!(11);
+    invalid_bound.refresh_all();
+    assert!(matches!(
+        compile(&invalid_bound),
+        Err(SourcePlanCompileError::Artifact(
+            SourcePlanArtifactError::InvalidLimits
+        ))
+    ));
+
     let registry = compile(&valid).expect("typed full-date output compiles");
     let plan = registry.iter().next().expect("compiled date plan");
     assert!(matches!(
@@ -3535,7 +3957,7 @@ fn bounded_http_runtime_commitment_digests_are_stable() {
     );
     assert_eq!(
         normal.1,
-        "sha256:550f3f915fc0396e5f1dc807ea8435d03db787d1d17f23fbef0eab0289bacb36"
+        "sha256:f7242b9e8ccfd506829614bd5d8a53d9289dd506670607c412bed1daa1365afd"
     );
 }
 
@@ -3600,7 +4022,7 @@ fn rhai_runtime_commitment_digest_binds_safe_script_and_dispatch_outputs() {
     );
     assert_eq!(
         base.1,
-        "sha256:fb6366892e6750e6efb9816f839b167af1aca64c10817d853745665291f1008d"
+        "sha256:6ad249272f62fb264435c7a582ed8ce6ace3ebaf0a69b16a8a897fd213c782ba"
     );
     assert_eq!(
         changed_script_digest.0,
@@ -3826,11 +4248,17 @@ fn script_terminal_output_contract_retains_each_scalar_bound() {
         .next()
         .expect("string plan")
         .rhai_outputs()
-        .map(CompiledRhaiOutput::output_type)
+        .map(|output| output.output_type().clone())
         .collect::<Vec<_>>();
     assert_eq!(
         string_bounds,
-        vec![CompiledRhaiOutputType::String { max_bytes: 64 }; 5]
+        vec![
+            CompiledRhaiOutputType::String {
+                nullable: false,
+                max_bytes: 64
+            };
+            5
+        ]
     );
 
     let mut integer_fixture = rhai_five_operation_fixture();
@@ -3865,6 +4293,7 @@ fn script_terminal_output_contract_retains_each_scalar_bound() {
         .all(|output| matches!(
             output.output_type(),
             CompiledRhaiOutputType::Integer {
+                nullable: false,
                 minimum: -2,
                 maximum: 2
             }
diff --git a/crates/registry-relay/src/source_plan/completion_seed.rs b/crates/registry-relay/src/source_plan/completion_seed.rs
index 707faa8e2e..453a1aef56 100644
--- a/crates/registry-relay/src/source_plan/completion_seed.rs
+++ b/crates/registry-relay/src/source_plan/completion_seed.rs
@@ -26,13 +26,14 @@ use super::compiler::{
     CompiledValueExpression, RhaiWorkerLimits, SourcePlanCompileError,
 };
 use super::runtime_profile::{
-    CompiledDispatchProfile, PhysicalProjectionDigest, PredicatePlanDigest, RhaiPredicateIdentity,
+    CompiledDispatchProfile, CompiledOutputField, CompiledOutputShape, PhysicalProjectionDigest,
+    PredicatePlanDigest, RhaiPredicateIdentity,
 };
 
 pub(super) const MAX_COMPLETION_AUDIT_CANONICAL_BYTES_V1: usize = 768 * 1024;
 
 const PREDICATE_PLAN_DOMAIN_V1: &str = "registry.relay.consultation-predicate-plan.v1";
-const PHYSICAL_PROJECTION_DOMAIN_V1: &str = "registry.relay.consultation-physical-projection.v1";
+const PHYSICAL_PROJECTION_DOMAIN_V2: &str = "registry.relay.consultation-physical-projection.v2";
 
 pub(super) struct CompletionSeedSizing {
     pub(super) canonical_bytes_max: usize,
@@ -121,6 +122,10 @@ impl CompiledCompletionSeedTemplate {
     }
 }
 
+#[allow(
+    clippy::too_many_arguments,
+    reason = "commitment dimensions stay explicit so a caller cannot silently omit one hashed input"
+)]
 pub(super) fn compile_runtime_commitment_digests(
     kind: SourcePlanKind,
     input_names: &[&str],
@@ -129,6 +134,7 @@ pub(super) fn compile_runtime_commitment_digests(
     dispatch: &CompiledDispatchProfile,
     rhai: Option<&RhaiPredicateIdentity>,
     snapshot: Option<&CompiledSnapshotBinding>,
+    output: &[CompiledOutputField],
 ) -> Result<(PredicatePlanDigest, PhysicalProjectionDigest), SourcePlanCompileError> {
     let predicate = compile_predicate_plan_digest(
         kind,
@@ -139,7 +145,7 @@ pub(super) fn compile_runtime_commitment_digests(
         rhai,
         snapshot,
     )?;
-    let projection = compile_physical_projection_digest(kind, operations, snapshot)?;
+    let projection = compile_physical_projection_digest(kind, operations, snapshot, output)?;
     Ok((predicate, projection))
 }
 
@@ -233,6 +239,7 @@ fn compile_physical_projection_digest(
     kind: SourcePlanKind,
     operations: &[CompiledOperation],
     snapshot: Option<&CompiledSnapshotBinding>,
+    output: &[CompiledOutputField],
 ) -> Result<PhysicalProjectionDigest, SourcePlanCompileError> {
     let mut operation_preimages = operations
         .iter()
@@ -244,6 +251,7 @@ fn compile_physical_projection_digest(
                     json!({
                         "field": output.field(),
                         "pointer_tokens": output.extraction_pointer().tokens().collect::<Vec<_>>(),
+                        "schema": output_shape_preimage(output.schema()),
                     })
                 })
                 .collect::<Vec<_>>();
@@ -304,8 +312,15 @@ fn compile_physical_projection_digest(
         return Err(SourcePlanCompileError::CompilerInvariant);
     }
     let mut preimage = json!({
-        "schema": "registry.relay.consultation-physical-projection.v1",
+        "schema": "registry.relay.consultation-physical-projection.v2",
         "plan_kind": source_plan_kind_str(kind),
+        "output_schema": output
+            .iter()
+            .map(|field| (
+                field.name().to_owned(),
+                output_shape_preimage(field.shape()),
+            ))
+            .collect::<serde_json::Map<_, _>>(),
         "operations": operation_preimages
             .into_iter()
             .map(|(_, preimage)| preimage)
@@ -315,11 +330,78 @@ fn compile_physical_projection_digest(
         preimage["snapshot_projection"] = snapshot_projection;
     }
     PhysicalProjectionDigest::from_compiled_label(domain_separated_digest(
-        PHYSICAL_PROJECTION_DOMAIN_V1,
+        PHYSICAL_PROJECTION_DOMAIN_V2,
         &preimage,
     )?)
 }
 
+fn output_shape_preimage(shape: &CompiledOutputShape) -> Value {
+    match shape {
+        CompiledOutputShape::String {
+            nullable,
+            max_bytes,
+        } => json!({
+            "type": "string",
+            "nullable": nullable,
+            "max_bytes": max_bytes,
+        }),
+        CompiledOutputShape::Boolean { nullable } => json!({
+            "type": "boolean",
+            "nullable": nullable,
+        }),
+        CompiledOutputShape::Integer {
+            nullable,
+            minimum,
+            maximum,
+        } => json!({
+            "type": "integer",
+            "nullable": nullable,
+            "minimum": minimum,
+            "maximum": maximum,
+        }),
+        CompiledOutputShape::Date { nullable } => json!({
+            "type": "date",
+            "nullable": nullable,
+        }),
+        CompiledOutputShape::Object {
+            nullable,
+            max_bytes,
+            fields,
+        } => {
+            let fields = fields
+                .iter()
+                .map(|field| {
+                    (
+                        field.name().to_owned(),
+                        json!({
+                            "required": field.required(),
+                            "schema": output_shape_preimage(field.shape()),
+                        }),
+                    )
+                })
+                .collect::<serde_json::Map<_, _>>();
+            json!({
+                "type": "object",
+                "nullable": nullable,
+                "max_bytes": max_bytes,
+                "fields": fields,
+            })
+        }
+        CompiledOutputShape::Array {
+            nullable,
+            max_bytes,
+            max_items,
+            items,
+        } => json!({
+            "type": "array",
+            "nullable": nullable,
+            "max_bytes": max_bytes,
+            "max_items": max_items,
+            "items": output_shape_preimage(items),
+        }),
+    }
+}
+
 fn predicate_operation_preimage(
     operation: &CompiledOperation,
     input_names: &[&str],
diff --git a/crates/registry-relay/src/source_plan/mod.rs b/crates/registry-relay/src/source_plan/mod.rs
index 779050efb2..951afeddce 100644
--- a/crates/registry-relay/src/source_plan/mod.rs
+++ b/crates/registry-relay/src/source_plan/mod.rs
@@ -43,8 +43,8 @@ pub use compiler::{
     RhaiWorkerCapability, SourcePlanArtifactBundle, SourcePlanCompileError,
 };
 pub(crate) use compiler::{
-    CompiledDciExact, CompiledDciSelector, CompiledRhaiOutputType, CompiledScriptAllowRule,
-    CompiledScriptAuthority, ParsedOAuth2AccessToken,
+    CompiledDciExact, CompiledDciSelector, CompiledScriptAllowRule, CompiledScriptAuthority,
+    ParsedOAuth2AccessToken,
 };
 #[allow(
     unused_imports,
@@ -83,5 +83,5 @@ pub(crate) use compiler::{
     rhai_five_operation_two_slot_completion_seed_fixture, rhai_runtime_vector_plan_fixture,
     semantic_alias_completion_seed_fixture, shared_snapshot_registry_fixture,
     signed_dci_expiring_oauth_runtime_plan_fixture, signed_dci_script_runtime_plan_fixture,
-    snapshot_completion_seed_fixture,
+    snapshot_completion_seed_fixture, structured_output_plan_fixture,
 };
diff --git a/crates/registry-relay/src/source_plan/runtime_profile.rs b/crates/registry-relay/src/source_plan/runtime_profile.rs
index ad339d2e4c..8246be71b0 100644
--- a/crates/registry-relay/src/source_plan/runtime_profile.rs
+++ b/crates/registry-relay/src/source_plan/runtime_profile.rs
@@ -15,7 +15,7 @@ use crate::consultation::{
 };
 
 use super::artifact::{
-    ConsentRevocationDocument, OutputTypeDocument, PrivateBindingHash, PublicContractArtifact,
+    ConsentRevocationDocument, OutputFieldDocument, PrivateBindingHash, PublicContractArtifact,
     SourceCardinality, SourceObservedAtDocument, SourcePlanKind, SourcePlanLimits,
     SourceRevisionDocument,
 };
@@ -315,7 +315,7 @@ impl CompiledRuntimeProfile {
                     },
                 })
             })
-            .collect::<Result<_, SourcePlanCompileError>>()?;
+            .collect::<Result<Box<[_]>, SourcePlanCompileError>>()?;
         let acquisition = CompiledAcquisitionSchema {
             fields: contract
                 .document
@@ -341,32 +341,10 @@ impl CompiledRuntimeProfile {
                 Ok(CompiledOutputField {
                     name: AcquiredField::try_from(name.as_str())
                         .map_err(|_| SourcePlanCompileError::CompilerInvariant)?,
-                    shape: match field.output_type {
-                        OutputTypeDocument::String => CompiledOutputShape::String {
-                            nullable: field.nullable,
-                            max_bytes: field
-                                .max_bytes
-                                .ok_or(SourcePlanCompileError::CompilerInvariant)?,
-                        },
-                        OutputTypeDocument::Boolean => CompiledOutputShape::Boolean {
-                            nullable: field.nullable,
-                        },
-                        OutputTypeDocument::Integer => CompiledOutputShape::Integer {
-                            nullable: field.nullable,
-                            minimum: field
-                                .minimum
-                                .ok_or(SourcePlanCompileError::CompilerInvariant)?,
-                            maximum: field
-                                .maximum
-                                .ok_or(SourcePlanCompileError::CompilerInvariant)?,
-                        },
-                        OutputTypeDocument::Date => CompiledOutputShape::Date {
-                            nullable: field.nullable,
-                        },
-                    },
+                    shape: compile_output_shape(field),
                 })
             })
-            .collect::<Result<_, SourcePlanCompileError>>()?;
+            .collect::<Result<Box<[_]>, SourcePlanCompileError>>()?;
         let outcomes = contract
             .document
             .spec
@@ -442,6 +420,7 @@ impl CompiledRuntimeProfile {
                 &dispatch,
                 rhai_predicate_identity.as_ref(),
                 snapshot,
+                &output,
             )?;
         let (observed, revision) = (
             &contract.document.spec.source_provenance.source_observed_at,
@@ -953,12 +932,33 @@ impl CompiledOutputField {
         self.name.as_str()
     }
 
-    pub(crate) const fn shape(&self) -> CompiledOutputShape {
-        self.shape
+    pub(crate) const fn shape(&self) -> &CompiledOutputShape {
+        &self.shape
     }
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct CompiledOutputObjectField {
+    name: Box<str>,
+    required: bool,
+    shape: CompiledOutputShape,
+}
+
+impl CompiledOutputObjectField {
+    pub(crate) fn name(&self) -> &str {
+        &self.name
+    }
+
+    pub(crate) const fn required(&self) -> bool {
+        self.required
+    }
+
+    pub(crate) const fn shape(&self) -> &CompiledOutputShape {
+        &self.shape
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub(crate) enum CompiledOutputShape {
     String {
         nullable: bool,
@@ -975,6 +975,94 @@ pub(crate) enum CompiledOutputShape {
     Date {
         nullable: bool,
     },
+    Object {
+        nullable: bool,
+        max_bytes: u32,
+        fields: Box<[CompiledOutputObjectField]>,
+    },
+    Array {
+        nullable: bool,
+        max_bytes: u32,
+        max_items: u16,
+        items: Box<CompiledOutputShape>,
+    },
+}
+
+impl CompiledOutputShape {
+    pub(crate) const fn nullable(&self) -> bool {
+        match self {
+            Self::String { nullable, .. }
+            | Self::Boolean { nullable }
+            | Self::Integer { nullable, .. }
+            | Self::Date { nullable }
+            | Self::Object { nullable, .. }
+            | Self::Array { nullable, .. } => *nullable,
+        }
+    }
+
+    pub(crate) const fn structured_max_bytes(&self) -> Option<u32> {
+        match self {
+            Self::Object { max_bytes, .. } | Self::Array { max_bytes, .. } => Some(*max_bytes),
+            Self::String { .. }
+            | Self::Boolean { .. }
+            | Self::Integer { .. }
+            | Self::Date { .. } => None,
+        }
+    }
+}
+
+pub(super) fn compile_output_shape(document: &OutputFieldDocument) -> CompiledOutputShape {
+    match document {
+        OutputFieldDocument::String {
+            nullable,
+            max_bytes,
+        } => CompiledOutputShape::String {
+            nullable: *nullable,
+            max_bytes: *max_bytes,
+        },
+        OutputFieldDocument::Boolean { nullable } => CompiledOutputShape::Boolean {
+            nullable: *nullable,
+        },
+        OutputFieldDocument::Integer {
+            nullable,
+            minimum,
+            maximum,
+        } => CompiledOutputShape::Integer {
+            nullable: *nullable,
+            minimum: *minimum,
+            maximum: *maximum,
+        },
+        OutputFieldDocument::Date { nullable, .. } => CompiledOutputShape::Date {
+            nullable: *nullable,
+        },
+        OutputFieldDocument::Object {
+            nullable,
+            max_bytes,
+            fields,
+        } => CompiledOutputShape::Object {
+            nullable: *nullable,
+            max_bytes: *max_bytes,
+            fields: fields
+                .iter()
+                .map(|(name, field)| CompiledOutputObjectField {
+                    name: name.as_str().into(),
+                    required: field.required,
+                    shape: compile_output_shape(&field.schema),
+                })
+                .collect(),
+        },
+        OutputFieldDocument::Array {
+            nullable,
+            max_bytes,
+            max_items,
+            items,
+        } => CompiledOutputShape::Array {
+            nullable: *nullable,
+            max_bytes: *max_bytes,
+            max_items: *max_items,
+            items: Box::new(compile_output_shape(items)),
+        },
+    }
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
diff --git a/crates/registry-relay/tests/fixtures/source-plan-v1/runtime-chain-vectors.json b/crates/registry-relay/tests/fixtures/source-plan-v1/runtime-chain-vectors.json
index 573171c981..f0a37e6f54 100644
--- a/crates/registry-relay/tests/fixtures/source-plan-v1/runtime-chain-vectors.json
+++ b/crates/registry-relay/tests/fixtures/source-plan-v1/runtime-chain-vectors.json
@@ -4,8 +4,8 @@
     {
       "completion_seed": {
         "canonical_bytes": 2333,
-        "canonical_json": "{\"acquisition\":{\"class\":\"source_projected_exact\",\"disclosure_fields\":[\"registration_status\"],\"provenance_contract\":{\"snapshot_generation\":\"absent\",\"snapshot_published_at\":\"absent\",\"source_observed_at\":null,\"source_revision\":null},\"public_outcomes\":[\"match\",\"no_match\",\"ambiguous\"],\"schema\":{\"fields\":{\"registration_status\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"}},\"type\":\"acquisition_union\"}},\"authorization_context_digest\":\"sha256:c8847466f56f3ce68c1b0ce5c1e99b2c1561a02db0df71d8efe0d1ddba88ee5d\",\"bounds\":{\"credential_exchanges\":1,\"credential_token_lifetime_ms\":1800000,\"data_destinations\":1,\"data_exchanges\":1,\"disclosed_records\":1,\"max_in_flight\":8,\"public_response_bytes\":32768,\"quota_burst\":5,\"quota_rate_per_minute\":30,\"source_bytes\":81920,\"source_matches\":2,\"timeout_ms\":4000},\"correlation\":{\"notary_evaluation_id\":\"01ARZ3NDEKTSV4RRFFQ69G5FAV\"},\"credential\":{\"generation\":7,\"reference\":\"people-api-reader\"},\"destinations\":{\"credential_destination_id\":\"registry-oauth-private\",\"data_destination_id\":\"registry-data-private\",\"verification_destination_id\":null},\"dispatch\":{\"permit_bindings\":[{\"kind\":\"credential\",\"ordinal\":0},{\"kind\":\"data\",\"ordinal\":0}],\"plan_kind\":\"bounded_http\"},\"execution_plan_digest\":\"sha256:7da3056c22626550bfaf5c7117ee2f4ecf6ea0352c1cc61d8c63d28f7cd417f6\",\"integration_pack\":{\"hash\":\"sha256:c7c73a312a5759bd1ce898a9dd944b10f313821c3b680698cf5c13927d3d2ba9\",\"id\":\"synthetic.person-status\",\"version\":\"1\"},\"policy\":{\"consent\":{\"contract_hash\":null,\"decision\":\"not_required\",\"required\":false,\"verifier_id\":null},\"hash\":\"sha256:14e9d33685eb8edb70fe8a334ad7263e493f2a56d9986cbbeecd7e67aa73d764\",\"id\":\"relay.synthetic.person-status.exact\",\"legal_basis_id\":\"public_task\",\"obligations_digest\":\"sha256:e348b8325589cd381ed10b7ae06034fbc66c7eac928f5b5b191982ab6d1a229b\"},\"private_binding_hash\":\"sha256:6cb60e5dbc45346db21feff0a53a6360c2eb8da67a79dbf2167bca919e00bf92\",\"profile\":{\"contract_hash\":\"sha256:2e0e051c6dc611f89ac837f9f25262c7d6677e677c759bbb43a4065942806cc7\",\"id\":\"synthetic.person-status.exact\",\"version\":\"1\"},\"purpose\":\"benefit-verification\",\"request_digest\":\"sha256:8357345a0044af6826e48f6d943fcf5e8ce5fdf164ebf4e5a846a4d931ae4c94\",\"schema\":\"registry.relay.consultation-completion-seed/v1\",\"workload\":{\"id\":\"registry-notary\",\"registry_id\":\"people-primary\",\"tenant_id\":\"synthetic-government\"}}",
-        "expected_digest": "sha256:ae73e8ee50b7f7b77234530efa6a4b84686edf15432ee889fc24e0944453c584",
+        "canonical_json": "{\"acquisition\":{\"class\":\"source_projected_exact\",\"disclosure_fields\":[\"registration_status\"],\"provenance_contract\":{\"snapshot_generation\":\"absent\",\"snapshot_published_at\":\"absent\",\"source_observed_at\":null,\"source_revision\":null},\"public_outcomes\":[\"match\",\"no_match\",\"ambiguous\"],\"schema\":{\"fields\":{\"registration_status\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"}},\"type\":\"acquisition_union\"}},\"authorization_context_digest\":\"sha256:c8847466f56f3ce68c1b0ce5c1e99b2c1561a02db0df71d8efe0d1ddba88ee5d\",\"bounds\":{\"credential_exchanges\":1,\"credential_token_lifetime_ms\":1800000,\"data_destinations\":1,\"data_exchanges\":1,\"disclosed_records\":1,\"max_in_flight\":8,\"public_response_bytes\":32768,\"quota_burst\":5,\"quota_rate_per_minute\":30,\"source_bytes\":81920,\"source_matches\":2,\"timeout_ms\":4000},\"correlation\":{\"notary_evaluation_id\":\"01ARZ3NDEKTSV4RRFFQ69G5FAV\"},\"credential\":{\"generation\":7,\"reference\":\"people-api-reader\"},\"destinations\":{\"credential_destination_id\":\"registry-oauth-private\",\"data_destination_id\":\"registry-data-private\",\"verification_destination_id\":null},\"dispatch\":{\"permit_bindings\":[{\"kind\":\"credential\",\"ordinal\":0},{\"kind\":\"data\",\"ordinal\":0}],\"plan_kind\":\"bounded_http\"},\"execution_plan_digest\":\"sha256:21417a20f5b9d998096eac8798f2bfca41e115e259d663e30b755b007c6934e9\",\"integration_pack\":{\"hash\":\"sha256:c7c73a312a5759bd1ce898a9dd944b10f313821c3b680698cf5c13927d3d2ba9\",\"id\":\"synthetic.person-status\",\"version\":\"1\"},\"policy\":{\"consent\":{\"contract_hash\":null,\"decision\":\"not_required\",\"required\":false,\"verifier_id\":null},\"hash\":\"sha256:14e9d33685eb8edb70fe8a334ad7263e493f2a56d9986cbbeecd7e67aa73d764\",\"id\":\"relay.synthetic.person-status.exact\",\"legal_basis_id\":\"public_task\",\"obligations_digest\":\"sha256:e348b8325589cd381ed10b7ae06034fbc66c7eac928f5b5b191982ab6d1a229b\"},\"private_binding_hash\":\"sha256:6cb60e5dbc45346db21feff0a53a6360c2eb8da67a79dbf2167bca919e00bf92\",\"profile\":{\"contract_hash\":\"sha256:2e0e051c6dc611f89ac837f9f25262c7d6677e677c759bbb43a4065942806cc7\",\"id\":\"synthetic.person-status.exact\",\"version\":\"1\"},\"purpose\":\"benefit-verification\",\"request_digest\":\"sha256:0dd5650b971d77b83bb2ffba0489709e0a07c10391616fb10a91d041b36aa82d\",\"schema\":\"registry.relay.consultation-completion-seed/v1\",\"workload\":{\"id\":\"registry-notary\",\"registry_id\":\"people-primary\",\"tenant_id\":\"synthetic-government\"}}",
+        "expected_digest": "sha256:fa6fd74315d37ab0e109c94a31b22520f994dc0097adfc97b20becad0d5c19fd",
         "value": {
           "acquisition": {
             "class": "source_projected_exact",
@@ -74,7 +74,7 @@
             ],
             "plan_kind": "bounded_http"
           },
-          "execution_plan_digest": "sha256:7da3056c22626550bfaf5c7117ee2f4ecf6ea0352c1cc61d8c63d28f7cd417f6",
+          "execution_plan_digest": "sha256:21417a20f5b9d998096eac8798f2bfca41e115e259d663e30b755b007c6934e9",
           "integration_pack": {
             "hash": "sha256:c7c73a312a5759bd1ce898a9dd944b10f313821c3b680698cf5c13927d3d2ba9",
             "id": "synthetic.person-status",
@@ -99,7 +99,7 @@
             "version": "1"
           },
           "purpose": "benefit-verification",
-          "request_digest": "sha256:8357345a0044af6826e48f6d943fcf5e8ce5fdf164ebf4e5a846a4d931ae4c94",
+          "request_digest": "sha256:0dd5650b971d77b83bb2ffba0489709e0a07c10391616fb10a91d041b36aa82d",
           "schema": "registry.relay.consultation-completion-seed/v1",
           "workload": {
             "id": "registry-notary",
@@ -209,14 +209,14 @@
           }
         },
         "authorized_request": {
-          "canonical_json": "{\"authorization_context_digest\":\"sha256:c8847466f56f3ce68c1b0ce5c1e99b2c1561a02db0df71d8efe0d1ddba88ee5d\",\"commitment_key_id\":\"synthetic-epoch-1\",\"contract_hash\":\"sha256:2e0e051c6dc611f89ac837f9f25262c7d6677e677c759bbb43a4065942806cc7\",\"execution_plan_digest\":\"sha256:7da3056c22626550bfaf5c7117ee2f4ecf6ea0352c1cc61d8c63d28f7cd417f6\",\"input_commitment\":\"hmac-sha256:94fdcac3363101ec6edee8a6234f9e7b42ff37c5d9a13eaa005e69b482d1d45b\",\"profile_id\":\"synthetic.person-status.exact\",\"profile_version\":\"1\",\"route\":\"/v1/consultations/{profile_id}/execute\",\"selector_provenance\":{\"type\":\"workload_selected\"},\"subject_handle\":\"hmac-sha256:d28c2c40577cbb3bffc5de4fcc9f4b1c4c30389043a1f6a8300677ddab3dfd10\"}",
+          "canonical_json": "{\"authorization_context_digest\":\"sha256:c8847466f56f3ce68c1b0ce5c1e99b2c1561a02db0df71d8efe0d1ddba88ee5d\",\"commitment_key_id\":\"synthetic-epoch-1\",\"contract_hash\":\"sha256:2e0e051c6dc611f89ac837f9f25262c7d6677e677c759bbb43a4065942806cc7\",\"execution_plan_digest\":\"sha256:21417a20f5b9d998096eac8798f2bfca41e115e259d663e30b755b007c6934e9\",\"input_commitment\":\"hmac-sha256:94fdcac3363101ec6edee8a6234f9e7b42ff37c5d9a13eaa005e69b482d1d45b\",\"profile_id\":\"synthetic.person-status.exact\",\"profile_version\":\"1\",\"route\":\"/v1/consultations/{profile_id}/execute\",\"selector_provenance\":{\"type\":\"workload_selected\"},\"subject_handle\":\"hmac-sha256:d28c2c40577cbb3bffc5de4fcc9f4b1c4c30389043a1f6a8300677ddab3dfd10\"}",
           "domain_label": "registry.relay.authorized-consultation.v1",
-          "expected": "sha256:8357345a0044af6826e48f6d943fcf5e8ce5fdf164ebf4e5a846a4d931ae4c94",
+          "expected": "sha256:0dd5650b971d77b83bb2ffba0489709e0a07c10391616fb10a91d041b36aa82d",
           "value": {
             "authorization_context_digest": "sha256:c8847466f56f3ce68c1b0ce5c1e99b2c1561a02db0df71d8efe0d1ddba88ee5d",
             "commitment_key_id": "synthetic-epoch-1",
             "contract_hash": "sha256:2e0e051c6dc611f89ac837f9f25262c7d6677e677c759bbb43a4065942806cc7",
-            "execution_plan_digest": "sha256:7da3056c22626550bfaf5c7117ee2f4ecf6ea0352c1cc61d8c63d28f7cd417f6",
+            "execution_plan_digest": "sha256:21417a20f5b9d998096eac8798f2bfca41e115e259d663e30b755b007c6934e9",
             "input_commitment": "hmac-sha256:94fdcac3363101ec6edee8a6234f9e7b42ff37c5d9a13eaa005e69b482d1d45b",
             "profile_id": "synthetic.person-status.exact",
             "profile_version": "1",
@@ -228,9 +228,9 @@
           }
         },
         "execution_plan": {
-          "canonical_json": "{\"acquisition_class\":\"source_projected_exact\",\"backend_kind\":\"bounded_http\",\"binding_hash\":\"sha256:6cb60e5dbc45346db21feff0a53a6360c2eb8da67a79dbf2167bca919e00bf92\",\"dispatch_budget_ms\":4000,\"integration_pack_hash\":\"sha256:c7c73a312a5759bd1ce898a9dd944b10f313821c3b680698cf5c13927d3d2ba9\",\"max_credential_exchanges\":1,\"max_data_destinations\":1,\"max_data_exchanges\":1,\"max_disclosed_records\":1,\"max_source_bytes\":81920,\"max_source_matches\":2,\"output_fields\":[\"registration_status\"],\"physical_projection_digest\":\"sha256:550f3f915fc0396e5f1dc807ea8435d03db787d1d17f23fbef0eab0289bacb36\",\"predicate_commitment\":\"hmac-sha256:b6c309615de7edb920ecace07e823e0d5b866db040302e64a1298e082d81b30b\",\"source_operation\":\"person.status\",\"timeout_ms\":4000,\"worst_case_acquisition_schema\":{\"fields\":{\"registration_status\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"}},\"type\":\"acquisition_union\"}}",
+          "canonical_json": "{\"acquisition_class\":\"source_projected_exact\",\"backend_kind\":\"bounded_http\",\"binding_hash\":\"sha256:6cb60e5dbc45346db21feff0a53a6360c2eb8da67a79dbf2167bca919e00bf92\",\"dispatch_budget_ms\":4000,\"integration_pack_hash\":\"sha256:c7c73a312a5759bd1ce898a9dd944b10f313821c3b680698cf5c13927d3d2ba9\",\"max_credential_exchanges\":1,\"max_data_destinations\":1,\"max_data_exchanges\":1,\"max_disclosed_records\":1,\"max_source_bytes\":81920,\"max_source_matches\":2,\"output_fields\":[\"registration_status\"],\"physical_projection_digest\":\"sha256:f7242b9e8ccfd506829614bd5d8a53d9289dd506670607c412bed1daa1365afd\",\"predicate_commitment\":\"hmac-sha256:b6c309615de7edb920ecace07e823e0d5b866db040302e64a1298e082d81b30b\",\"source_operation\":\"person.status\",\"timeout_ms\":4000,\"worst_case_acquisition_schema\":{\"fields\":{\"registration_status\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"}},\"type\":\"acquisition_union\"}}",
           "domain_label": "registry.relay.consultation-execution-plan.v1",
-          "expected": "sha256:7da3056c22626550bfaf5c7117ee2f4ecf6ea0352c1cc61d8c63d28f7cd417f6",
+          "expected": "sha256:21417a20f5b9d998096eac8798f2bfca41e115e259d663e30b755b007c6934e9",
           "value": {
             "acquisition_class": "source_projected_exact",
             "backend_kind": "bounded_http",
@@ -246,7 +246,7 @@
             "output_fields": [
               "registration_status"
             ],
-            "physical_projection_digest": "sha256:550f3f915fc0396e5f1dc807ea8435d03db787d1d17f23fbef0eab0289bacb36",
+            "physical_projection_digest": "sha256:f7242b9e8ccfd506829614bd5d8a53d9289dd506670607c412bed1daa1365afd",
             "predicate_commitment": "hmac-sha256:b6c309615de7edb920ecace07e823e0d5b866db040302e64a1298e082d81b30b",
             "source_operation": "person.status",
             "timeout_ms": 4000,
@@ -267,8 +267,8 @@
     {
       "completion_seed": {
         "canonical_bytes": 2618,
-        "canonical_json": "{\"acquisition\":{\"class\":\"bounded_full_record\",\"disclosure_fields\":[\"status_0\",\"status_1\",\"status_2\",\"status_3\",\"status_4\"],\"provenance_contract\":{\"snapshot_generation\":\"absent\",\"snapshot_published_at\":\"absent\",\"source_observed_at\":null,\"source_revision\":null},\"public_outcomes\":[\"match\",\"no_match\",\"ambiguous\"],\"schema\":{\"fields\":{\"status_0\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_1\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_2\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_3\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_4\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"}},\"type\":\"acquisition_union\"}},\"authorization_context_digest\":\"sha256:c8847466f56f3ce68c1b0ce5c1e99b2c1561a02db0df71d8efe0d1ddba88ee5d\",\"bounds\":{\"credential_exchanges\":1,\"credential_token_lifetime_ms\":1800000,\"data_destinations\":1,\"data_exchanges\":2,\"disclosed_records\":1,\"max_in_flight\":8,\"public_response_bytes\":32768,\"quota_burst\":5,\"quota_rate_per_minute\":30,\"source_bytes\":81920,\"source_matches\":2,\"timeout_ms\":4000},\"correlation\":{\"notary_evaluation_id\":\"01ARZ3NDEKTSV4RRFFQ69G5FAV\"},\"credential\":{\"generation\":7,\"reference\":\"people-api-reader\"},\"destinations\":{\"credential_destination_id\":\"registry-oauth-private\",\"data_destination_id\":\"registry-data-private\",\"verification_destination_id\":null},\"dispatch\":{\"permit_bindings\":[{\"kind\":\"credential\",\"ordinal\":0},{\"kind\":\"data\",\"ordinal\":0},{\"kind\":\"data\",\"ordinal\":1}],\"plan_kind\":\"script\"},\"execution_plan_digest\":\"sha256:6e62fad22baf62f09463437dd0df8a17deb3cd4be46d36c2407359636f8a5358\",\"integration_pack\":{\"hash\":\"sha256:c17ef829615fb106e335ca8f06399d97b861dd4e18f450e1f9ce17120402060d\",\"id\":\"synthetic.person-status\",\"version\":\"1\"},\"policy\":{\"consent\":{\"contract_hash\":null,\"decision\":\"not_required\",\"required\":false,\"verifier_id\":null},\"hash\":\"sha256:14e9d33685eb8edb70fe8a334ad7263e493f2a56d9986cbbeecd7e67aa73d764\",\"id\":\"relay.synthetic.person-status.exact\",\"legal_basis_id\":\"public_task\",\"obligations_digest\":\"sha256:e348b8325589cd381ed10b7ae06034fbc66c7eac928f5b5b191982ab6d1a229b\"},\"private_binding_hash\":\"sha256:3b5f6a55715ec4d61b8fef90ee5ba5b3b0b972b3df25195c6fd3b8e0110faf06\",\"profile\":{\"contract_hash\":\"sha256:230dc1a30df81433a508a5df738e48ac9e4070b9e29d72b6ecaa068769003ea1\",\"id\":\"synthetic.person-status.exact\",\"version\":\"1\"},\"purpose\":\"benefit-verification\",\"request_digest\":\"sha256:9fa8f32b74a624a7e607780bd9872a61d94be57bef9620a8970c5461340d0a43\",\"schema\":\"registry.relay.consultation-completion-seed/v1\",\"workload\":{\"id\":\"registry-notary\",\"registry_id\":\"people-primary\",\"tenant_id\":\"synthetic-government\"}}",
-        "expected_digest": "sha256:5d51947245fc746e3f20fc3bf705f85fedf5ab7e520db20c936775e91145dfc7",
+        "canonical_json": "{\"acquisition\":{\"class\":\"bounded_full_record\",\"disclosure_fields\":[\"status_0\",\"status_1\",\"status_2\",\"status_3\",\"status_4\"],\"provenance_contract\":{\"snapshot_generation\":\"absent\",\"snapshot_published_at\":\"absent\",\"source_observed_at\":null,\"source_revision\":null},\"public_outcomes\":[\"match\",\"no_match\",\"ambiguous\"],\"schema\":{\"fields\":{\"status_0\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_1\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_2\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_3\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_4\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"}},\"type\":\"acquisition_union\"}},\"authorization_context_digest\":\"sha256:c8847466f56f3ce68c1b0ce5c1e99b2c1561a02db0df71d8efe0d1ddba88ee5d\",\"bounds\":{\"credential_exchanges\":1,\"credential_token_lifetime_ms\":1800000,\"data_destinations\":1,\"data_exchanges\":2,\"disclosed_records\":1,\"max_in_flight\":8,\"public_response_bytes\":32768,\"quota_burst\":5,\"quota_rate_per_minute\":30,\"source_bytes\":81920,\"source_matches\":2,\"timeout_ms\":4000},\"correlation\":{\"notary_evaluation_id\":\"01ARZ3NDEKTSV4RRFFQ69G5FAV\"},\"credential\":{\"generation\":7,\"reference\":\"people-api-reader\"},\"destinations\":{\"credential_destination_id\":\"registry-oauth-private\",\"data_destination_id\":\"registry-data-private\",\"verification_destination_id\":null},\"dispatch\":{\"permit_bindings\":[{\"kind\":\"credential\",\"ordinal\":0},{\"kind\":\"data\",\"ordinal\":0},{\"kind\":\"data\",\"ordinal\":1}],\"plan_kind\":\"script\"},\"execution_plan_digest\":\"sha256:2009b5fc743d3574031ca4a97bddeaea15f8c126e6b98923ff64c79472679b4c\",\"integration_pack\":{\"hash\":\"sha256:c17ef829615fb106e335ca8f06399d97b861dd4e18f450e1f9ce17120402060d\",\"id\":\"synthetic.person-status\",\"version\":\"1\"},\"policy\":{\"consent\":{\"contract_hash\":null,\"decision\":\"not_required\",\"required\":false,\"verifier_id\":null},\"hash\":\"sha256:14e9d33685eb8edb70fe8a334ad7263e493f2a56d9986cbbeecd7e67aa73d764\",\"id\":\"relay.synthetic.person-status.exact\",\"legal_basis_id\":\"public_task\",\"obligations_digest\":\"sha256:e348b8325589cd381ed10b7ae06034fbc66c7eac928f5b5b191982ab6d1a229b\"},\"private_binding_hash\":\"sha256:3b5f6a55715ec4d61b8fef90ee5ba5b3b0b972b3df25195c6fd3b8e0110faf06\",\"profile\":{\"contract_hash\":\"sha256:230dc1a30df81433a508a5df738e48ac9e4070b9e29d72b6ecaa068769003ea1\",\"id\":\"synthetic.person-status.exact\",\"version\":\"1\"},\"purpose\":\"benefit-verification\",\"request_digest\":\"sha256:d8713c9778bf9198badbaafe3589c7233fd4b2cc443cd4e8c9f9e73017d81bdd\",\"schema\":\"registry.relay.consultation-completion-seed/v1\",\"workload\":{\"id\":\"registry-notary\",\"registry_id\":\"people-primary\",\"tenant_id\":\"synthetic-government\"}}",
+        "expected_digest": "sha256:0d8fa1300d1d07d05e8574084df541fe58ccb626e0e8c10bed4fe1429d3d6118",
         "value": {
           "acquisition": {
             "class": "bounded_full_record",
@@ -365,7 +365,7 @@
             ],
             "plan_kind": "script"
           },
-          "execution_plan_digest": "sha256:6e62fad22baf62f09463437dd0df8a17deb3cd4be46d36c2407359636f8a5358",
+          "execution_plan_digest": "sha256:2009b5fc743d3574031ca4a97bddeaea15f8c126e6b98923ff64c79472679b4c",
           "integration_pack": {
             "hash": "sha256:c17ef829615fb106e335ca8f06399d97b861dd4e18f450e1f9ce17120402060d",
             "id": "synthetic.person-status",
@@ -390,7 +390,7 @@
             "version": "1"
           },
           "purpose": "benefit-verification",
-          "request_digest": "sha256:9fa8f32b74a624a7e607780bd9872a61d94be57bef9620a8970c5461340d0a43",
+          "request_digest": "sha256:d8713c9778bf9198badbaafe3589c7233fd4b2cc443cd4e8c9f9e73017d81bdd",
           "schema": "registry.relay.consultation-completion-seed/v1",
           "workload": {
             "id": "registry-notary",
@@ -500,14 +500,14 @@
           }
         },
         "authorized_request": {
-          "canonical_json": "{\"authorization_context_digest\":\"sha256:c8847466f56f3ce68c1b0ce5c1e99b2c1561a02db0df71d8efe0d1ddba88ee5d\",\"commitment_key_id\":\"synthetic-epoch-1\",\"contract_hash\":\"sha256:230dc1a30df81433a508a5df738e48ac9e4070b9e29d72b6ecaa068769003ea1\",\"execution_plan_digest\":\"sha256:6e62fad22baf62f09463437dd0df8a17deb3cd4be46d36c2407359636f8a5358\",\"input_commitment\":\"hmac-sha256:94fdcac3363101ec6edee8a6234f9e7b42ff37c5d9a13eaa005e69b482d1d45b\",\"profile_id\":\"synthetic.person-status.exact\",\"profile_version\":\"1\",\"route\":\"/v1/consultations/{profile_id}/execute\",\"selector_provenance\":{\"type\":\"workload_selected\"},\"subject_handle\":\"hmac-sha256:d28c2c40577cbb3bffc5de4fcc9f4b1c4c30389043a1f6a8300677ddab3dfd10\"}",
+          "canonical_json": "{\"authorization_context_digest\":\"sha256:c8847466f56f3ce68c1b0ce5c1e99b2c1561a02db0df71d8efe0d1ddba88ee5d\",\"commitment_key_id\":\"synthetic-epoch-1\",\"contract_hash\":\"sha256:230dc1a30df81433a508a5df738e48ac9e4070b9e29d72b6ecaa068769003ea1\",\"execution_plan_digest\":\"sha256:2009b5fc743d3574031ca4a97bddeaea15f8c126e6b98923ff64c79472679b4c\",\"input_commitment\":\"hmac-sha256:94fdcac3363101ec6edee8a6234f9e7b42ff37c5d9a13eaa005e69b482d1d45b\",\"profile_id\":\"synthetic.person-status.exact\",\"profile_version\":\"1\",\"route\":\"/v1/consultations/{profile_id}/execute\",\"selector_provenance\":{\"type\":\"workload_selected\"},\"subject_handle\":\"hmac-sha256:d28c2c40577cbb3bffc5de4fcc9f4b1c4c30389043a1f6a8300677ddab3dfd10\"}",
           "domain_label": "registry.relay.authorized-consultation.v1",
-          "expected": "sha256:9fa8f32b74a624a7e607780bd9872a61d94be57bef9620a8970c5461340d0a43",
+          "expected": "sha256:d8713c9778bf9198badbaafe3589c7233fd4b2cc443cd4e8c9f9e73017d81bdd",
           "value": {
             "authorization_context_digest": "sha256:c8847466f56f3ce68c1b0ce5c1e99b2c1561a02db0df71d8efe0d1ddba88ee5d",
             "commitment_key_id": "synthetic-epoch-1",
             "contract_hash": "sha256:230dc1a30df81433a508a5df738e48ac9e4070b9e29d72b6ecaa068769003ea1",
-            "execution_plan_digest": "sha256:6e62fad22baf62f09463437dd0df8a17deb3cd4be46d36c2407359636f8a5358",
+            "execution_plan_digest": "sha256:2009b5fc743d3574031ca4a97bddeaea15f8c126e6b98923ff64c79472679b4c",
             "input_commitment": "hmac-sha256:94fdcac3363101ec6edee8a6234f9e7b42ff37c5d9a13eaa005e69b482d1d45b",
             "profile_id": "synthetic.person-status.exact",
             "profile_version": "1",
@@ -519,9 +519,9 @@
           }
         },
         "execution_plan": {
-          "canonical_json": "{\"acquisition_class\":\"bounded_full_record\",\"backend_kind\":\"script\",\"binding_hash\":\"sha256:3b5f6a55715ec4d61b8fef90ee5ba5b3b0b972b3df25195c6fd3b8e0110faf06\",\"dispatch_budget_ms\":4000,\"integration_pack_hash\":\"sha256:c17ef829615fb106e335ca8f06399d97b861dd4e18f450e1f9ce17120402060d\",\"max_credential_exchanges\":1,\"max_data_destinations\":1,\"max_data_exchanges\":2,\"max_disclosed_records\":1,\"max_source_bytes\":81920,\"max_source_matches\":2,\"output_fields\":[\"status_0\",\"status_1\",\"status_2\",\"status_3\",\"status_4\"],\"physical_projection_digest\":\"sha256:fb6366892e6750e6efb9816f839b167af1aca64c10817d853745665291f1008d\",\"predicate_commitment\":\"hmac-sha256:4c131732c4cc18ba239a3d185936caf48095450a6bc22a46bb725934e98c8dc6\",\"source_operation\":\"person.status\",\"timeout_ms\":4000,\"worst_case_acquisition_schema\":{\"fields\":{\"status_0\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_1\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_2\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_3\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_4\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"}},\"type\":\"acquisition_union\"}}",
+          "canonical_json": "{\"acquisition_class\":\"bounded_full_record\",\"backend_kind\":\"script\",\"binding_hash\":\"sha256:3b5f6a55715ec4d61b8fef90ee5ba5b3b0b972b3df25195c6fd3b8e0110faf06\",\"dispatch_budget_ms\":4000,\"integration_pack_hash\":\"sha256:c17ef829615fb106e335ca8f06399d97b861dd4e18f450e1f9ce17120402060d\",\"max_credential_exchanges\":1,\"max_data_destinations\":1,\"max_data_exchanges\":2,\"max_disclosed_records\":1,\"max_source_bytes\":81920,\"max_source_matches\":2,\"output_fields\":[\"status_0\",\"status_1\",\"status_2\",\"status_3\",\"status_4\"],\"physical_projection_digest\":\"sha256:6ad249272f62fb264435c7a582ed8ce6ace3ebaf0a69b16a8a897fd213c782ba\",\"predicate_commitment\":\"hmac-sha256:4c131732c4cc18ba239a3d185936caf48095450a6bc22a46bb725934e98c8dc6\",\"source_operation\":\"person.status\",\"timeout_ms\":4000,\"worst_case_acquisition_schema\":{\"fields\":{\"status_0\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_1\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_2\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_3\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"},\"status_4\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"}},\"type\":\"acquisition_union\"}}",
           "domain_label": "registry.relay.consultation-execution-plan.v1",
-          "expected": "sha256:6e62fad22baf62f09463437dd0df8a17deb3cd4be46d36c2407359636f8a5358",
+          "expected": "sha256:2009b5fc743d3574031ca4a97bddeaea15f8c126e6b98923ff64c79472679b4c",
           "value": {
             "acquisition_class": "bounded_full_record",
             "backend_kind": "script",
@@ -541,7 +541,7 @@
               "status_3",
               "status_4"
             ],
-            "physical_projection_digest": "sha256:fb6366892e6750e6efb9816f839b167af1aca64c10817d853745665291f1008d",
+            "physical_projection_digest": "sha256:6ad249272f62fb264435c7a582ed8ce6ace3ebaf0a69b16a8a897fd213c782ba",
             "predicate_commitment": "hmac-sha256:4c131732c4cc18ba239a3d185936caf48095450a6bc22a46bb725934e98c8dc6",
             "source_operation": "person.status",
             "timeout_ms": 4000,
@@ -582,8 +582,8 @@
     {
       "completion_seed": {
         "canonical_bytes": 2414,
-        "canonical_json": "{\"acquisition\":{\"class\":\"source_projected_exact\",\"disclosure_fields\":[\"registration_status\"],\"provenance_contract\":{\"snapshot_generation\":\"absent\",\"snapshot_published_at\":\"absent\",\"source_observed_at\":null,\"source_revision\":null},\"public_outcomes\":[\"match\",\"no_match\",\"ambiguous\"],\"schema\":{\"fields\":{\"registration_status\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"}},\"type\":\"acquisition_union\"}},\"authorization_context_digest\":\"sha256:a21199772f539f9ae4adfe00d08b4fb6b5c35f861b86ed6a46c9fae72ca4a681\",\"bounds\":{\"credential_exchanges\":1,\"credential_token_lifetime_ms\":1800000,\"data_destinations\":1,\"data_exchanges\":1,\"disclosed_records\":1,\"max_in_flight\":8,\"public_response_bytes\":32768,\"quota_burst\":5,\"quota_rate_per_minute\":30,\"source_bytes\":81920,\"source_matches\":2,\"timeout_ms\":4000},\"correlation\":{\"notary_evaluation_id\":\"01ARZ3NDEKTSV4RRFFQ69G5FAV\"},\"credential\":{\"generation\":7,\"reference\":\"people-api-reader\"},\"destinations\":{\"credential_destination_id\":\"registry-oauth-private\",\"data_destination_id\":\"registry-data-private\",\"verification_destination_id\":null},\"dispatch\":{\"permit_bindings\":[{\"kind\":\"credential\",\"ordinal\":0},{\"kind\":\"data\",\"ordinal\":0}],\"plan_kind\":\"bounded_http\"},\"execution_plan_digest\":\"sha256:7da3056c22626550bfaf5c7117ee2f4ecf6ea0352c1cc61d8c63d28f7cd417f6\",\"integration_pack\":{\"hash\":\"sha256:c7c73a312a5759bd1ce898a9dd944b10f313821c3b680698cf5c13927d3d2ba9\",\"id\":\"synthetic.person-status\",\"version\":\"1\"},\"policy\":{\"consent\":{\"contract_hash\":\"sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\",\"decision\":\"verified\",\"required\":true,\"verifier_id\":\"registry.consent.v1\"},\"hash\":\"sha256:29701482d7ce14f370a0da895adb44da28ddc5cb4ca765f50b463db5301f1fcb\",\"id\":\"relay.synthetic.person-status.exact\",\"legal_basis_id\":\"public_task\",\"obligations_digest\":\"sha256:e348b8325589cd381ed10b7ae06034fbc66c7eac928f5b5b191982ab6d1a229b\"},\"private_binding_hash\":\"sha256:6cb60e5dbc45346db21feff0a53a6360c2eb8da67a79dbf2167bca919e00bf92\",\"profile\":{\"contract_hash\":\"sha256:6d9283f325261f9e8ebf2f3663d1756ee7674ccd5024afa4d1d43f0de5df816e\",\"id\":\"synthetic.person-status.exact\",\"version\":\"1\"},\"purpose\":\"benefit-verification\",\"request_digest\":\"sha256:857354ce2b58d60619e060a8d8f0a243c33d629598922430de48f7849217e18e\",\"schema\":\"registry.relay.consultation-completion-seed/v1\",\"workload\":{\"id\":\"registry-notary\",\"registry_id\":\"people-primary\",\"tenant_id\":\"synthetic-government\"}}",
-        "expected_digest": "sha256:cbf3dc9e74dc79f88a7b330c194e0e1048a70413b2758691eec430942d5e95a0",
+        "canonical_json": "{\"acquisition\":{\"class\":\"source_projected_exact\",\"disclosure_fields\":[\"registration_status\"],\"provenance_contract\":{\"snapshot_generation\":\"absent\",\"snapshot_published_at\":\"absent\",\"source_observed_at\":null,\"source_revision\":null},\"public_outcomes\":[\"match\",\"no_match\",\"ambiguous\"],\"schema\":{\"fields\":{\"registration_status\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"}},\"type\":\"acquisition_union\"}},\"authorization_context_digest\":\"sha256:a21199772f539f9ae4adfe00d08b4fb6b5c35f861b86ed6a46c9fae72ca4a681\",\"bounds\":{\"credential_exchanges\":1,\"credential_token_lifetime_ms\":1800000,\"data_destinations\":1,\"data_exchanges\":1,\"disclosed_records\":1,\"max_in_flight\":8,\"public_response_bytes\":32768,\"quota_burst\":5,\"quota_rate_per_minute\":30,\"source_bytes\":81920,\"source_matches\":2,\"timeout_ms\":4000},\"correlation\":{\"notary_evaluation_id\":\"01ARZ3NDEKTSV4RRFFQ69G5FAV\"},\"credential\":{\"generation\":7,\"reference\":\"people-api-reader\"},\"destinations\":{\"credential_destination_id\":\"registry-oauth-private\",\"data_destination_id\":\"registry-data-private\",\"verification_destination_id\":null},\"dispatch\":{\"permit_bindings\":[{\"kind\":\"credential\",\"ordinal\":0},{\"kind\":\"data\",\"ordinal\":0}],\"plan_kind\":\"bounded_http\"},\"execution_plan_digest\":\"sha256:21417a20f5b9d998096eac8798f2bfca41e115e259d663e30b755b007c6934e9\",\"integration_pack\":{\"hash\":\"sha256:c7c73a312a5759bd1ce898a9dd944b10f313821c3b680698cf5c13927d3d2ba9\",\"id\":\"synthetic.person-status\",\"version\":\"1\"},\"policy\":{\"consent\":{\"contract_hash\":\"sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\",\"decision\":\"verified\",\"required\":true,\"verifier_id\":\"registry.consent.v1\"},\"hash\":\"sha256:29701482d7ce14f370a0da895adb44da28ddc5cb4ca765f50b463db5301f1fcb\",\"id\":\"relay.synthetic.person-status.exact\",\"legal_basis_id\":\"public_task\",\"obligations_digest\":\"sha256:e348b8325589cd381ed10b7ae06034fbc66c7eac928f5b5b191982ab6d1a229b\"},\"private_binding_hash\":\"sha256:6cb60e5dbc45346db21feff0a53a6360c2eb8da67a79dbf2167bca919e00bf92\",\"profile\":{\"contract_hash\":\"sha256:6d9283f325261f9e8ebf2f3663d1756ee7674ccd5024afa4d1d43f0de5df816e\",\"id\":\"synthetic.person-status.exact\",\"version\":\"1\"},\"purpose\":\"benefit-verification\",\"request_digest\":\"sha256:bc75f337d9b304088a176529338b94a3c8b967388887fc9091bcf81f35b75644\",\"schema\":\"registry.relay.consultation-completion-seed/v1\",\"workload\":{\"id\":\"registry-notary\",\"registry_id\":\"people-primary\",\"tenant_id\":\"synthetic-government\"}}",
+        "expected_digest": "sha256:deb7ab9c0abf2cad3fa52e22c40bb9c1d81d051d5e1f3da5bbb94c0cf2a8bd5e",
         "value": {
           "acquisition": {
             "class": "source_projected_exact",
@@ -652,7 +652,7 @@
             ],
             "plan_kind": "bounded_http"
           },
-          "execution_plan_digest": "sha256:7da3056c22626550bfaf5c7117ee2f4ecf6ea0352c1cc61d8c63d28f7cd417f6",
+          "execution_plan_digest": "sha256:21417a20f5b9d998096eac8798f2bfca41e115e259d663e30b755b007c6934e9",
           "integration_pack": {
             "hash": "sha256:c7c73a312a5759bd1ce898a9dd944b10f313821c3b680698cf5c13927d3d2ba9",
             "id": "synthetic.person-status",
@@ -677,7 +677,7 @@
             "version": "1"
           },
           "purpose": "benefit-verification",
-          "request_digest": "sha256:857354ce2b58d60619e060a8d8f0a243c33d629598922430de48f7849217e18e",
+          "request_digest": "sha256:bc75f337d9b304088a176529338b94a3c8b967388887fc9091bcf81f35b75644",
           "schema": "registry.relay.consultation-completion-seed/v1",
           "workload": {
             "id": "registry-notary",
@@ -795,14 +795,14 @@
           }
         },
         "authorized_request": {
-          "canonical_json": "{\"authorization_context_digest\":\"sha256:a21199772f539f9ae4adfe00d08b4fb6b5c35f861b86ed6a46c9fae72ca4a681\",\"commitment_key_id\":\"synthetic-epoch-1\",\"contract_hash\":\"sha256:6d9283f325261f9e8ebf2f3663d1756ee7674ccd5024afa4d1d43f0de5df816e\",\"execution_plan_digest\":\"sha256:7da3056c22626550bfaf5c7117ee2f4ecf6ea0352c1cc61d8c63d28f7cd417f6\",\"input_commitment\":\"hmac-sha256:94fdcac3363101ec6edee8a6234f9e7b42ff37c5d9a13eaa005e69b482d1d45b\",\"profile_id\":\"synthetic.person-status.exact\",\"profile_version\":\"1\",\"route\":\"/v1/consultations/{profile_id}/execute\",\"selector_provenance\":{\"type\":\"workload_selected\"},\"subject_handle\":\"hmac-sha256:d28c2c40577cbb3bffc5de4fcc9f4b1c4c30389043a1f6a8300677ddab3dfd10\"}",
+          "canonical_json": "{\"authorization_context_digest\":\"sha256:a21199772f539f9ae4adfe00d08b4fb6b5c35f861b86ed6a46c9fae72ca4a681\",\"commitment_key_id\":\"synthetic-epoch-1\",\"contract_hash\":\"sha256:6d9283f325261f9e8ebf2f3663d1756ee7674ccd5024afa4d1d43f0de5df816e\",\"execution_plan_digest\":\"sha256:21417a20f5b9d998096eac8798f2bfca41e115e259d663e30b755b007c6934e9\",\"input_commitment\":\"hmac-sha256:94fdcac3363101ec6edee8a6234f9e7b42ff37c5d9a13eaa005e69b482d1d45b\",\"profile_id\":\"synthetic.person-status.exact\",\"profile_version\":\"1\",\"route\":\"/v1/consultations/{profile_id}/execute\",\"selector_provenance\":{\"type\":\"workload_selected\"},\"subject_handle\":\"hmac-sha256:d28c2c40577cbb3bffc5de4fcc9f4b1c4c30389043a1f6a8300677ddab3dfd10\"}",
           "domain_label": "registry.relay.authorized-consultation.v1",
-          "expected": "sha256:857354ce2b58d60619e060a8d8f0a243c33d629598922430de48f7849217e18e",
+          "expected": "sha256:bc75f337d9b304088a176529338b94a3c8b967388887fc9091bcf81f35b75644",
           "value": {
             "authorization_context_digest": "sha256:a21199772f539f9ae4adfe00d08b4fb6b5c35f861b86ed6a46c9fae72ca4a681",
             "commitment_key_id": "synthetic-epoch-1",
             "contract_hash": "sha256:6d9283f325261f9e8ebf2f3663d1756ee7674ccd5024afa4d1d43f0de5df816e",
-            "execution_plan_digest": "sha256:7da3056c22626550bfaf5c7117ee2f4ecf6ea0352c1cc61d8c63d28f7cd417f6",
+            "execution_plan_digest": "sha256:21417a20f5b9d998096eac8798f2bfca41e115e259d663e30b755b007c6934e9",
             "input_commitment": "hmac-sha256:94fdcac3363101ec6edee8a6234f9e7b42ff37c5d9a13eaa005e69b482d1d45b",
             "profile_id": "synthetic.person-status.exact",
             "profile_version": "1",
@@ -814,9 +814,9 @@
           }
         },
         "execution_plan": {
-          "canonical_json": "{\"acquisition_class\":\"source_projected_exact\",\"backend_kind\":\"bounded_http\",\"binding_hash\":\"sha256:6cb60e5dbc45346db21feff0a53a6360c2eb8da67a79dbf2167bca919e00bf92\",\"dispatch_budget_ms\":4000,\"integration_pack_hash\":\"sha256:c7c73a312a5759bd1ce898a9dd944b10f313821c3b680698cf5c13927d3d2ba9\",\"max_credential_exchanges\":1,\"max_data_destinations\":1,\"max_data_exchanges\":1,\"max_disclosed_records\":1,\"max_source_bytes\":81920,\"max_source_matches\":2,\"output_fields\":[\"registration_status\"],\"physical_projection_digest\":\"sha256:550f3f915fc0396e5f1dc807ea8435d03db787d1d17f23fbef0eab0289bacb36\",\"predicate_commitment\":\"hmac-sha256:b6c309615de7edb920ecace07e823e0d5b866db040302e64a1298e082d81b30b\",\"source_operation\":\"person.status\",\"timeout_ms\":4000,\"worst_case_acquisition_schema\":{\"fields\":{\"registration_status\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"}},\"type\":\"acquisition_union\"}}",
+          "canonical_json": "{\"acquisition_class\":\"source_projected_exact\",\"backend_kind\":\"bounded_http\",\"binding_hash\":\"sha256:6cb60e5dbc45346db21feff0a53a6360c2eb8da67a79dbf2167bca919e00bf92\",\"dispatch_budget_ms\":4000,\"integration_pack_hash\":\"sha256:c7c73a312a5759bd1ce898a9dd944b10f313821c3b680698cf5c13927d3d2ba9\",\"max_credential_exchanges\":1,\"max_data_destinations\":1,\"max_data_exchanges\":1,\"max_disclosed_records\":1,\"max_source_bytes\":81920,\"max_source_matches\":2,\"output_fields\":[\"registration_status\"],\"physical_projection_digest\":\"sha256:f7242b9e8ccfd506829614bd5d8a53d9289dd506670607c412bed1daa1365afd\",\"predicate_commitment\":\"hmac-sha256:b6c309615de7edb920ecace07e823e0d5b866db040302e64a1298e082d81b30b\",\"source_operation\":\"person.status\",\"timeout_ms\":4000,\"worst_case_acquisition_schema\":{\"fields\":{\"registration_status\":{\"max_bytes\":64,\"nullable\":false,\"type\":\"string\"}},\"type\":\"acquisition_union\"}}",
           "domain_label": "registry.relay.consultation-execution-plan.v1",
-          "expected": "sha256:7da3056c22626550bfaf5c7117ee2f4ecf6ea0352c1cc61d8c63d28f7cd417f6",
+          "expected": "sha256:21417a20f5b9d998096eac8798f2bfca41e115e259d663e30b755b007c6934e9",
           "value": {
             "acquisition_class": "source_projected_exact",
             "backend_kind": "bounded_http",
@@ -832,7 +832,7 @@
             "output_fields": [
               "registration_status"
             ],
-            "physical_projection_digest": "sha256:550f3f915fc0396e5f1dc807ea8435d03db787d1d17f23fbef0eab0289bacb36",
+            "physical_projection_digest": "sha256:f7242b9e8ccfd506829614bd5d8a53d9289dd506670607c412bed1daa1365afd",
             "predicate_commitment": "hmac-sha256:b6c309615de7edb920ecace07e823e0d5b866db040302e64a1298e082d81b30b",
             "source_operation": "person.status",
             "timeout_ms": 4000,
diff --git a/crates/registry-relay/tests/fixtures/source-plan-v1/snapshot-exact-compiler-vectors.json b/crates/registry-relay/tests/fixtures/source-plan-v1/snapshot-exact-compiler-vectors.json
index 07b6370005..a929d9a4c6 100644
--- a/crates/registry-relay/tests/fixtures/source-plan-v1/snapshot-exact-compiler-vectors.json
+++ b/crates/registry-relay/tests/fixtures/source-plan-v1/snapshot-exact-compiler-vectors.json
@@ -24,10 +24,17 @@
     "digest": "sha256:9cdbdafd868f1fb7bd80402ee557e48e1de1b41115861efbdd234182798493ac"
   },
   "physical_projection": {
-    "domain": "registry.relay.consultation-physical-projection.v1",
+    "domain": "registry.relay.consultation-physical-projection.v2",
     "preimage": {
-      "schema": "registry.relay.consultation-physical-projection.v1",
+      "schema": "registry.relay.consultation-physical-projection.v2",
       "plan_kind": "snapshot_exact",
+      "output_schema": {
+        "registration_status": {
+          "type": "string",
+          "nullable": false,
+          "max_bytes": 64
+        }
+      },
       "operations": [],
       "snapshot_projection": {
         "keys": [
@@ -48,6 +55,6 @@
         "source_revision": null
       }
     },
-    "digest": "sha256:13de89ae8797bc227cbcff73df485e70e4527fe9a039cf9951571097166dccc3"
+    "digest": "sha256:cc89050872c847ba3dbc82d96ef2f3d95c1fa1cd681003dfda185b3aaae1a345"
   }
 }
diff --git a/crates/registry-relay/tests/rhai_worker_cold_start.rs b/crates/registry-relay/tests/rhai_worker_cold_start.rs
index 66832829ad..caa9bd2b7a 100644
--- a/crates/registry-relay/tests/rhai_worker_cold_start.rs
+++ b/crates/registry-relay/tests/rhai_worker_cold_start.rs
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use registry_relay::rhai_worker::{
-    OutputSchema, OutputType, TypedValue, WorkerLimits, WorkerOutcome, WorkerOutput, WorkerProcess,
+    OutputSchema, TypedValue, WorkerLimits, WorkerOutcome, WorkerOutput, WorkerProcess,
     WorkerRequest,
 };
 
@@ -18,13 +18,7 @@ async fn first_product_worker_invocation_keeps_cold_start_outside_script_budget(
     );
     request.output_schema.insert(
         "active".to_owned(),
-        OutputSchema {
-            output_type: OutputType::Boolean,
-            nullable: false,
-            max_bytes: None,
-            minimum: None,
-            maximum: None,
-        },
+        OutputSchema::Boolean { nullable: false },
     );
     let output = worker
         .evaluate(&request)
diff --git a/crates/registry-relay/tests/rhai_worker_process.rs b/crates/registry-relay/tests/rhai_worker_process.rs
index 2e02251f23..2b30109403 100644
--- a/crates/registry-relay/tests/rhai_worker_process.rs
+++ b/crates/registry-relay/tests/rhai_worker_process.rs
@@ -7,9 +7,9 @@ use std::{
 
 use async_trait::async_trait;
 use registry_relay::rhai_worker::{
-    HostFailure, OutputSchema, OutputType, ScriptFailure, SourceCall, SourceHost, SourceResponse,
-    TypedValue, WorkerError, WorkerLimits, WorkerOutcome, WorkerOutput, WorkerProcess,
-    WorkerRequest,
+    HostFailure, OutputObjectField, OutputSchema, ScriptFailure, SourceCall, SourceHost,
+    SourceResponse, TypedValue, WorkerError, WorkerLimits, WorkerOutcome, WorkerOutput,
+    WorkerProcess, WorkerRequest,
 };
 use serde_json::json;
 
@@ -25,13 +25,7 @@ fn request(script: impl Into<String>) -> WorkerRequest {
     let mut request = WorkerRequest::v1(script, "consult", limits);
     request.output_schema.insert(
         "active".to_string(),
-        OutputSchema {
-            output_type: OutputType::Boolean,
-            nullable: false,
-            max_bytes: None,
-            minimum: None,
-            maximum: None,
-        },
+        OutputSchema::Boolean { nullable: false },
     );
     request
 }
@@ -73,6 +67,83 @@ fn matched(output: WorkerOutput) -> BTreeMap<String, TypedValue> {
     }
 }
 
+fn required(schema: OutputSchema) -> OutputObjectField {
+    OutputObjectField {
+        required: true,
+        schema: Box::new(schema),
+    }
+}
+
+fn opencrvs_output_request(script: &str) -> WorkerRequest {
+    let mut request = WorkerRequest::v1(script, "consult", WorkerLimits::default());
+    let name = OutputSchema::Object {
+        nullable: false,
+        max_bytes: 512,
+        fields: BTreeMap::from([
+            (
+                "family".to_owned(),
+                required(OutputSchema::String {
+                    nullable: false,
+                    max_bytes: 128,
+                }),
+            ),
+            (
+                "given".to_owned(),
+                required(OutputSchema::String {
+                    nullable: false,
+                    max_bytes: 128,
+                }),
+            ),
+        ]),
+    };
+    request.output_schema.insert(
+        "registration".to_owned(),
+        OutputSchema::Object {
+            nullable: false,
+            max_bytes: 1_024,
+            fields: BTreeMap::from([
+                (
+                    "registration_number".to_owned(),
+                    required(OutputSchema::String {
+                        nullable: false,
+                        max_bytes: 64,
+                    }),
+                ),
+                (
+                    "status".to_owned(),
+                    required(OutputSchema::String {
+                        nullable: false,
+                        max_bytes: 32,
+                    }),
+                ),
+            ]),
+        },
+    );
+    request.output_schema.insert(
+        "parents".to_owned(),
+        OutputSchema::Array {
+            nullable: false,
+            max_bytes: 4_096,
+            max_items: 2,
+            items: Box::new(OutputSchema::Object {
+                nullable: false,
+                max_bytes: 1_024,
+                fields: BTreeMap::from([
+                    ("name".to_owned(), required(name)),
+                    (
+                        "relationship".to_owned(),
+                        required(OutputSchema::String {
+                            nullable: false,
+                            max_bytes: 32,
+                        }),
+                    ),
+                ]),
+            }),
+        },
+    );
+    request
+}
+
 #[tokio::test]
 async fn fresh_workers_return_the_same_closed_result() {
     let worker = relay_worker();
@@ -86,6 +157,244 @@ async fn fresh_workers_return_the_same_closed_result() {
     );
 }
 
+#[tokio::test]
+async fn worker_preserves_opencrvs_object_and_parents_array_outputs() {
+    let request = opencrvs_output_request(
+        r#"
+        fn consult(ctx) {
+            result.match(#{
+                registration: #{
+                    registration_number: "2026-000042",
+                    status: "registered"
+                },
+                parents: [
+                    #{
+                        relationship: "mother",
+                        name: #{ given: "Ada", family: "Lovelace" }
+                    },
+                    #{
+                        relationship: "father",
+                        name: #{ given: "William", family: "King" }
+                    }
+                ]
+            })
+        }
+        "#,
+    );
+
+    let output = matched(
+        relay_worker()
+            .evaluate(&request)
+            .await
+            .expect("structured worker output"),
+    );
+    assert_eq!(
+        output.get("registration"),
+        Some(&TypedValue::Object {
+            value: Some(json!({
+                "registration_number": "2026-000042",
+                "status": "registered"
+            }))
+        })
+    );
+    assert_eq!(
+        output.get("parents"),
+        Some(&TypedValue::Array {
+            value: Some(json!([
+                {
+                    "name": {"family": "Lovelace", "given": "Ada"},
+                    "relationship": "mother"
+                },
+                {
+                    "name": {"family": "King", "given": "William"},
+                    "relationship": "father"
+                }
+            ]))
+        })
+    );
+    let debug = format!("{:?}", output.get("parents").expect("parents output"));
+    assert!(debug.contains("[REDACTED]"));
+    assert!(!debug.contains("Lovelace"));
+}
+
+#[tokio::test]
+async fn worker_rejects_structured_output_type_extra_key_and_value_bounds() {
+    let worker = relay_worker();
+    for script in [
+        r#"fn consult(ctx) {
+            result.match(#{
+                registration: #{
+                    registration_number: "2026-000042",
+                    status: "registered",
+                    undeclared: true
+                },
+                parents: []
+            })
+        }"#,
+        r#"fn consult(ctx) {
+            result.match(#{
+                registration: #{
+                    registration_number: 42,
+                    status: "registered"
+                },
+                parents: []
+            })
+        }"#,
+        r#"fn consult(ctx) {
+            result.match(#{
+                registration: #{
+                    registration_number: "2026-000042",
+                    status: "registered"
+                },
+                parents: [
+                    #{ relationship: "mother", name: #{ given: "A", family: "B" } },
+                    #{ relationship: "father", name: #{ given: "C", family: "D" } },
+                    #{ relationship: "guardian", name: #{ given: "E", family: "F" } }
+                ]
+            })
+        }"#,
+    ] {
+        assert_eq!(
+            worker.evaluate(&opencrvs_output_request(script)).await,
+            Err(WorkerError::ContractViolation)
+        );
+    }
+
+    let mut serialized_bound = opencrvs_output_request(
+        r#"fn consult(ctx) {
+            result.match(#{
+                registration: #{
+                    registration_number: "2026-000042",
+                    status: "registered"
+                },
+                parents: []
+            })
+        }"#,
+    );
+    let OutputSchema::Object { max_bytes, .. } = serialized_bound
+        .output_schema
+        .get_mut("registration")
+        .expect("registration schema")
+    else {
+        panic!("registration object schema");
+    };
+    *max_bytes = 16;
+    assert_eq!(
+        worker.evaluate(&serialized_bound).await,
+        Err(WorkerError::ContractViolation)
+    );
+}
+
+#[tokio::test]
+async fn worker_rejects_output_schema_depth_field_and_array_bounds() {
+    let worker = relay_worker();
+    let script = "fn consult(ctx) { result.match(#{ value: #{} }) }";
+
+    let mut too_deep = WorkerRequest::v1(script, "consult", WorkerLimits::default());
+    let mut schema = OutputSchema::Boolean { nullable: false };
+    for depth in (0..8).rev() {
+        schema = OutputSchema::Object {
+            nullable: false,
+            max_bytes: 1_024,
+            fields: BTreeMap::from([(format!("level_{depth}"), required(schema))]),
+        };
+    }
+    too_deep.output_schema.insert("value".to_owned(), schema);
+    assert_eq!(
+        worker.evaluate(&too_deep).await,
+        Err(WorkerError::ContractViolation)
+    );
+
+    let mut too_many_fields = WorkerRequest::v1(script, "consult", WorkerLimits::default());
+    too_many_fields.output_schema.insert(
+        "value".to_owned(),
+        OutputSchema::Object {
+            nullable: false,
+            max_bytes: 4_096,
+            fields: (0..33)
+                .map(|index| {
+                    (
+                        format!("field_{index}"),
+                        required(OutputSchema::Boolean { nullable: false }),
+                    )
+                })
+                .collect(),
+        },
+    );
+    assert_eq!(
+        worker.evaluate(&too_many_fields).await,
+        Err(WorkerError::ContractViolation)
+    );
+
+    let mut too_many_items = WorkerRequest::v1(script, "consult", WorkerLimits::default());
+    too_many_items.output_schema.insert(
+        "value".to_owned(),
+        OutputSchema::Array {
+            nullable: false,
+            max_bytes: 4_096,
+            max_items: 257,
+            items: Box::new(OutputSchema::Boolean { nullable: false }),
+        },
+    );
+    assert_eq!(
+        worker.evaluate(&too_many_items).await,
+        Err(WorkerError::ContractViolation)
+    );
+
+    let mut too_expanded = WorkerRequest::v1(script, "consult", WorkerLimits::default());
+    too_expanded.output_schema.insert(
+        "value".to_owned(),
+        OutputSchema::Array {
+            nullable: false,
+            max_bytes: 65_536,
+            max_items: 256,
+            items: Box::new(OutputSchema::Array {
+                nullable: false,
+                max_bytes: 65_536,
+                max_items: 256,
+                items: Box::new(OutputSchema::Boolean { nullable: false }),
+            }),
+        },
+    );
+    assert_eq!(
+        worker.evaluate(&too_expanded).await,
+        Err(WorkerError::ContractViolation)
+    );
+
+    let child_fields = (0..8)
+        .map(|index| {
+            (
+                format!("child_{index}"),
+                required(OutputSchema::Boolean { nullable: false }),
+            )
+        })
+        .collect::<BTreeMap<_, _>>();
+    let mut too_many_nodes = WorkerRequest::v1(script, "consult", WorkerLimits::default());
+    too_many_nodes.output_schema.insert(
+        "value".to_owned(),
+        OutputSchema::Object {
+            nullable: false,
+            max_bytes: 65_536,
+            fields: (0..32)
+                .map(|index| {
+                    (
+                        format!("field_{index}"),
+                        required(OutputSchema::Object {
+                            nullable: false,
+                            max_bytes: 4_096,
+                            fields: child_fields.clone(),
+                        }),
+                    )
+                })
+                .collect(),
+        },
+    );
+    assert_eq!(
+        worker.evaluate(&too_many_nodes).await,
+        Err(WorkerError::ContractViolation)
+    );
+}
+
 #[tokio::test]
 async fn one_worker_interactively_orchestrates_multiple_bounded_source_calls() {
     let script = r#"
@@ -268,12 +577,9 @@ async fn process_denies_instruction_depth_output_call_and_wall_time_overruns() {
     );
     output.output_schema.insert(
         "payload".to_string(),
-        OutputSchema {
-            output_type: OutputType::String,
+        OutputSchema::String {
             nullable: false,
-            max_bytes: Some(512),
-            minimum: None,
-            maximum: None,
+            max_bytes: 512,
         },
     );
     output.limits.max_output_bytes = 256;
diff --git a/crates/registryctl/schemas/project-authoring/documentation-intent.json b/crates/registryctl/schemas/project-authoring/documentation-intent.json
index c75fcb29b8..7797d1c1a7 100644
--- a/crates/registryctl/schemas/project-authoring/documentation-intent.json
+++ b/crates/registryctl/schemas/project-authoring/documentation-intent.json
@@ -139,6 +139,7 @@
     { "schema": "environment", "pointer": "/$defs/relayResource/anyOf/0", "path_kind": "branch" },
     { "schema": "environment", "pointer": "/$defs/relayResource/anyOf/1", "path_kind": "branch" },
     { "schema": "environment", "pointer": "/$defs/oid4vci/properties/allowed_wallet_origins/items", "path_kind": "array_item" },
+    { "schema": "environment", "pointer": "/$defs/oid4vci/properties/registrar_clients/items", "path_kind": "array_item" },
     { "schema": "environment", "pointer": "/$defs/privateCidrs/items", "path_kind": "array_item" },
     { "schema": "environment", "pointer": "/$defs/credential/oneOf/0", "path_kind": "branch" },
     { "schema": "environment", "pointer": "/$defs/credential/oneOf/1", "path_kind": "branch" },
@@ -160,6 +161,14 @@
     { "schema": "integration", "pointer": "/properties/outputs/oneOf/0/additionalProperties", "path_kind": "map_value" },
     { "schema": "integration", "pointer": "/properties/outputs/oneOf/1", "path_kind": "branch" },
     { "schema": "integration", "pointer": "/properties/outputs/oneOf/1/items", "path_kind": "array_item" },
+    { "schema": "integration", "pointer": "/$defs/output/oneOf/0", "path_kind": "branch" },
+    { "schema": "integration", "pointer": "/$defs/output/oneOf/1", "path_kind": "branch" },
+    { "schema": "integration", "pointer": "/$defs/output/oneOf/2", "path_kind": "branch" },
+    { "schema": "integration", "pointer": "/$defs/outputSchema/oneOf/0", "path_kind": "branch" },
+    { "schema": "integration", "pointer": "/$defs/outputSchema/oneOf/1", "path_kind": "branch" },
+    { "schema": "integration", "pointer": "/$defs/outputSchema/oneOf/2", "path_kind": "branch" },
+    { "schema": "integration", "pointer": "/$defs/outputObject/properties/fields/propertyNames", "path_kind": "map_key" },
+    { "schema": "integration", "pointer": "/$defs/outputObject/properties/fields/additionalProperties", "path_kind": "map_value" },
     { "schema": "integration", "pointer": "/$defs/integrationResponseByteSize/oneOf/0", "path_kind": "branch" },
     { "schema": "integration", "pointer": "/$defs/integrationResponseByteSize/oneOf/1", "path_kind": "branch" },
     { "schema": "integration", "pointer": "/$defs/integrationRequestByteSize/oneOf/0", "path_kind": "branch" },
@@ -1390,29 +1399,94 @@
     },
     {
       "schema": "integration",
-      "pointer": "/$defs/output/properties/format",
+      "pointer": "/$defs/scalarOutput/properties/format",
       "purpose": "Applies the full-date semantic format to a string-valued integration output."
     },
     {
       "schema": "integration",
-      "pointer": "/$defs/output/properties/maxLength",
+      "pointer": "/$defs/scalarOutput/properties/maxLength",
       "purpose": "Caps the character length produced for a string-valued integration output."
     },
     {
       "schema": "integration",
-      "pointer": "/$defs/output/properties/minimum",
+      "pointer": "/$defs/scalarOutput/properties/minimum",
       "purpose": "Sets the inclusive lower bound produced for an integer-valued integration output."
     },
     {
       "schema": "integration",
-      "pointer": "/$defs/output/properties/maximum",
+      "pointer": "/$defs/scalarOutput/properties/maximum",
       "purpose": "Sets the inclusive upper bound produced for an integer-valued integration output."
     },
     {
       "schema": "integration",
-      "pointer": "/$defs/output/properties/x-registry-source",
+      "pointer": "/$defs/scalarOutput/properties/x-registry-source",
       "purpose": "Selects the canonical source-response location from which the HTTP output is extracted."
     },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/scalarOutputSchema/properties/format",
+      "purpose": "Applies the full-date semantic format to a string-valued field inside a structured integration output."
+    },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/scalarOutputSchema/properties/maxLength",
+      "purpose": "Caps the character length produced for a string-valued field inside a structured integration output."
+    },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/scalarOutputSchema/properties/minimum",
+      "purpose": "Sets the inclusive lower bound produced for an integer-valued field inside a structured integration output."
+    },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/scalarOutputSchema/properties/maximum",
+      "purpose": "Sets the inclusive upper bound produced for an integer-valued field inside a structured integration output."
+    },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/outputObjectField/properties/required",
+      "purpose": "Declares whether a named field must be present in every released structured output object."
+    },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/outputObject/properties/type",
+      "purpose": "Selects the closed object form for a structured integration output."
+    },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/outputObject/properties/nullable",
+      "purpose": "Declares whether the complete structured output object may be null."
+    },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/outputObject/properties/max_bytes",
+      "purpose": "Caps the canonical serialized size of one structured output object."
+    },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/outputObject/properties/fields",
+      "purpose": "Declares the bounded closed map of fields released in one structured output object."
+    },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/outputArray/properties/type",
+      "purpose": "Selects the array form for a structured integration output."
+    },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/outputArray/properties/nullable",
+      "purpose": "Declares whether the complete structured output array may be null."
+    },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/outputArray/properties/max_bytes",
+      "purpose": "Caps the canonical serialized size of one structured output array."
+    },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/outputArray/properties/max_items",
+      "purpose": "Caps the number of values released in one structured output array."
+    },
     {
       "schema": "integration",
       "pointer": "/$defs/limits/properties/calls",
diff --git a/crates/registryctl/schemas/project-authoring/dto-shape-contract.v1.json b/crates/registryctl/schemas/project-authoring/dto-shape-contract.v1.json
index 7868b9824d..357f38fca4 100644
--- a/crates/registryctl/schemas/project-authoring/dto-shape-contract.v1.json
+++ b/crates/registryctl/schemas/project-authoring/dto-shape-contract.v1.json
@@ -209,6 +209,8 @@
               "integer",
               "string",
               "date",
+              "object",
+              "array",
               "presence"
             ],
             "type": "string"
@@ -1877,6 +1879,14 @@
               "redirect_uri": {
                 "type": "string"
               },
+              "registrar_clients": {
+                "default": [],
+                "description": "Machine OIDC clients admitted to create registrar-initiated offers.\n\nThese clients use the pinned authorization server and the Notary public\nbase URL as their resource audience. They are deliberately separate\nfrom the citizen client so generated subject-access classification\nremains closed.",
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
               "sensitive_state_key": {
                 "$ref": "#/$defs/SecretReference"
               },
@@ -2794,7 +2804,169 @@
             ],
             "type": "object"
           },
+          "AuthoredOutputArrayDeclaration": {
+            "additionalProperties": false,
+            "properties": {
+              "items": {
+                "$ref": "#/$defs/AuthoredOutputSchema"
+              },
+              "max_bytes": {
+                "format": "uint32",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "max_items": {
+                "format": "uint16",
+                "maximum": 65535,
+                "minimum": 0,
+                "type": "integer"
+              },
+              "nullable": {
+                "type": "boolean"
+              },
+              "type": {
+                "$ref": "#/$defs/AuthoredOutputArrayType"
+              }
+            },
+            "required": [
+              "type",
+              "nullable",
+              "max_bytes",
+              "max_items",
+              "items"
+            ],
+            "type": "object"
+          },
+          "AuthoredOutputArrayType": {
+            "enum": [
+              "array"
+            ],
+            "type": "string"
+          },
           "AuthoredOutputDeclaration": {
+            "anyOf": [
+              {
+                "$ref": "#/$defs/AuthoredScalarOutputDeclaration"
+              },
+              {
+                "$ref": "#/$defs/AuthoredOutputObjectDeclaration"
+              },
+              {
+                "$ref": "#/$defs/AuthoredOutputArrayDeclaration"
+              }
+            ]
+          },
+          "AuthoredOutputObjectDeclaration": {
+            "additionalProperties": false,
+            "properties": {
+              "fields": {
+                "additionalProperties": {
+                  "$ref": "#/$defs/AuthoredOutputObjectField"
+                },
+                "type": "object"
+              },
+              "max_bytes": {
+                "format": "uint32",
+                "minimum": 0,
+                "type": "integer"
+              },
+              "nullable": {
+                "type": "boolean"
+              },
+              "type": {
+                "$ref": "#/$defs/AuthoredOutputObjectType"
+              }
+            },
+            "required": [
+              "type",
+              "nullable",
+              "max_bytes",
+              "fields"
+            ],
+            "type": "object"
+          },
+          "AuthoredOutputObjectField": {
+            "additionalProperties": false,
+            "properties": {
+              "required": {
+                "type": "boolean"
+              },
+              "schema": {
+                "$ref": "#/$defs/AuthoredOutputSchema"
+              }
+            },
+            "required": [
+              "required",
+              "schema"
+            ],
+            "type": "object"
+          },
+          "AuthoredOutputObjectType": {
+            "enum": [
+              "object"
+            ],
+            "type": "string"
+          },
+          "AuthoredOutputSchema": {
+            "anyOf": [
+              {
+                "$ref": "#/$defs/AuthoredScalarOutputSchema"
+              },
+              {
+                "$ref": "#/$defs/AuthoredOutputObjectDeclaration"
+              },
+              {
+                "$ref": "#/$defs/AuthoredOutputArrayDeclaration"
+              }
+            ]
+          },
+          "AuthoredOutputsDeclaration": {
+            "anyOf": [
+              {
+                "additionalProperties": {
+                  "$ref": "#/$defs/AuthoredOutputDeclaration"
+                },
+                "type": "object"
+              },
+              {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ]
+          },
+          "AuthoredProtocolDeclaration": {
+            "additionalProperties": false,
+            "properties": {
+              "signed_dci": {
+                "anyOf": [
+                  {
+                    "$ref": "#/$defs/AuthoredSignedDciDeclaration"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null
+              }
+            },
+            "type": "object"
+          },
+          "AuthoredRequestSemantics": {
+            "enum": [
+              "read_only"
+            ],
+            "type": "string"
+          },
+          "AuthoredResponseFormat": {
+            "enum": [
+              "json",
+              "text"
+            ],
+            "type": "string"
+          },
+          "AuthoredScalarOutputDeclaration": {
             "additionalProperties": false,
             "properties": {
               "format": {
@@ -2849,51 +3021,53 @@
             ],
             "type": "object"
           },
-          "AuthoredOutputsDeclaration": {
-            "anyOf": [
-              {
-                "additionalProperties": {
-                  "$ref": "#/$defs/AuthoredOutputDeclaration"
-                },
-                "type": "object"
-              },
-              {
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              }
-            ]
-          },
-          "AuthoredProtocolDeclaration": {
+          "AuthoredScalarOutputSchema": {
             "additionalProperties": false,
             "properties": {
-              "signed_dci": {
+              "format": {
                 "anyOf": [
                   {
-                    "$ref": "#/$defs/AuthoredSignedDciDeclaration"
+                    "$ref": "#/$defs/AuthoredStringFormat"
                   },
                   {
                     "type": "null"
                   }
                 ],
                 "default": null
+              },
+              "maxLength": {
+                "default": null,
+                "format": "uint32",
+                "minimum": 0,
+                "type": [
+                  "integer",
+                  "null"
+                ]
+              },
+              "maximum": {
+                "default": null,
+                "format": "int64",
+                "type": [
+                  "integer",
+                  "null"
+                ]
+              },
+              "minimum": {
+                "default": null,
+                "format": "int64",
+                "type": [
+                  "integer",
+                  "null"
+                ]
+              },
+              "type": {
+                "$ref": "#/$defs/AuthoredSchemaType"
               }
             },
-            "type": "object"
-          },
-          "AuthoredRequestSemantics": {
-            "enum": [
-              "read_only"
-            ],
-            "type": "string"
-          },
-          "AuthoredResponseFormat": {
-            "enum": [
-              "json",
-              "text"
+            "required": [
+              "type"
             ],
-            "type": "string"
+            "type": "object"
           },
           "AuthoredScalarType": {
             "enum": [
diff --git a/crates/registryctl/schemas/project-authoring/environment.schema.json b/crates/registryctl/schemas/project-authoring/environment.schema.json
index f04c70b986..d41dd31ddf 100644
--- a/crates/registryctl/schemas/project-authoring/environment.schema.json
+++ b/crates/registryctl/schemas/project-authoring/environment.schema.json
@@ -218,6 +218,12 @@
             "signing_kid": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/token2048" }
           }
         },
+        "registrar_clients": {
+          "x-registry-field": "sensitive_property",
+          "description": "Closed OIDC machine-client allow-list for registrar-created credential offers. Each client uses this authorization server and the Notary public base URL as its resource audience; citizen client classification remains separate.",
+          "type": "array", "maxItems": 64, "uniqueItems": true, "default": [],
+          "items": {"x-registry-field": "sensitive_array_item", "$ref": "#/$defs/token256" }
+        },
         "access_token": {
           "x-registry-field": "property",
           "description": "Dedicated Notary access-token signing key and published key identifier.",
diff --git a/crates/registryctl/schemas/project-authoring/integration.schema.json b/crates/registryctl/schemas/project-authoring/integration.schema.json
index 9bb2ad05ea..b557bcf757 100644
--- a/crates/registryctl/schemas/project-authoring/integration.schema.json
+++ b/crates/registryctl/schemas/project-authoring/integration.schema.json
@@ -65,7 +65,24 @@
         "script": { "file": "adapter.rhai" }
       },
       "outputs": {
-        "active": { "type": "boolean" }
+        "active": { "type": "boolean" },
+        "parents": {
+          "type": "array",
+          "nullable": false,
+          "max_bytes": 4096,
+          "max_items": 2,
+          "items": {
+            "type": "object",
+            "nullable": false,
+            "max_bytes": 2048,
+            "fields": {
+              "name": {
+                "required": true,
+                "schema": { "type": "string", "maxLength": 160 }
+              }
+            }
+          }
+        }
       }
     }
   ],
@@ -477,7 +494,15 @@
       ]
     },
     "output": {
-      "description": "Type and optional source pointer for one normalized integration output.",
+      "description": "A bounded scalar or recursively closed structured schema for one normalized integration output.",
+      "oneOf": [
+        {"x-registry-field": "branch", "$ref": "#/$defs/scalarOutput" },
+        {"x-registry-field": "branch", "$ref": "#/$defs/outputObject" },
+        {"x-registry-field": "branch", "$ref": "#/$defs/outputArray" }
+      ]
+    },
+    "scalarOutput": {
+      "description": "Type, scalar bounds, and optional source pointer for one normalized scalar integration output.",
       "type": "object",
       "additionalProperties": false,
       "required": ["type"],
@@ -494,6 +519,69 @@
         }
       }
     },
+    "outputSchema": {
+      "description": "A recursively closed structured output schema without a source pointer.",
+      "oneOf": [
+        {"x-registry-field": "branch", "$ref": "#/$defs/scalarOutputSchema" },
+        {"x-registry-field": "branch", "$ref": "#/$defs/outputObject" },
+        {"x-registry-field": "branch", "$ref": "#/$defs/outputArray" }
+      ]
+    },
+    "scalarOutputSchema": {
+      "description": "Type and bounds for a scalar nested inside a structured output.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["type"],
+      "properties": {
+        "type": {"x-registry-field": "property", "$ref": "#/$defs/scalarType" },
+        "format": {"x-registry-field": "property", "const": "date" },
+        "maxLength": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 16384 },
+        "minimum": {"x-registry-field": "property", "type": "integer", "minimum": -9223372036854775808, "maximum": 9223372036854775807 },
+        "maximum": {"x-registry-field": "property", "type": "integer", "minimum": -9223372036854775808, "maximum": 9223372036854775807 }
+      }
+    },
+    "outputObjectField": {
+      "description": "Requiredness and recursive schema for one named field of a closed structured output object.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["required", "schema"],
+      "properties": {
+        "required": {"x-registry-field": "property", "type": "boolean" },
+        "schema": {"x-registry-field": "property", "$ref": "#/$defs/outputSchema" }
+      }
+    },
+    "outputObject": {
+      "description": "A recursively typed object output with a canonical byte ceiling and an always-closed field map.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["type", "nullable", "max_bytes", "fields"],
+      "properties": {
+        "type": {"x-registry-field": "property", "const": "object" },
+        "nullable": {"x-registry-field": "property", "type": "boolean" },
+        "max_bytes": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 65536 },
+        "fields": {
+          "x-registry-field": "property",
+          "type": "object",
+          "minProperties": 1,
+          "maxProperties": 32,
+          "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/inputName" },
+          "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/outputObjectField" }
+        }
+      }
+    },
+    "outputArray": {
+      "description": "A recursively typed array output with canonical byte and item-count ceilings.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["type", "nullable", "max_bytes", "max_items", "items"],
+      "properties": {
+        "type": {"x-registry-field": "property", "const": "array" },
+        "nullable": {"x-registry-field": "property", "type": "boolean" },
+        "max_bytes": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 65536 },
+        "max_items": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 256 },
+        "items": {"x-registry-field": "property", "$ref": "#/$defs/outputSchema" }
+      }
+    },
     "limits": {
       "description": "Per-execution call, byte, and deadline budgets.",
       "type": "object",
diff --git a/crates/registryctl/schemas/project-authoring/parity-coverage.json b/crates/registryctl/schemas/project-authoring/parity-coverage.json
index d9e3bf7625..51de54af67 100644
--- a/crates/registryctl/schemas/project-authoring/parity-coverage.json
+++ b/crates/registryctl/schemas/project-authoring/parity-coverage.json
@@ -393,6 +393,12 @@
       "kind": "typed_map",
       "rationale": "Integration output names are authored and every value uses the closed output declaration."
     },
+    {
+      "schema": "integration",
+      "pointer": "/$defs/outputObject/properties/fields",
+      "kind": "typed_map",
+      "rationale": "Structured output field names are authored and every value uses the closed requiredness and recursive schema declaration."
+    },
     {
       "schema": "integration",
       "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors",
diff --git a/crates/registryctl/src/project_authoring/authoring_contract.rs b/crates/registryctl/src/project_authoring/authoring_contract.rs
index 05d321fef8..c6321636a8 100644
--- a/crates/registryctl/src/project_authoring/authoring_contract.rs
+++ b/crates/registryctl/src/project_authoring/authoring_contract.rs
@@ -1,5 +1,20 @@
 // SPDX-License-Identifier: Apache-2.0
 
+// Generated Notary consultation outputs live under the Relay result root and
+// its closed `outputs` object. Reserve the same fixed depth and node envelope
+// here so authoring acceptance implies downstream Notary config acceptance.
+const OUTPUT_SCHEMA_ROOT_DEPTH_V1: usize = 3;
+const OUTPUT_SCHEMA_ENVELOPE_NODES_V1: usize = 20;
+const MAX_OUTPUT_SCHEMA_DEPTH_V1: usize =
+    registry_notary_core::MAX_RELAY_OUTPUT_SCHEMA_DEPTH_V1;
+const MAX_OUTPUT_SCHEMA_NODES_V1: usize =
+    registry_notary_core::MAX_RELAY_OUTPUT_SCHEMA_NODES_V1;
+const MAX_OUTPUT_EXPANDED_NODES_V1: usize =
+    registry_notary_core::MAX_RELAY_OUTPUT_EXPANDED_NODES_V1;
+// Relay parsing and Notary recursive-schema validation accept exact JSON
+// integers only through 2^53 - 1, so authoring must enforce the same boundary.
+const MAX_JSON_SAFE_INTEGER_V1: i64 = 9_007_199_254_740_991;
+
 /// The pre-1.0 project authoring contract. Runtime artifacts may still lower
 /// this concise model into product-owned structures, but authored files never
 /// expose those structures.
@@ -321,10 +336,28 @@ enum AuthoredOutputsDeclaration {
     EntityFields(Vec<String>),
 }
 
+#[cfg_attr(test, derive(schemars::JsonSchema))]
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(untagged)]
+enum AuthoredOutputDeclaration {
+    Scalar(AuthoredScalarOutputDeclaration),
+    Object(AuthoredOutputObjectDeclaration),
+    Array(AuthoredOutputArrayDeclaration),
+}
+
+#[cfg_attr(test, derive(schemars::JsonSchema))]
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(untagged)]
+enum AuthoredOutputSchema {
+    Scalar(AuthoredScalarOutputSchema),
+    Object(AuthoredOutputObjectDeclaration),
+    Array(AuthoredOutputArrayDeclaration),
+}
+
 #[cfg_attr(test, derive(schemars::JsonSchema))]
 #[derive(Debug, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
-struct AuthoredOutputDeclaration {
+struct AuthoredScalarOutputDeclaration {
     #[serde(rename = "type")]
     output_type: AuthoredSchemaType,
     #[serde(default)]
@@ -339,6 +372,67 @@ struct AuthoredOutputDeclaration {
     source: Option<String>,
 }
 
+#[cfg_attr(test, derive(schemars::JsonSchema))]
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct AuthoredScalarOutputSchema {
+    #[serde(rename = "type")]
+    output_type: AuthoredSchemaType,
+    #[serde(default)]
+    format: Option<AuthoredStringFormat>,
+    #[serde(default, rename = "maxLength")]
+    max_length: Option<u32>,
+    #[serde(default)]
+    minimum: Option<i64>,
+    #[serde(default)]
+    maximum: Option<i64>,
+}
+
+#[cfg_attr(test, derive(schemars::JsonSchema))]
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct AuthoredOutputObjectField {
+    required: bool,
+    schema: Box<AuthoredOutputSchema>,
+}
+
+#[cfg_attr(test, derive(schemars::JsonSchema))]
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct AuthoredOutputObjectDeclaration {
+    #[serde(rename = "type")]
+    output_type: AuthoredOutputObjectType,
+    nullable: bool,
+    max_bytes: u32,
+    fields: BTreeMap<String, AuthoredOutputObjectField>,
+}
+
+#[cfg_attr(test, derive(schemars::JsonSchema))]
+#[derive(Debug, Clone, Copy, Deserialize, Serialize)]
+#[serde(rename_all = "snake_case")]
+enum AuthoredOutputObjectType {
+    Object,
+}
+
+#[cfg_attr(test, derive(schemars::JsonSchema))]
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct AuthoredOutputArrayDeclaration {
+    #[serde(rename = "type")]
+    output_type: AuthoredOutputArrayType,
+    nullable: bool,
+    max_bytes: u32,
+    max_items: u16,
+    items: Box<AuthoredOutputSchema>,
+}
+
+#[cfg_attr(test, derive(schemars::JsonSchema))]
+#[derive(Debug, Clone, Copy, Deserialize, Serialize)]
+#[serde(rename_all = "snake_case")]
+enum AuthoredOutputArrayType {
+    Array,
+}
+
 #[cfg_attr(test, derive(schemars::JsonSchema))]
 #[derive(Debug, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -711,16 +805,7 @@ fn validate_authored_integration_contract(authored: &AuthoredIntegrationDocument
         bail!("canonical selector inputs exceed the fixed 4096-byte aggregate ceiling");
     }
     if let AuthoredOutputsDeclaration::Schemas(outputs) = &authored.outputs {
-        if outputs.is_empty() || outputs.len() > MAX_OUTPUTS {
-            bail!("outputs must contain between one and {MAX_OUTPUTS} fields");
-        }
-        for (name, output) in outputs {
-            validate_input_name(name).with_context(|| format!("outputs.{name}"))?;
-            if matches!(name.as_str(), "matched" | "outcome") {
-                bail!("outputs.{name} is reserved consultation vocabulary");
-            }
-            validate_authored_output(name, output)?;
-        }
+        validate_authored_outputs(outputs)?;
     }
     if let Some(source) = &authored.source {
         validate_authored_source(source)?;
@@ -800,6 +885,28 @@ fn validate_authored_integration_contract(authored: &AuthoredIntegrationDocument
     Ok(())
 }
 
+fn validate_authored_outputs(outputs: &BTreeMap<String, AuthoredOutputDeclaration>) -> Result<()> {
+    if outputs.is_empty() || outputs.len() > MAX_OUTPUTS {
+        bail!("outputs must contain between one and {MAX_OUTPUTS} fields");
+    }
+    let mut schema_nodes = OUTPUT_SCHEMA_ENVELOPE_NODES_V1;
+    let mut expanded_nodes = OUTPUT_SCHEMA_ENVELOPE_NODES_V1;
+    for (name, output) in outputs {
+        validate_input_name(name).with_context(|| format!("outputs.{name}"))?;
+        if matches!(name.as_str(), "matched" | "outcome") {
+            bail!("outputs.{name} is reserved consultation vocabulary");
+        }
+        let expanded = validate_authored_output(name, output, &mut schema_nodes)?;
+        expanded_nodes = expanded_nodes
+            .checked_add(expanded)
+            .ok_or_else(|| anyhow!("outputs recursive expansion overflows"))?;
+        if expanded_nodes > MAX_OUTPUT_EXPANDED_NODES_V1 {
+            bail!("outputs recursive expansion exceeds {MAX_OUTPUT_EXPANDED_NODES_V1} nodes");
+        }
+    }
+    Ok(())
+}
+
 fn validate_authored_source(source: &AuthoredSourceDeclaration) -> Result<()> {
     if source.versions.tested.is_empty()
         && source.versions.unverified.is_empty()
@@ -940,40 +1047,88 @@ fn validate_authored_credential_interface(interface: &CredentialInterface) -> Re
     Ok(())
 }
 
-fn validate_authored_output(name: &str, output: &AuthoredOutputDeclaration) -> Result<()> {
-    let (scalar, _) = schema_type_parts(&output.output_type)?;
+fn validate_authored_output(
+    name: &str,
+    output: &AuthoredOutputDeclaration,
+    nodes: &mut usize,
+) -> Result<usize> {
+    match output {
+        AuthoredOutputDeclaration::Scalar(output) => {
+            record_output_schema_node(name, OUTPUT_SCHEMA_ROOT_DEPTH_V1, nodes)?;
+            validate_authored_scalar_output(
+                name,
+                &output.output_type,
+                output.format,
+                output.max_length,
+                output.minimum,
+                output.maximum,
+            )?;
+            Ok(1)
+        }
+        AuthoredOutputDeclaration::Object(output) => {
+            validate_authored_output_object(
+                name,
+                &format!("outputs.{name}"),
+                output,
+                OUTPUT_SCHEMA_ROOT_DEPTH_V1,
+                nodes,
+            )
+        }
+        AuthoredOutputDeclaration::Array(output) => {
+            validate_authored_output_array(
+                name,
+                &format!("outputs.{name}"),
+                output,
+                OUTPUT_SCHEMA_ROOT_DEPTH_V1,
+                nodes,
+            )
+        }
+    }
+}
+
+fn validate_authored_scalar_output(
+    name: &str,
+    output_type: &AuthoredSchemaType,
+    format: Option<AuthoredStringFormat>,
+    max_length: Option<u32>,
+    minimum: Option<i64>,
+    maximum: Option<i64>,
+) -> Result<()> {
+    let (scalar, _) = schema_type_parts(output_type)?;
     match scalar {
         AuthoredScalarType::String => {
-            let max = output
-                .max_length
+            let max = max_length
                 .ok_or_else(|| anyhow!("outputs.{name}.maxLength is required for String"))?;
             if max == 0 || max > 16_384 {
                 bail!("outputs.{name}.maxLength is outside the v1 bounds");
             }
-            if output.minimum.is_some() || output.maximum.is_some() {
+            if minimum.is_some() || maximum.is_some() {
                 bail!("outputs.{name} String schemas cannot declare minimum or maximum");
             }
-            if output.format == Some(AuthoredStringFormat::Date) && max != 10 {
+            if format == Some(AuthoredStringFormat::Date) && max != 10 {
                 bail!("outputs.{name} date format requires maxLength: 10");
             }
         }
         AuthoredScalarType::Boolean => {
-            if output.format.is_some()
-                || output.max_length.is_some()
-                || output.minimum.is_some()
-                || output.maximum.is_some()
+            if format.is_some()
+                || max_length.is_some()
+                || minimum.is_some()
+                || maximum.is_some()
             {
                 bail!("outputs.{name} Boolean schema has incompatible constraints");
             }
         }
         AuthoredScalarType::Integer => {
-            let minimum = output
-                .minimum
+            let minimum = minimum
                 .ok_or_else(|| anyhow!("outputs.{name}.minimum is required for Integer"))?;
-            let maximum = output
-                .maximum
+            let maximum = maximum
                 .ok_or_else(|| anyhow!("outputs.{name}.maximum is required for Integer"))?;
-            if minimum > maximum || output.format.is_some() || output.max_length.is_some() {
+            if minimum > maximum
+                || minimum < -MAX_JSON_SAFE_INTEGER_V1
+                || maximum > MAX_JSON_SAFE_INTEGER_V1
+                || format.is_some()
+                || max_length.is_some()
+            {
                 bail!("outputs.{name} Integer schema has invalid constraints");
             }
         }
@@ -982,6 +1137,219 @@ fn validate_authored_output(name: &str, output: &AuthoredOutputDeclaration) -> R
     Ok(())
 }
 
+fn record_output_schema_node(name: &str, depth: usize, nodes: &mut usize) -> Result<()> {
+    *nodes = nodes
+        .checked_add(1)
+        .ok_or_else(|| anyhow!("outputs.{name} schema node count overflows"))?;
+    if depth > MAX_OUTPUT_SCHEMA_DEPTH_V1 {
+        bail!("outputs.{name} schema exceeds the maximum depth of {MAX_OUTPUT_SCHEMA_DEPTH_V1}");
+    }
+    if *nodes > MAX_OUTPUT_SCHEMA_NODES_V1 {
+        bail!("outputs schema contains more than {MAX_OUTPUT_SCHEMA_NODES_V1} nodes");
+    }
+    Ok(())
+}
+
+fn validate_authored_output_schema(
+    name: &str,
+    path: &str,
+    schema: &AuthoredOutputSchema,
+    depth: usize,
+    nodes: &mut usize,
+) -> Result<usize> {
+    match schema {
+        AuthoredOutputSchema::Scalar(schema) => {
+            record_output_schema_node(name, depth, nodes)?;
+            validate_authored_scalar_output(
+                name,
+                &schema.output_type,
+                schema.format,
+                schema.max_length,
+                schema.minimum,
+                schema.maximum,
+            )?;
+            Ok(1)
+        }
+        AuthoredOutputSchema::Object(schema) => {
+            validate_authored_output_object(name, path, schema, depth, nodes)
+        }
+        AuthoredOutputSchema::Array(schema) => {
+            validate_authored_output_array(name, path, schema, depth, nodes)
+        }
+    }
+}
+
+fn validate_authored_output_object(
+    name: &str,
+    path: &str,
+    object: &AuthoredOutputObjectDeclaration,
+    depth: usize,
+    nodes: &mut usize,
+) -> Result<usize> {
+    record_output_schema_node(name, depth, nodes)?;
+    if !(1..=registry_notary_core::MAX_RELAY_OUTPUT_VALUE_BYTES_V1)
+        .contains(&object.max_bytes)
+    {
+        bail!(
+            "{path}.max_bytes must be between 1 and {}",
+            registry_notary_core::MAX_RELAY_OUTPUT_VALUE_BYTES_V1
+        );
+    }
+    if object.fields.is_empty()
+        || object.fields.len() > registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
+    {
+        bail!(
+            "{path}.fields must contain between 1 and {} entries",
+            registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
+        );
+    }
+    let mut expanded = 1_usize;
+    for (field_name, field) in &object.fields {
+        validate_input_name(field_name)
+            .with_context(|| format!("{path}.fields.{field_name}"))?;
+        let child_path = format!("{path}.fields.{field_name}.schema");
+        let child = validate_authored_output_schema(
+            name,
+            &child_path,
+            &field.schema,
+            depth + 1,
+            nodes,
+        )?;
+        expanded = expanded
+            .checked_add(child)
+            .ok_or_else(|| anyhow!("outputs.{name} recursive expansion overflows"))?;
+    }
+    let minimum_bytes = minimum_authored_output_object_json_bytes(path, object)?;
+    if u64::from(object.max_bytes) < minimum_bytes {
+        bail!(
+            "{path}.max_bytes must be at least {minimum_bytes} to encode the smallest non-null object"
+        );
+    }
+    Ok(expanded)
+}
+
+fn validate_authored_output_array(
+    name: &str,
+    path: &str,
+    array: &AuthoredOutputArrayDeclaration,
+    depth: usize,
+    nodes: &mut usize,
+) -> Result<usize> {
+    record_output_schema_node(name, depth, nodes)?;
+    if !(1..=registry_notary_core::MAX_RELAY_OUTPUT_VALUE_BYTES_V1)
+        .contains(&array.max_bytes)
+    {
+        bail!(
+            "{path}.max_bytes must be between 1 and {}",
+            registry_notary_core::MAX_RELAY_OUTPUT_VALUE_BYTES_V1
+        );
+    }
+    if !(1..=registry_notary_core::MAX_RELAY_OUTPUT_ARRAY_ITEMS_V1).contains(&array.max_items) {
+        bail!(
+            "{path}.max_items must be between 1 and {}",
+            registry_notary_core::MAX_RELAY_OUTPUT_ARRAY_ITEMS_V1
+        );
+    }
+    let child = validate_authored_output_schema(
+        name,
+        &format!("{path}.items"),
+        &array.items,
+        depth + 1,
+        nodes,
+    )?;
+    let minimum_bytes = minimum_authored_output_array_json_bytes();
+    if u64::from(array.max_bytes) < minimum_bytes {
+        bail!(
+            "{path}.max_bytes must be at least {minimum_bytes} to encode the smallest non-null array"
+        );
+    }
+    usize::from(array.max_items)
+        .checked_mul(child)
+        .and_then(|expanded| expanded.checked_add(1))
+        .ok_or_else(|| anyhow!("outputs.{name} recursive expansion overflows"))
+}
+
+fn minimum_authored_output_schema_json_bytes(
+    path: &str,
+    schema: &AuthoredOutputSchema,
+) -> Result<u64> {
+    let (non_null_bytes, nullable) = match schema {
+        AuthoredOutputSchema::Scalar(schema) => {
+            let (scalar, nullable) = schema_type_parts(&schema.output_type)?;
+            let bytes = match (scalar, schema.format) {
+                (AuthoredScalarType::String, Some(AuthoredStringFormat::Date)) => 12,
+                (AuthoredScalarType::String, None) => 2,
+                (AuthoredScalarType::Boolean, None) => 4,
+                (AuthoredScalarType::Integer, None) => {
+                    let minimum = schema
+                        .minimum
+                        .ok_or_else(|| anyhow!("{path}.minimum is required for Integer"))?;
+                    let maximum = schema
+                        .maximum
+                        .ok_or_else(|| anyhow!("{path}.maximum is required for Integer"))?;
+                    let shortest = if minimum <= 0 && maximum >= 0 {
+                        0
+                    } else if minimum > 0 {
+                        minimum
+                    } else {
+                        maximum
+                    };
+                    u64::try_from(shortest.to_string().len())
+                        .map_err(|_| anyhow!("{path} minimum JSON size overflows"))?
+                }
+                _ => bail!("{path} has incompatible scalar constraints"),
+            };
+            (bytes, nullable)
+        }
+        AuthoredOutputSchema::Object(object) => (
+            minimum_authored_output_object_json_bytes(path, object)?,
+            object.nullable,
+        ),
+        AuthoredOutputSchema::Array(array) => {
+            (minimum_authored_output_array_json_bytes(), array.nullable)
+        }
+    };
+    Ok(if nullable {
+        non_null_bytes.min(4)
+    } else {
+        non_null_bytes
+    })
+}
+
+fn minimum_authored_output_object_json_bytes(
+    path: &str,
+    object: &AuthoredOutputObjectDeclaration,
+) -> Result<u64> {
+    let mut bytes = 2_u64;
+    let mut required_fields = 0_u64;
+    for (field_name, field) in object.fields.iter().filter(|(_, field)| field.required) {
+        if required_fields > 0 {
+            bytes = checked_minimum_json_bytes_add(path, bytes, 1)?;
+        }
+        let field_name_bytes = u64::try_from(field_name.len())
+            .map_err(|_| anyhow!("{path} minimum JSON size overflows"))?;
+        bytes = checked_minimum_json_bytes_add(path, bytes, field_name_bytes)?;
+        bytes = checked_minimum_json_bytes_add(path, bytes, 3)?;
+        let child_path = format!("{path}.fields.{field_name}.schema");
+        let child_bytes =
+            minimum_authored_output_schema_json_bytes(&child_path, &field.schema)?;
+        bytes = checked_minimum_json_bytes_add(path, bytes, child_bytes)?;
+        required_fields = required_fields
+            .checked_add(1)
+            .ok_or_else(|| anyhow!("{path} minimum JSON size overflows"))?;
+    }
+    Ok(bytes)
+}
+
+const fn minimum_authored_output_array_json_bytes() -> u64 {
+    2
+}
+
+fn checked_minimum_json_bytes_add(path: &str, left: u64, right: u64) -> Result<u64> {
+    left.checked_add(right)
+        .ok_or_else(|| anyhow!("{path} minimum JSON size overflows"))
+}
+
 struct LoweredInputSchema {
     input_type: InputType,
     nullable: bool,
@@ -1102,7 +1470,6 @@ fn lower_input_schema(
             })
         }
         AuthoredScalarType::Integer => {
-            const JSON_SAFE_INTEGER: i64 = 9_007_199_254_740_991;
             let minimum = declaration
                 .minimum
                 .ok_or_else(|| anyhow!("input.{name}.minimum is required for Integer inputs"))?;
@@ -1110,8 +1477,8 @@ fn lower_input_schema(
                 .maximum
                 .ok_or_else(|| anyhow!("input.{name}.maximum is required for Integer inputs"))?;
             if minimum > maximum
-                || minimum < -JSON_SAFE_INTEGER
-                || maximum > JSON_SAFE_INTEGER
+                || minimum < -MAX_JSON_SAFE_INTEGER_V1
+                || maximum > MAX_JSON_SAFE_INTEGER_V1
                 || declaration.format.is_some()
                 || declaration.max_length.is_some()
                 || declaration.min_length.is_some()
@@ -1525,38 +1892,81 @@ fn lower_output_map(
     authored
         .iter()
         .map(|(name, declaration)| {
-            let (scalar, nullable) = schema_type_parts(&declaration.output_type)?;
-            let output_type = match (scalar, declaration.format) {
-                (AuthoredScalarType::String, Some(AuthoredStringFormat::Date)) => OutputType::Date,
-                (AuthoredScalarType::String, None) => OutputType::String,
-                (AuthoredScalarType::Boolean, None) => OutputType::Boolean,
-                (AuthoredScalarType::Integer, None) => OutputType::Integer,
-                (AuthoredScalarType::Null, _) => {
-                    bail!("outputs.{name}: null cannot be the only output type")
+            let (
+                output_type,
+                nullable,
+                max_bytes,
+                minimum,
+                maximum,
+                structured_schema,
+                pointer,
+            ) = match declaration {
+                AuthoredOutputDeclaration::Scalar(declaration) => {
+                    let lowered = lower_authored_scalar_output(
+                        name,
+                        &declaration.output_type,
+                        declaration.format,
+                        declaration.max_length,
+                        declaration.minimum,
+                        declaration.maximum,
+                    )?;
+                    let pointer = match (&declaration.source, require_source) {
+                        (Some(pointer), true) => {
+                            pointer_segments(pointer)?;
+                            Some(pointer.clone())
+                        }
+                        (Some(_), false) => None,
+                        (None, true) => {
+                            bail!("outputs.{name}.x-registry-source is required for http")
+                        }
+                        (None, false) => None,
+                    };
+                    (
+                        lowered.output_type,
+                        lowered.nullable,
+                        lowered.max_bytes,
+                        lowered.minimum,
+                        lowered.maximum,
+                        None,
+                        pointer,
+                    )
                 }
-                (_, Some(_)) => bail!("outputs.{name}: format is valid only for String"),
-            };
-            let pointer = match (&declaration.source, require_source) {
-                (Some(pointer), true) => {
-                    pointer_segments(pointer)?;
-                    Some(pointer.clone())
+                AuthoredOutputDeclaration::Object(declaration) => {
+                    match declaration.output_type {
+                        AuthoredOutputObjectType::Object => {}
+                    }
+                    if require_source {
+                        bail!("outputs.{name}: structured outputs require capability.script");
+                    }
+                    let schema = lower_authored_output_object(name, declaration)?;
+                    (
+                        OutputType::Object,
+                        declaration.nullable,
+                        Some(declaration.max_bytes),
+                        None,
+                        None,
+                        Some(schema),
+                        None,
+                    )
                 }
-                (Some(_), false) => None,
-                (None, true) => {
-                    bail!("outputs.{name}.x-registry-source is required for http")
+                AuthoredOutputDeclaration::Array(declaration) => {
+                    match declaration.output_type {
+                        AuthoredOutputArrayType::Array => {}
+                    }
+                    if require_source {
+                        bail!("outputs.{name}: structured outputs require capability.script");
+                    }
+                    let schema = lower_authored_output_array(name, declaration)?;
+                    (
+                        OutputType::Array,
+                        declaration.nullable,
+                        Some(declaration.max_bytes),
+                        None,
+                        None,
+                        Some(schema),
+                        None,
+                    )
                 }
-                (None, false) => None,
-            };
-            let max_bytes = if output_type == OutputType::String {
-                Some(
-                    declaration
-                        .max_length
-                        .ok_or_else(|| anyhow!("outputs.{name}.maxLength is required"))?
-                        .checked_mul(4)
-                        .ok_or_else(|| anyhow!("outputs.{name}.maxLength exceeds byte limits"))?,
-                )
-            } else {
-                None
             };
             Ok((
                 name.clone(),
@@ -1564,12 +1974,9 @@ fn lower_output_map(
                     output_type,
                     nullable,
                     max_bytes,
-                    minimum: (output_type == OutputType::Integer)
-                        .then_some(declaration.minimum)
-                        .flatten(),
-                    maximum: (output_type == OutputType::Integer)
-                        .then_some(declaration.maximum)
-                        .flatten(),
+                    minimum,
+                    maximum,
+                    structured_schema,
                     from: pointer.as_ref().map(|_| format!("{step}.record.{name}")),
                     source_pointer: pointer,
                 },
@@ -1578,6 +1985,145 @@ fn lower_output_map(
         .collect()
 }
 
+struct LoweredOutputScalar {
+    schema: StructuredOutputSchema,
+    output_type: OutputType,
+    nullable: bool,
+    max_bytes: Option<u32>,
+    minimum: Option<i64>,
+    maximum: Option<i64>,
+}
+
+fn lower_authored_scalar_output(
+    name: &str,
+    output_type: &AuthoredSchemaType,
+    format: Option<AuthoredStringFormat>,
+    max_length: Option<u32>,
+    minimum: Option<i64>,
+    maximum: Option<i64>,
+) -> Result<LoweredOutputScalar> {
+    let (scalar, nullable) = schema_type_parts(output_type)?;
+    match (scalar, format) {
+        (AuthoredScalarType::String, Some(AuthoredStringFormat::Date)) => {
+            Ok(LoweredOutputScalar {
+                schema: StructuredOutputSchema::Date { nullable },
+                output_type: OutputType::Date,
+                nullable,
+                max_bytes: None,
+                minimum: None,
+                maximum: None,
+            })
+        }
+        (AuthoredScalarType::String, None) => {
+            let max_bytes = max_length
+                .ok_or_else(|| anyhow!("outputs.{name}.maxLength is required"))?
+                .checked_mul(4)
+                .ok_or_else(|| anyhow!("outputs.{name}.maxLength exceeds byte limits"))?;
+            Ok(LoweredOutputScalar {
+                schema: StructuredOutputSchema::String {
+                    nullable,
+                    max_bytes,
+                },
+                output_type: OutputType::String,
+                nullable,
+                max_bytes: Some(max_bytes),
+                minimum: None,
+                maximum: None,
+            })
+        }
+        (AuthoredScalarType::Boolean, None) => Ok(LoweredOutputScalar {
+            schema: StructuredOutputSchema::Boolean { nullable },
+            output_type: OutputType::Boolean,
+            nullable,
+            max_bytes: None,
+            minimum: None,
+            maximum: None,
+        }),
+        (AuthoredScalarType::Integer, None) => {
+            let minimum =
+                minimum.ok_or_else(|| anyhow!("outputs.{name}.minimum is required"))?;
+            let maximum =
+                maximum.ok_or_else(|| anyhow!("outputs.{name}.maximum is required"))?;
+            Ok(LoweredOutputScalar {
+                schema: StructuredOutputSchema::Integer {
+                    nullable,
+                    minimum,
+                    maximum,
+                },
+                output_type: OutputType::Integer,
+                nullable,
+                max_bytes: None,
+                minimum: Some(minimum),
+                maximum: Some(maximum),
+            })
+        }
+        (AuthoredScalarType::Null, _) => {
+            bail!("outputs.{name}: null cannot be the only output type")
+        }
+        (_, Some(_)) => bail!("outputs.{name}: format is valid only for String"),
+    }
+}
+
+fn lower_authored_output_schema(
+    name: &str,
+    schema: &AuthoredOutputSchema,
+) -> Result<StructuredOutputSchema> {
+    match schema {
+        AuthoredOutputSchema::Scalar(schema) => Ok(lower_authored_scalar_output(
+            name,
+            &schema.output_type,
+            schema.format,
+            schema.max_length,
+            schema.minimum,
+            schema.maximum,
+        )?
+        .schema),
+        AuthoredOutputSchema::Object(schema) => lower_authored_output_object(name, schema),
+        AuthoredOutputSchema::Array(schema) => lower_authored_output_array(name, schema),
+    }
+}
+
+fn lower_authored_output_object(
+    name: &str,
+    object: &AuthoredOutputObjectDeclaration,
+) -> Result<StructuredOutputSchema> {
+    match object.output_type {
+        AuthoredOutputObjectType::Object => {}
+    }
+    Ok(StructuredOutputSchema::Object {
+        nullable: object.nullable,
+        max_bytes: object.max_bytes,
+        fields: object
+            .fields
+            .iter()
+            .map(|(field_name, field)| {
+                Ok((
+                    field_name.clone(),
+                    StructuredOutputObjectField {
+                        required: field.required,
+                        schema: Box::new(lower_authored_output_schema(name, &field.schema)?),
+                    },
+                ))
+            })
+            .collect::<Result<_>>()?,
+    })
+}
+
+fn lower_authored_output_array(
+    name: &str,
+    array: &AuthoredOutputArrayDeclaration,
+) -> Result<StructuredOutputSchema> {
+    match array.output_type {
+        AuthoredOutputArrayType::Array => {}
+    }
+    Ok(StructuredOutputSchema::Array {
+        nullable: array.nullable,
+        max_bytes: array.max_bytes,
+        max_items: array.max_items,
+        items: Box::new(lower_authored_output_schema(name, &array.items)?),
+    })
+}
+
 fn response_schema_for_outputs(
     outputs: &BTreeMap<String, AuthoredOutputDeclaration>,
 ) -> Result<SchemaNode> {
@@ -1586,6 +2132,9 @@ fn response_schema_for_outputs(
         fields: BTreeMap::new(),
     };
     for (name, output) in outputs {
+        let AuthoredOutputDeclaration::Scalar(output) = output else {
+            bail!("outputs.{name}: structured HTTP outputs are unavailable");
+        };
         let source = output.source.as_deref().unwrap_or(name.as_str());
         let path = pointer_segments(source)?;
         insert_output_schema(&mut root, &path, output, name)?;
@@ -1596,7 +2145,7 @@ fn response_schema_for_outputs(
 fn insert_output_schema(
     node: &mut SchemaNode,
     path: &[String],
-    output: &AuthoredOutputDeclaration,
+    output: &AuthoredScalarOutputDeclaration,
     output_name: &str,
 ) -> Result<()> {
     let (head, tail) = path
@@ -1628,7 +2177,7 @@ fn insert_output_schema(
     insert_output_schema(&mut field.schema, tail, output, output_name)
 }
 
-fn output_schema_node(output: &AuthoredOutputDeclaration, name: &str) -> Result<SchemaNode> {
+fn output_schema_node(output: &AuthoredScalarOutputDeclaration, name: &str) -> Result<SchemaNode> {
     let (scalar, _) = schema_type_parts(&output.output_type)?;
     match (scalar, output.format) {
         (AuthoredScalarType::String, Some(AuthoredStringFormat::Date)) => Ok(SchemaNode::Date),
diff --git a/crates/registryctl/src/project_authoring/commands.rs b/crates/registryctl/src/project_authoring/commands.rs
index 9b5f51ee60..42b45e5d33 100644
--- a/crates/registryctl/src/project_authoring/commands.rs
+++ b/crates/registryctl/src/project_authoring/commands.rs
@@ -2413,7 +2413,7 @@ mod promotion_adapter_tests {
         // intentional review pins. Adding or changing a published path without
         // updating its closed mapping and reviewed revision fails this test and
         // `project_promotion_projection`.
-        assert_eq!(index.by_path().len(), 657);
+        assert_eq!(index.by_path().len(), 683);
         let mapped = index
             .by_path()
             .keys()
diff --git a/crates/registryctl/src/project_authoring/compiler/artifacts.rs b/crates/registryctl/src/project_authoring/compiler/artifacts.rs
index 1bb154ac52..c22cb11813 100644
--- a/crates/registryctl/src/project_authoring/compiler/artifacts.rs
+++ b/crates/registryctl/src/project_authoring/compiler/artifacts.rs
@@ -700,26 +700,8 @@ fn generated_script_pack_semantics(
         .document
         .outputs
         .iter()
-        .map(|(name, output)| {
-            let output_type = match output.output_type {
-                OutputType::Boolean | OutputType::Presence => "boolean",
-                OutputType::Integer => "integer",
-                OutputType::String => "string",
-                OutputType::Date => "date",
-            };
-            let mut declaration = json!({ "type": output_type, "nullable": output.nullable });
-            match output.output_type {
-                OutputType::String => declaration["max_bytes"] = json!(output.max_bytes),
-                OutputType::Integer => {
-                    declaration["minimum"] = json!(output.minimum);
-                    declaration["maximum"] = json!(output.maximum);
-                }
-                OutputType::Date => declaration["max_bytes"] = json!(10),
-                OutputType::Boolean | OutputType::Presence => {}
-            }
-            (name.clone(), declaration)
-        })
-        .collect::<Map<String, Value>>();
+        .map(|(name, output)| Ok((name.clone(), relay_output_schema_for_output(output)?)))
+        .collect::<Result<Map<String, Value>>>()?;
     let signed_dci = script.signed_dci.as_ref().map(|protocol| {
         json!({
             "protocol_version": "1.0.0",
@@ -898,35 +880,20 @@ fn generated_http_pack_semantics(
         .outputs
         .iter()
         .map(|(name, output)| {
-            let output_type = if output
+            if output
                 .from
                 .as_deref()
                 .is_some_and(|source| source.ends_with(".presence"))
             {
-                "presence"
+                Ok((
+                    name.clone(),
+                    json!({ "type": "presence", "nullable": output.nullable }),
+                ))
             } else {
-                match output.output_type {
-                    OutputType::Boolean | OutputType::Presence => "boolean",
-                    OutputType::Integer => "integer",
-                    OutputType::String => "string",
-                    OutputType::Date => "date",
-                }
-            };
-            let mut declaration = json!({ "type": output_type, "nullable": output.nullable });
-            match output.output_type {
-                OutputType::String => {
-                    declaration["max_bytes"] = json!(output.max_bytes);
-                }
-                OutputType::Integer => {
-                    declaration["minimum"] = json!(output.minimum);
-                    declaration["maximum"] = json!(output.maximum);
-                }
-                OutputType::Date => declaration["max_bytes"] = json!(10),
-                OutputType::Boolean | OutputType::Presence => {}
+                Ok((name.clone(), relay_output_schema_for_output(output)?))
             }
-            (name.clone(), declaration)
         })
-        .collect::<Map<String, Value>>();
+        .collect::<Result<Map<String, Value>>>()?;
     let root_operation_id = data_operations[0].0;
     let operations = data_operations
         .iter()
@@ -1048,6 +1015,9 @@ fn generated_http_pack_semantics(
 }
 
 fn relay_acquisition_schema_for_output(output: &OutputDeclaration) -> Result<Value> {
+    if let Some(schema) = &output.structured_schema {
+        return relay_structured_acquisition_schema(schema);
+    }
     Ok(match output.output_type {
         OutputType::String => json!({
             "type": "string",
@@ -1068,6 +1038,152 @@ fn relay_acquisition_schema_for_output(output: &OutputDeclaration) -> Result<Val
             "minimum": output.minimum.context("integer output minimum is absent")?,
             "maximum": output.maximum.context("integer output maximum is absent")?,
         }),
+        OutputType::Object | OutputType::Array => {
+            bail!("structured output schema is absent")
+        }
+    })
+}
+
+fn relay_structured_acquisition_schema(schema: &StructuredOutputSchema) -> Result<Value> {
+    Ok(match schema {
+        StructuredOutputSchema::String {
+            nullable,
+            max_bytes,
+        } => json!({
+            "type": "string",
+            "nullable": nullable,
+            "max_bytes": max_bytes,
+        }),
+        StructuredOutputSchema::Boolean { nullable } => json!({
+            "type": "boolean",
+            "nullable": nullable,
+        }),
+        StructuredOutputSchema::Integer {
+            nullable,
+            minimum,
+            maximum,
+        } => json!({
+            "type": "integer",
+            "nullable": nullable,
+            "minimum": minimum,
+            "maximum": maximum,
+        }),
+        StructuredOutputSchema::Date { nullable } => json!({
+            "type": "date",
+            "nullable": nullable,
+        }),
+        StructuredOutputSchema::Object {
+            nullable, fields, ..
+        } => {
+            let fields = fields
+                .iter()
+                .map(|(name, field)| {
+                    Ok((
+                        name.clone(),
+                        json!({
+                            "required": field.required,
+                            "schema": relay_structured_acquisition_schema(&field.schema)?,
+                        }),
+                    ))
+                })
+                .collect::<Result<Map<String, Value>>>()?;
+            json!({
+                "type": "object",
+                "nullable": nullable,
+                "reject_unknown_fields": true,
+                "fields": fields,
+            })
+        }
+        StructuredOutputSchema::Array {
+            nullable,
+            max_items,
+            items,
+            ..
+        } => json!({
+            "type": "array",
+            "nullable": nullable,
+            "max_items": max_items,
+            "items": relay_structured_acquisition_schema(items)?,
+        }),
+    })
+}
+
+fn relay_output_schema_for_output(output: &OutputDeclaration) -> Result<Value> {
+    if let Some(schema) = &output.structured_schema {
+        return relay_structured_output_schema(schema);
+    }
+    let mut schema = relay_acquisition_schema_for_output(output)?;
+    if output.output_type == OutputType::Date {
+        schema["max_bytes"] = json!(10);
+    }
+    Ok(schema)
+}
+
+fn relay_structured_output_schema(schema: &StructuredOutputSchema) -> Result<Value> {
+    Ok(match schema {
+        StructuredOutputSchema::String {
+            nullable,
+            max_bytes,
+        } => json!({
+            "type": "string",
+            "nullable": nullable,
+            "max_bytes": max_bytes,
+        }),
+        StructuredOutputSchema::Boolean { nullable } => json!({
+            "type": "boolean",
+            "nullable": nullable,
+        }),
+        StructuredOutputSchema::Integer {
+            nullable,
+            minimum,
+            maximum,
+        } => json!({
+            "type": "integer",
+            "nullable": nullable,
+            "minimum": minimum,
+            "maximum": maximum,
+        }),
+        StructuredOutputSchema::Date { nullable } => json!({
+            "type": "date",
+            "nullable": nullable,
+            "max_bytes": 10,
+        }),
+        StructuredOutputSchema::Object {
+            nullable,
+            max_bytes,
+            fields,
+        } => {
+            let fields = fields
+                .iter()
+                .map(|(name, field)| {
+                    Ok((
+                        name.clone(),
+                        json!({
+                            "required": field.required,
+                            "schema": relay_structured_output_schema(&field.schema)?,
+                        }),
+                    ))
+                })
+                .collect::<Result<Map<String, Value>>>()?;
+            json!({
+                "type": "object",
+                "nullable": nullable,
+                "max_bytes": max_bytes,
+                "fields": fields,
+            })
+        }
+        StructuredOutputSchema::Array {
+            nullable,
+            max_bytes,
+            max_items,
+            items,
+        } => json!({
+            "type": "array",
+            "nullable": nullable,
+            "max_bytes": max_bytes,
+            "max_items": max_items,
+            "items": relay_structured_output_schema(items)?,
+        }),
     })
 }
 
@@ -2543,13 +2659,14 @@ mod artifact_projection_tests {
     use super::*;
 
     #[test]
-    fn date_acquisition_schema_is_not_a_bounded_string() {
+    fn date_acquisition_and_output_schemas_use_their_exact_shapes() {
         let date = relay_acquisition_schema_for_output(&OutputDeclaration {
             output_type: OutputType::Date,
             nullable: false,
             max_bytes: None,
             minimum: None,
             maximum: None,
+            structured_schema: None,
             from: None,
             source_pointer: None,
         })
@@ -2560,18 +2677,119 @@ mod artifact_projection_tests {
             max_bytes: Some(10),
             minimum: None,
             maximum: None,
+            structured_schema: None,
             from: None,
             source_pointer: None,
         })
         .expect("string schema compiles");
 
-        assert_eq!(date, json!({"type": "date", "nullable": false}));
+        assert_eq!(
+            date,
+            json!({"type": "date", "nullable": false})
+        );
+        assert_eq!(
+            relay_output_schema_for_output(&OutputDeclaration {
+                output_type: OutputType::Date,
+                nullable: false,
+                max_bytes: None,
+                minimum: None,
+                maximum: None,
+                structured_schema: None,
+                from: None,
+                source_pointer: None,
+            })
+            .expect("date output schema compiles"),
+            json!({"type": "date", "nullable": false, "max_bytes": 10})
+        );
         assert_eq!(
             string,
             json!({"type": "string", "nullable": false, "max_bytes": 10})
         );
     }
 
+    #[test]
+    fn structured_acquisition_schema_preserves_the_exact_recursive_shape() {
+        let declaration = OutputDeclaration {
+            output_type: OutputType::Array,
+            nullable: false,
+            max_bytes: Some(1024),
+            minimum: None,
+            maximum: None,
+            structured_schema: Some(StructuredOutputSchema::Array {
+                nullable: false,
+                max_bytes: 1024,
+                max_items: 2,
+                items: Box::new(StructuredOutputSchema::Object {
+                    nullable: false,
+                    max_bytes: 384,
+                    fields: BTreeMap::from([(
+                        "name".to_string(),
+                        StructuredOutputObjectField {
+                            required: true,
+                            schema: Box::new(StructuredOutputSchema::String {
+                                nullable: false,
+                                max_bytes: 640,
+                            }),
+                        },
+                    )]),
+                }),
+            }),
+            from: None,
+            source_pointer: None,
+        };
+        let parents =
+            relay_output_schema_for_output(&declaration).expect("structured schema compiles");
+
+        assert_eq!(
+            parents,
+            json!({
+                "type": "array",
+                "nullable": false,
+                "max_bytes": 1024,
+                "max_items": 2,
+                "items": {
+                    "type": "object",
+                    "nullable": false,
+                    "max_bytes": 384,
+                    "fields": {
+                        "name": {
+                            "required": true,
+                            "schema": {
+                                "type": "string",
+                                "nullable": false,
+                                "max_bytes": 640
+                            }
+                        }
+                    }
+                }
+            })
+        );
+        assert_eq!(
+            relay_acquisition_schema_for_output(&declaration)
+                .expect("structured acquisition schema compiles"),
+            json!({
+                "type": "array",
+                "nullable": false,
+                "max_items": 2,
+                "items": {
+                    "type": "object",
+                    "nullable": false,
+                    "reject_unknown_fields": true,
+                    "fields": {
+                        "name": {
+                            "required": true,
+                            "schema": {
+                                "type": "string",
+                                "nullable": false,
+                                "max_bytes": 640
+                            }
+                        }
+                    }
+                }
+            })
+        );
+    }
+
     #[test]
     fn raw_projection_schema_preserves_recursive_additional_field_policy() {
         let schema = SchemaNode::Object {
diff --git a/crates/registryctl/src/project_authoring/compiler/notary.rs b/crates/registryctl/src/project_authoring/compiler/notary.rs
index 36ddf863bb..67e8547c8b 100644
--- a/crates/registryctl/src/project_authoring/compiler/notary.rs
+++ b/crates/registryctl/src/project_authoring/compiler/notary.rs
@@ -296,16 +296,19 @@ fn generated_notary_config(
     let mut auth = json!({ "api_keys": api_keys });
     if let Some(binding) = &environment.oid4vci {
         let public_base_url = binding.public_base_url.trim_end_matches('/');
+        let allowed_clients = std::iter::once(binding.client.id.as_str())
+            .chain(binding.registrar_clients.iter().map(String::as_str))
+            .collect::<Vec<_>>();
         instance["public_base_url"] = Value::String(public_base_url.to_string());
         evidence["api_base_url"] = Value::String(public_base_url.to_string());
         auth["oidc"] = json!({
             "issuer": binding.authorization_server.issuer,
             "jwks_url": binding.authorization_server.jwks_url,
             "userinfo_endpoint": binding.authorization_server.userinfo_url,
-            "audiences": [binding.client.id],
-            "allowed_clients": [binding.client.id],
+            "audiences": [binding.client.id.as_str(), public_base_url],
+            "allowed_clients": allowed_clients,
             "allowed_algorithms": ["RS256"],
-            "allowed_token_types": [],
+            "allowed_token_types": ["JWT"],
             "scope_claim": "scope",
             "scope_separator": " ",
             "principal_claim": "sub",
@@ -513,6 +516,9 @@ fn claim_value_type(value: &ClaimValueDeclaration) -> Result<&'static str> {
         OutputType::Integer => Ok("integer"),
         OutputType::String => Ok("string"),
         OutputType::Date => Ok("date"),
+        OutputType::Object | OutputType::Array => {
+            bail!("claim value contracts cannot declare structured values")
+        }
         OutputType::Presence => bail!("claim value contracts cannot use presence"),
     }
 }
@@ -522,6 +528,12 @@ fn generated_notary_output_contracts(integration: &IntegrationDocument) -> Resul
         .outputs
         .iter()
         .map(|(name, output)| {
+            if let Some(schema) = &output.structured_schema {
+                return Ok((
+                    name.clone(),
+                    generated_notary_structured_output_contract(schema)?,
+                ));
+            }
             let contract = match output.output_type {
                 OutputType::Boolean => {
                     json!({ "type": "boolean", "nullable": output.nullable })
@@ -550,6 +562,9 @@ fn generated_notary_output_contracts(integration: &IntegrationDocument) -> Resul
                 OutputType::Date => {
                     json!({ "type": "date", "nullable": output.nullable })
                 }
+                OutputType::Object | OutputType::Array => {
+                    bail!("structured output schema is absent")
+                }
                 OutputType::Presence => bail!("presence is an outcome, not a declared output"),
             };
             Ok((name.clone(), contract))
@@ -558,6 +573,75 @@ fn generated_notary_output_contracts(integration: &IntegrationDocument) -> Resul
     Ok(Value::Object(outputs))
 }
 
+fn generated_notary_structured_output_contract(
+    schema: &StructuredOutputSchema,
+) -> Result<Value> {
+    Ok(match schema {
+        StructuredOutputSchema::String {
+            nullable,
+            max_bytes,
+        } => json!({
+            "type": "string",
+            "nullable": nullable,
+            "max_bytes": max_bytes,
+        }),
+        StructuredOutputSchema::Boolean { nullable } => json!({
+            "type": "boolean",
+            "nullable": nullable,
+        }),
+        StructuredOutputSchema::Integer {
+            nullable,
+            minimum,
+            maximum,
+        } => json!({
+            "type": "integer",
+            "nullable": nullable,
+            "minimum": minimum,
+            "maximum": maximum,
+        }),
+        StructuredOutputSchema::Date { nullable } => json!({
+            "type": "date",
+            "nullable": nullable,
+        }),
+        StructuredOutputSchema::Object {
+            nullable,
+            max_bytes,
+            fields,
+        } => {
+            let fields = fields
+                .iter()
+                .map(|(name, field)| {
+                    Ok((
+                        name.clone(),
+                        json!({
+                            "required": field.required,
+                            "schema": generated_notary_structured_output_contract(&field.schema)?,
+                        }),
+                    ))
+                })
+                .collect::<Result<Map<String, Value>>>()?;
+            json!({
+                "type": "object",
+                "nullable": nullable,
+                "max_bytes": max_bytes,
+                "fields": fields,
+            })
+        }
+        StructuredOutputSchema::Array {
+            nullable,
+            max_bytes,
+            max_items,
+            items,
+        } => json!({
+            "type": "array",
+            "nullable": nullable,
+            "max_bytes": max_bytes,
+            "max_items": max_items,
+            "items": generated_notary_structured_output_contract(items)?,
+        }),
+    })
+}
+
 fn output_source_schema<'a>(
     integration: &'a IntegrationDocument,
     output: &OutputDeclaration,
@@ -630,6 +714,8 @@ fn generated_notary_claim_rule(
             OutputType::Integer => "integer",
             OutputType::String => "string",
             OutputType::Date => "date",
+            OutputType::Object => "object",
+            OutputType::Array => "array",
             OutputType::Presence => bail!("presence cannot be referenced as an output"),
         };
         let nullable = true;
@@ -866,53 +952,81 @@ fn claim_consultation_name<'a>(
     }
 }
 
-fn cel_member_roots(expression: &str) -> Result<BTreeSet<String>> {
+#[derive(Debug, Default, PartialEq, Eq)]
+struct CelReferences {
+    roots: BTreeSet<String>,
+    first_level_members: BTreeMap<String, BTreeSet<String>>,
+    uses_index: bool,
+}
+
+fn cel_references(expression: &str) -> Result<CelReferences> {
     let program = cel::Program::compile(expression)
         .map_err(|_| anyhow!("CEL expression contains invalid syntax"))?;
-    let mut roots = BTreeSet::new();
-    collect_cel_roots(program.expression(), &BTreeSet::new(), &mut roots);
-    Ok(roots)
+    let mut references = CelReferences::default();
+    collect_cel_references(program.expression(), &BTreeSet::new(), &mut references);
+    Ok(references)
 }
 
-fn collect_cel_roots(
+fn cel_member_roots(expression: &str) -> Result<BTreeSet<String>> {
+    Ok(cel_references(expression)?.roots)
+}
+
+fn collect_cel_references(
     expression: &IdedExpr,
     locals: &BTreeSet<String>,
-    roots: &mut BTreeSet<String>,
+    references: &mut CelReferences,
 ) {
     match &expression.expr {
         Expr::Unspecified | Expr::Literal(_) => {}
         Expr::Ident(name) => {
             if !name.starts_with('@') && !locals.contains(name) {
-                roots.insert(name.clone());
+                references.roots.insert(name.clone());
             }
         }
-        Expr::Select(select) => collect_cel_roots(&select.operand, locals, roots),
+        Expr::Select(select) => {
+            if let Expr::Ident(root) = &select.operand.expr {
+                if !root.starts_with('@') && !locals.contains(root) {
+                    references
+                        .first_level_members
+                        .entry(root.clone())
+                        .or_default()
+                        .insert(select.field.clone());
+                }
+            }
+            collect_cel_references(&select.operand, locals, references);
+        }
         Expr::Call(call) => {
+            if matches!(
+                call.func_name.as_str(),
+                cel::common::ast::operators::INDEX | cel::common::ast::operators::OPT_INDEX
+            ) {
+                references.uses_index = true;
+            }
             if let Some(target) = &call.target {
-                collect_cel_roots(target, locals, roots);
+                collect_cel_references(target, locals, references);
             }
             for argument in &call.args {
-                collect_cel_roots(argument, locals, roots);
+                collect_cel_references(argument, locals, references);
             }
         }
         Expr::List(list) => {
             for element in &list.elements {
-                collect_cel_roots(element, locals, roots);
+                collect_cel_references(element, locals, references);
             }
         }
         Expr::Map(map) => {
             for entry in &map.entries {
-                collect_cel_entry_roots(&entry.expr, locals, roots);
+                collect_cel_entry_references(&entry.expr, locals, references);
             }
         }
         Expr::Struct(value) => {
             for entry in &value.entries {
-                collect_cel_entry_roots(&entry.expr, locals, roots);
+                collect_cel_entry_references(&entry.expr, locals, references);
             }
         }
         Expr::Comprehension(comprehension) => {
-            collect_cel_roots(&comprehension.iter_range, locals, roots);
-            collect_cel_roots(&comprehension.accu_init, locals, roots);
+            collect_cel_references(&comprehension.iter_range, locals, references);
+            collect_cel_references(&comprehension.accu_init, locals, references);
 
             let mut scoped_locals = locals.clone();
             scoped_locals.insert(comprehension.iter_var.clone());
@@ -920,23 +1034,33 @@ fn collect_cel_roots(
                 scoped_locals.insert(iter_var.clone());
             }
             scoped_locals.insert(comprehension.accu_var.clone());
-            collect_cel_roots(&comprehension.loop_cond, &scoped_locals, roots);
-            collect_cel_roots(&comprehension.loop_step, &scoped_locals, roots);
-            collect_cel_roots(&comprehension.result, &scoped_locals, roots);
+            collect_cel_references(
+                &comprehension.loop_cond,
+                &scoped_locals,
+                references,
+            );
+            collect_cel_references(
+                &comprehension.loop_step,
+                &scoped_locals,
+                references,
+            );
+            collect_cel_references(&comprehension.result, &scoped_locals, references);
         }
     }
 }
 
-fn collect_cel_entry_roots(
+fn collect_cel_entry_references(
     entry: &EntryExpr,
     locals: &BTreeSet<String>,
-    roots: &mut BTreeSet<String>,
+    references: &mut CelReferences,
 ) {
     match entry {
-        EntryExpr::StructField(field) => collect_cel_roots(&field.value, locals, roots),
+        EntryExpr::StructField(field) => {
+            collect_cel_references(&field.value, locals, references);
+        }
         EntryExpr::MapEntry(entry) => {
-            collect_cel_roots(&entry.key, locals, roots);
-            collect_cel_roots(&entry.value, locals, roots);
+            collect_cel_references(&entry.key, locals, references);
+            collect_cel_references(&entry.value, locals, references);
         }
     }
 }
diff --git a/crates/registryctl/src/project_authoring/documentation.rs b/crates/registryctl/src/project_authoring/documentation.rs
index 78ac0e2c0c..e1a29b3ec3 100644
--- a/crates/registryctl/src/project_authoring/documentation.rs
+++ b/crates/registryctl/src/project_authoring/documentation.rs
@@ -766,7 +766,7 @@ fn runtime_schema_paths(
     document: &Value,
 ) -> Result<BTreeMap<String, RuntimeSchemaPath>, DocumentationError> {
     let mut paths = BTreeMap::new();
-    let mut visited_references = BTreeSet::new();
+    let mut reference_visits = RuntimeSchemaReferenceVisits::default();
     record_runtime_path(
         &mut paths,
         RuntimePathIdentity {
@@ -784,19 +784,25 @@ fn runtime_schema_paths(
         document,
         "",
         "",
-        &mut visited_references,
+        &mut reference_visits,
         &mut paths,
     )?;
     Ok(paths)
 }
 
+#[derive(Default)]
+struct RuntimeSchemaReferenceVisits {
+    visited: BTreeSet<(String, String)>,
+    active: BTreeSet<String>,
+}
+
 fn walk_runtime_schema(
     schema: ConfigurationSchemaKind,
     document: &Value,
     node: &Value,
     pointer: &str,
     key_path: &str,
-    visited_references: &mut BTreeSet<(String, String)>,
+    reference_visits: &mut RuntimeSchemaReferenceVisits,
     paths: &mut BTreeMap<String, RuntimeSchemaPath>,
 ) -> Result<(), DocumentationError> {
     let Some(object) = node.as_object() else {
@@ -809,7 +815,9 @@ fn walk_runtime_schema(
             ))
         })?;
         let visit = (target_pointer.to_owned(), key_path.to_owned());
-        if visited_references.insert(visit) {
+        if reference_visits.visited.insert(visit)
+            && reference_visits.active.insert(target_pointer.to_owned())
+        {
             let target = document.pointer(target_pointer).ok_or_else(|| {
                 documentation_error(format!(
                     "{schema} runtime schema has unresolved reference {reference:?}"
@@ -821,9 +829,10 @@ fn walk_runtime_schema(
                 target,
                 target_pointer,
                 key_path,
-                visited_references,
+                reference_visits,
                 paths,
             )?;
+            reference_visits.active.remove(target_pointer);
         }
     }
 
@@ -836,7 +845,7 @@ fn walk_runtime_schema(
                     branch,
                     &format!("{pointer}/{keyword}/{index}"),
                     key_path,
-                    visited_references,
+                    reference_visits,
                     paths,
                 )?;
             }
@@ -875,7 +884,7 @@ fn walk_runtime_schema(
                 property,
                 &child_pointer,
                 &child_key_path,
-                visited_references,
+                reference_visits,
                 paths,
             )?;
         }
@@ -901,7 +910,7 @@ fn walk_runtime_schema(
             items,
             &child_pointer,
             &child_key_path,
-            visited_references,
+            reference_visits,
             paths,
         )?;
     }
@@ -929,7 +938,7 @@ fn walk_runtime_schema(
             values,
             &child_pointer,
             &child_key_path,
-            visited_references,
+            reference_visits,
             paths,
         )?;
     }
@@ -2846,7 +2855,7 @@ mod tests {
             .expect("embedded reference coverage is readable");
         assert!(!coverage.source_contract.reads_country_workspaces);
         assert!(!coverage.source_contract.reads_runtime_configuration);
-        assert_eq!(coverage.coverage.path_count, 657);
+        assert_eq!(coverage.coverage.path_count, 683);
     }
 
     #[test]
diff --git a/crates/registryctl/src/project_authoring/model.rs b/crates/registryctl/src/project_authoring/model.rs
index 7355006d01..cf8800ae95 100644
--- a/crates/registryctl/src/project_authoring/model.rs
+++ b/crates/registryctl/src/project_authoring/model.rs
@@ -1601,9 +1601,51 @@ enum OutputType {
     Integer,
     String,
     Date,
+    Object,
+    Array,
     Presence,
 }
 
+#[cfg_attr(test, derive(schemars::JsonSchema))]
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct StructuredOutputObjectField {
+    required: bool,
+    schema: Box<StructuredOutputSchema>,
+}
+
+#[cfg_attr(test, derive(schemars::JsonSchema))]
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)]
+enum StructuredOutputSchema {
+    String {
+        nullable: bool,
+        max_bytes: u32,
+    },
+    Boolean {
+        nullable: bool,
+    },
+    Integer {
+        nullable: bool,
+        minimum: i64,
+        maximum: i64,
+    },
+    Date {
+        nullable: bool,
+    },
+    Object {
+        nullable: bool,
+        max_bytes: u32,
+        fields: BTreeMap<String, StructuredOutputObjectField>,
+    },
+    Array {
+        nullable: bool,
+        max_bytes: u32,
+        max_items: u16,
+        items: Box<StructuredOutputSchema>,
+    },
+}
+
 #[cfg_attr(test, derive(schemars::JsonSchema))]
 #[derive(Debug, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -1619,6 +1661,8 @@ struct OutputDeclaration {
     #[serde(default)]
     maximum: Option<i64>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
+    structured_schema: Option<StructuredOutputSchema>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     from: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     source_pointer: Option<String>,
@@ -1924,6 +1968,14 @@ struct Oid4vciBinding {
     credential: Oid4vciCredentialBinding,
     authorization_server: Oid4vciAuthorizationServerBinding,
     client: Oid4vciClientBinding,
+    /// Machine OIDC clients admitted to create registrar-initiated offers.
+    ///
+    /// These clients use the pinned authorization server and the Notary public
+    /// base URL as their resource audience. They are deliberately separate
+    /// from the citizen client so generated subject-access classification
+    /// remains closed.
+    #[serde(default)]
+    registrar_clients: Vec<String>,
     access_token: Oid4vciSigningKeyBinding,
     sensitive_state_key: SecretReference,
     subject: Oid4vciSubjectBinding,
diff --git a/crates/registryctl/src/project_authoring/project.rs b/crates/registryctl/src/project_authoring/project.rs
index 2a5f17abcc..c980d2c536 100644
--- a/crates/registryctl/src/project_authoring/project.rs
+++ b/crates/registryctl/src/project_authoring/project.rs
@@ -276,6 +276,7 @@ fn lower_project_integration(
                     max_bytes,
                     minimum: field.minimum,
                     maximum: field.maximum,
+                    structured_schema: None,
                     from: Some(format!("snapshot.record.{name}")),
                     source_pointer: None,
                 },
@@ -857,6 +858,8 @@ fn semantic_digests(
             "relay": environment.relay,
             "notary_relay": environment.notary_relay,
             "notary_state": environment.notary_state,
+            "oid4vci_registrar_clients": environment.oid4vci.as_ref()
+                .map(|binding| &binding.registrar_clients),
             "deployment": environment.deployment,
         });
         if let Some(relay_state) = &environment.relay_state {
@@ -886,7 +889,7 @@ fn semantic_digests(
 // A schema or knowledge change must therefore be reviewed for promotion
 // semantics before a new projection can be emitted.
 const PROMOTION_FIELD_KNOWLEDGE_REVISION: &str =
-    "sha256:a8f00b404cb86e06f8c2f63ed0df9f27bf1df92636568a265d9338416dea0332";
+    "sha256:5f2fa5cff59147791a8d8af3d4ee5fc3c8cfdd053877e681a0d1b9a06b1601bf";
 
 fn project_promotion_projection(
     loaded: &LoadedRegistryProject,
@@ -958,6 +961,8 @@ fn project_promotion_projection(
         "oid4vci_authorization_server": environment.oid4vci.as_ref().map(|binding| json!({
             "issuer": binding.authorization_server.issuer,
         })),
+        "oid4vci_registrar_clients": environment.oid4vci.as_ref()
+            .map(|binding| &binding.registrar_clients),
     });
     let trust_members = environment
         .integrations
@@ -991,6 +996,13 @@ fn project_promotion_projection(
                 .flat_map(|relay| relay.allowed_clients.iter())
                 .map(|client| json!(["relay_client", client])),
         )
+        .chain(
+            environment
+                .oid4vci
+                .iter()
+                .flat_map(|binding| binding.registrar_clients.iter())
+                .map(|client| json!(["oid4vci_registrar_client", client])),
+        )
         .collect::<Vec<_>>();
 
     let caller_state = environment.callers.iter().collect::<BTreeMap<_, _>>();
@@ -1581,6 +1593,7 @@ fn promotion_kind_for_field_path(path: &knowledge::FieldPath) -> Option<Promotio
                 || pointer.contains("/mtls")
                 || pointer.contains("audience")
                 || pointer.contains("allowed_clients")
+                || pointer.contains("registrar_clients")
                 || pointer.contains("/issuer")
             {
                 Some(Kind::Trust)
@@ -2505,13 +2518,21 @@ fn validate_service_integration_links(
     project: &RegistryProject,
     integrations: &BTreeMap<String, LoadedIntegration>,
 ) -> Result<()> {
-    for service in project
+    for (service_id, service) in project
         .services
-        .values()
-        .filter(|service| service.kind == ServiceKind::Evidence)
+        .iter()
+        .filter(|(_, service)| service.kind == ServiceKind::Evidence)
     {
-        for consultation in service.consultations.values() {
+        for (consultation_name, consultation) in &service.consultations {
             let integration = &integrations[&consultation.integration].document;
+            if integration.outputs.len()
+                > registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
+            {
+                bail!(
+                    "service {service_id} consultation {consultation_name} integration outputs must contain no more than {} entries",
+                    registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
+                );
+            }
             if consultation.input.keys().ne(integration.input.keys()) {
                 bail!("consultation input must bind the integration input set exactly");
             }
@@ -2521,6 +2542,36 @@ fn validate_service_integration_links(
                 bail!("consultation target mappings must be injective");
             }
         }
+        for (claim_id, claim) in &service.claims {
+            let Some(expression) = claim.cel.as_deref() else {
+                continue;
+            };
+            if inferred_claim_evidence(service, claim)? != ClaimEvidence::RegistryBacked {
+                continue;
+            }
+            let references = cel_references(expression)
+                .with_context(|| format!("invalid CEL for service {service_id} claim {claim_id}"))?;
+            if references.uses_index {
+                bail!(
+                    "service {service_id} claim {claim_id} registry-backed CEL cannot use index access"
+                );
+            }
+            for (consultation_name, consultation) in &service.consultations {
+                let Some(members) = references.first_level_members.get(consultation_name) else {
+                    continue;
+                };
+                let integration = &integrations[&consultation.integration].document;
+                for member in members {
+                    if integration.outputs.get(member).is_some_and(|output| {
+                        matches!(output.output_type, OutputType::Object | OutputType::Array)
+                    }) {
+                        bail!(
+                            "service {service_id} claim {claim_id} CEL cannot reference structured consultation output {consultation_name}.{member}"
+                        );
+                    }
+                }
+            }
+        }
     }
     Ok(())
 }
@@ -2856,7 +2907,7 @@ fn validate_integration(alias: &str, integration: &IntegrationDocument) -> Resul
     }
     validate_credential_interface(integration)?;
     if integration.outputs.is_empty() || integration.outputs.len() > MAX_OUTPUTS {
-        bail!("integration outputs must contain between one and 64 entries");
+        bail!("integration outputs must contain between one and {MAX_OUTPUTS} entries");
     }
     let operations = integration_operations(integration);
     let http = matches!(integration.capability, CapabilityDeclaration::Http { .. });
@@ -3213,6 +3264,19 @@ fn validate_oid4vci_binding(
     }
 
     validate_token(&binding.client.id, "OID4VCI client id", 256)?;
+    if binding.registrar_clients.len() > 64 {
+        bail!("OID4VCI registrar_clients exceeds the supported bound");
+    }
+    let mut registrar_clients = BTreeSet::new();
+    for client in &binding.registrar_clients {
+        validate_token(client, "OID4VCI registrar client id", 256)?;
+        if client == &binding.client.id {
+            bail!("OID4VCI registrar_clients must not contain the citizen client id");
+        }
+        if !registrar_clients.insert(client) {
+            bail!("OID4VCI registrar_clients must not contain duplicates");
+        }
+    }
     validate_secret_reference(&binding.client.signing_key)?;
     validate_token(
         &binding.client.signing_kid,
diff --git a/crates/registryctl/src/project_authoring/schema_authority.rs b/crates/registryctl/src/project_authoring/schema_authority.rs
index b3eb6a9460..800e071272 100644
--- a/crates/registryctl/src/project_authoring/schema_authority.rs
+++ b/crates/registryctl/src/project_authoring/schema_authority.rs
@@ -1980,6 +1980,7 @@ mod schema_authority_tests {
                 "/$defs/integrationRequestByteSize",
                 "/$defs/integrationResponseByteSize",
                 "/$defs/integrationSourceByteSize",
+                "/$defs/oid4vci/properties/registrar_clients",
                 "/$defs/oid4vci/properties/tx_code/properties/required",
                 "/properties/issuance/properties/algorithm",
             ]
@@ -2051,6 +2052,20 @@ mod schema_authority_tests {
             serde_json::to_value(tx_omitted).expect("tx code serializes"),
             serde_json::to_value(tx_explicit).expect("tx code serializes")
         );
+
+        let environment_schema: Value =
+            serde_json::from_str(ProjectSchemaKind::Environment.document())
+                .expect("environment schema parses");
+        let registrar_clients_default: Vec<String> = serde_json::from_value(
+            environment_schema["$defs"]["oid4vci"]["properties"]["registrar_clients"]["default"]
+                .clone(),
+        )
+        .expect("registrar client default parses");
+        assert_eq!(
+            registrar_clients_default,
+            Vec::<String>::default(),
+            "schema and serde use the same empty registrar-client default"
+        );
     }
 
     fn collect_keyword_addresses(
diff --git a/crates/registryctl/src/project_authoring/tests.rs b/crates/registryctl/src/project_authoring/tests.rs
index 0345967d98..92c7a3abca 100644
--- a/crates/registryctl/src/project_authoring/tests.rs
+++ b/crates/registryctl/src/project_authoring/tests.rs
@@ -186,6 +186,7 @@ maxLength: 10
                 max_bytes,
                 minimum: None,
                 maximum: None,
+                structured_schema: None,
                 from: Some("snapshot.record.birth_date".to_string()),
                 source_pointer: None,
             },
@@ -258,16 +259,416 @@ maximum: 9007199254740991
     }
 
     #[test]
-    fn integer_integration_outputs_preserve_full_i64_bounds() {
-        let output: AuthoredOutputDeclaration = serde_norway::from_str(
-            r#"type: integer
-minimum: -9223372036854775808
-maximum: 9223372036854775807
+    fn integer_integration_outputs_enforce_json_safe_bounds_recursively() {
+        let safe: AuthoredOutputDeclaration = serde_norway::from_str(
+            r#"type: object
+nullable: false
+max_bytes: 1024
+fields:
+  direct:
+    required: true
+    schema:
+      type: integer
+      minimum: -9007199254740991
+      maximum: 9007199254740991
+  nested:
+    required: true
+    schema:
+      type: array
+      nullable: false
+      max_bytes: 512
+      max_items: 2
+      items:
+        type: integer
+        minimum: -9007199254740991
+        maximum: 9007199254740991
+"#,
+        )
+        .expect("nested JSON-safe output contract parses");
+        let mut nodes = OUTPUT_SCHEMA_ENVELOPE_NODES_V1;
+        validate_authored_output("sequence", &safe, &mut nodes)
+            .expect("nested JSON-safe integer boundaries validate");
+
+        for (name, source) in [
+            (
+                "nested object lower bound",
+                r#"type: object
+nullable: false
+max_bytes: 256
+fields:
+  sequence:
+    required: true
+    schema:
+      type: integer
+      minimum: -9007199254740992
+      maximum: 0
 "#,
+            ),
+            (
+                "nested array upper bound",
+                r#"type: array
+nullable: false
+max_bytes: 256
+max_items: 2
+items:
+  type: integer
+  minimum: 0
+  maximum: 9007199254740992
+"#,
+            ),
+        ] {
+            let output: AuthoredOutputDeclaration =
+                serde_norway::from_str(source).expect("adjacent unsafe output contract parses");
+            let mut nodes = OUTPUT_SCHEMA_ENVELOPE_NODES_V1;
+            assert!(
+                validate_authored_output("sequence", &output, &mut nodes)
+                    .expect_err("adjacent unsafe nested integer bound rejects")
+                    .to_string()
+                    .contains("Integer schema has invalid constraints"),
+                "{name} must fail during recursive authoring validation"
+            );
+        }
+    }
+
+    #[test]
+    fn structured_script_output_lowers_recursively_with_closed_bounded_fields() {
+        let authored = r#"type: array
+nullable: false
+max_bytes: 1024
+max_items: 2
+items:
+  type: object
+  nullable: false
+  max_bytes: 384
+  fields:
+    type:
+      required: true
+      schema: { type: string, maxLength: 16 }
+    name:
+      required: true
+      schema: { type: string, maxLength: 160 }
+    identifier:
+      required: false
+      schema: { type: [string, "null"], maxLength: 64 }
+"#;
+        let output: AuthoredOutputDeclaration =
+            serde_norway::from_str(authored).expect("structured output parses");
+        let mut nodes = OUTPUT_SCHEMA_ENVELOPE_NODES_V1;
+        let expanded = validate_authored_output("parents", &output, &mut nodes)
+            .expect("structured output validates");
+        assert_eq!(nodes, OUTPUT_SCHEMA_ENVELOPE_NODES_V1 + 5);
+        assert_eq!(expanded, 9);
+
+        let lowered = lower_output_map(
+            &BTreeMap::from([("parents".to_string(), output)]),
+            "birth",
+            false,
+        )
+        .expect("structured script output lowers");
+        let parents = &lowered["parents"];
+        assert_eq!(parents.output_type, OutputType::Array);
+        assert_eq!(parents.max_bytes, Some(1024));
+        assert!(parents.from.is_none());
+        let Some(StructuredOutputSchema::Array {
+            nullable,
+            max_bytes,
+            max_items,
+            items,
+        }) = &parents.structured_schema
+        else {
+            panic!("parents must retain its recursive schema");
+        };
+        assert!(!nullable);
+        assert_eq!(*max_bytes, 1024);
+        assert_eq!(*max_items, 2);
+        let StructuredOutputSchema::Object { fields, .. } = items.as_ref() else {
+            panic!("parents items must be objects");
+        };
+        assert_eq!(
+            fields.keys().map(String::as_str).collect::<Vec<_>>(),
+            ["identifier", "name", "type"]
+        );
+        assert!(!fields["identifier"].required);
+        assert!(matches!(
+            fields["identifier"].schema.as_ref(),
+            StructuredOutputSchema::String {
+                nullable: true,
+                max_bytes: 256
+            }
+        ));
+
+        assert!(lower_output_map(
+            &BTreeMap::from([(
+                "parents".to_string(),
+                serde_norway::from_str(authored).expect("structured output parses again"),
+            )]),
+            "birth",
+            true,
         )
-        .expect("full i64 output contract parses");
-        validate_authored_output("sequence", &output)
-            .expect("integration output bounds intentionally retain full i64");
+        .expect_err("HTTP cannot author structured output projection")
+        .to_string()
+        .contains("require capability.script"));
+    }
+
+    #[test]
+    fn authored_output_count_preserves_the_generic_non_notary_limit() {
+        fn boolean_output() -> AuthoredOutputDeclaration {
+            AuthoredOutputDeclaration::Scalar(AuthoredScalarOutputDeclaration {
+                output_type: AuthoredSchemaType::Single(AuthoredScalarType::Boolean),
+                format: None,
+                max_length: None,
+                minimum: None,
+                maximum: None,
+                source: None,
+            })
+        }
+
+        const {
+            assert!(MAX_OUTPUTS > registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1);
+        }
+        let outputs = |count| {
+            (0..count)
+                .map(|index| (format!("field_{index}"), boolean_output()))
+                .collect::<BTreeMap<_, _>>()
+        };
+        validate_authored_outputs(&outputs(
+            registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1 + 1,
+        ))
+        .expect("generic authoring retains more outputs than a Notary consultation");
+        validate_authored_outputs(&outputs(MAX_OUTPUTS))
+            .expect("the generic integration output limit validates");
+        assert!(validate_authored_outputs(&outputs(MAX_OUTPUTS + 1))
+            .expect_err("one output beyond the generic integration limit rejects")
+            .to_string()
+            .contains(&format!("between one and {MAX_OUTPUTS} fields")));
+    }
+
+    #[test]
+    fn notary_output_count_applies_only_to_evidence_consultations() {
+        let mut evidence =
+            load_registry_project(&project_golden("opencrvs"), None).expect("OpenCRVS project loads");
+        let birth = evidence
+            .integrations
+            .get_mut("birth-record")
+            .expect("birth integration exists");
+        let template = serde_json::to_value(&birth.document.outputs["sex"])
+            .expect("scalar output serializes");
+        while birth.document.outputs.len()
+            <= registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
+        {
+            let index = birth.document.outputs.len();
+            birth.document.outputs.insert(
+                format!("extra_{index}"),
+                serde_json::from_value(template.clone()).expect("scalar output clones"),
+            );
+        }
+        validate_integration("birth-record", &birth.document)
+            .expect("the generic integration contract still accepts 33 outputs");
+        let error = validate_service_integration_links(&evidence.project, &evidence.integrations)
+            .expect_err("an Evidence consultation cannot exceed the Notary output limit");
+        assert!(error.to_string().contains(&format!(
+            "integration outputs must contain no more than {} entries",
+            registry_notary_core::MAX_RELAY_OUTPUT_OBJECT_FIELDS_V1
+        )));
+
+        let records_root = Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("assets/project-starters/spreadsheet");
+        let mut records =
+            load_registry_project(&records_root, None).expect("Records API project loads");
+        records.project.integrations.insert(
+            "wide".to_string(),
+            IntegrationReference {
+                file: PathBuf::from("integrations/wide/integration.yaml"),
+            },
+        );
+        records.integrations.insert(
+            "wide".to_string(),
+            evidence
+                .integrations
+                .remove("birth-record")
+                .expect("wide integration remains available"),
+        );
+        validate_project_shape(&records.project)
+            .expect("a Records API-only project may retain the generic integration limit");
+        validate_service_integration_links(&records.project, &records.integrations)
+            .expect("Records API-only integrations are not narrowed to the Notary limit");
+    }
+
+    #[test]
+    fn structured_output_byte_caps_must_encode_a_non_null_value() {
+        fn validate(source: &str) -> Result<()> {
+            let output: AuthoredOutputDeclaration =
+                serde_norway::from_str(source).expect("structured output parses");
+            let mut nodes = OUTPUT_SCHEMA_ENVELOPE_NODES_V1;
+            validate_authored_output("record", &output, &mut nodes).map(|_| ())
+        }
+
+        let required_boolean = |max_bytes| {
+            format!(
+                r#"type: object
+nullable: false
+max_bytes: {max_bytes}
+fields:
+  active:
+    required: true
+    schema: {{ type: boolean }}
+"#
+            )
+        };
+        assert!(validate(&required_boolean(14))
+            .expect_err("a cap below the required-member encoding rejects")
+            .to_string()
+            .contains("must be at least 15"));
+        validate(&required_boolean(15))
+            .expect("the exact compact encoding bound for the required member validates");
+
+        let array = |max_bytes| {
+            format!(
+                r#"type: array
+nullable: false
+max_bytes: {max_bytes}
+max_items: 1
+items: {{ type: boolean }}
+"#
+            )
+        };
+        assert!(validate(&array(1))
+            .expect_err("a cap below the empty-array encoding rejects")
+            .to_string()
+            .contains("must be at least 2"));
+        validate(&array(2)).expect("the empty-array encoding bound validates");
+
+        let nested = r#"type: object
+nullable: false
+max_bytes: 64
+fields:
+  child:
+    required: true
+    schema:
+      type: object
+      nullable: false
+      max_bytes: 1
+      fields:
+        active:
+          required: false
+          schema: { type: boolean }
+"#;
+        assert!(validate(nested)
+            .expect_err("an impossible nested object cap rejects")
+            .to_string()
+            .contains("outputs.record.fields.child.schema.max_bytes must be at least 2"));
+    }
+
+    #[test]
+    fn structured_output_limits_reserve_the_notary_result_envelope() {
+        fn boolean_schema() -> AuthoredOutputSchema {
+            AuthoredOutputSchema::Scalar(AuthoredScalarOutputSchema {
+                output_type: AuthoredSchemaType::Single(AuthoredScalarType::Boolean),
+                format: None,
+                max_length: None,
+                minimum: None,
+                maximum: None,
+            })
+        }
+
+        fn boolean_output() -> AuthoredOutputDeclaration {
+            AuthoredOutputDeclaration::Scalar(AuthoredScalarOutputDeclaration {
+                output_type: AuthoredSchemaType::Single(AuthoredScalarType::Boolean),
+                format: None,
+                max_length: None,
+                minimum: None,
+                maximum: None,
+                source: None,
+            })
+        }
+
+        fn object_declaration(field_count: usize) -> AuthoredOutputObjectDeclaration {
+            AuthoredOutputObjectDeclaration {
+                output_type: AuthoredOutputObjectType::Object,
+                nullable: false,
+                max_bytes: 65_536,
+                fields: (0..field_count)
+                    .map(|index| {
+                        (
+                            format!("field_{index}"),
+                            AuthoredOutputObjectField {
+                                required: true,
+                                schema: Box::new(boolean_schema()),
+                            },
+                        )
+                    })
+                    .collect(),
+            }
+        }
+
+        fn object_output(field_count: usize) -> AuthoredOutputDeclaration {
+            AuthoredOutputDeclaration::Object(object_declaration(field_count))
+        }
+
+        fn array_output(array_nodes: usize) -> AuthoredOutputDeclaration {
+            assert!(array_nodes > 0);
+            let mut items = boolean_schema();
+            for _ in 1..array_nodes {
+                items = AuthoredOutputSchema::Array(AuthoredOutputArrayDeclaration {
+                    output_type: AuthoredOutputArrayType::Array,
+                    nullable: false,
+                    max_bytes: 65_536,
+                    max_items: 1,
+                    items: Box::new(items),
+                });
+            }
+            AuthoredOutputDeclaration::Array(AuthoredOutputArrayDeclaration {
+                output_type: AuthoredOutputArrayType::Array,
+                nullable: false,
+                max_bytes: 65_536,
+                max_items: 1,
+                items: Box::new(items),
+            })
+        }
+
+        let maximum_depth = BTreeMap::from([("nested".to_string(), array_output(5))]);
+        validate_authored_outputs(&maximum_depth)
+            .expect("five array nodes plus one leaf fit downstream depth eight");
+        let excessive_depth = BTreeMap::from([("nested".to_string(), array_output(6))]);
+        assert!(validate_authored_outputs(&excessive_depth)
+            .expect_err("one more nested node exceeds downstream depth eight")
+            .to_string()
+            .contains("maximum depth of 8"));
+
+        let node_budget = |extra_scalars| {
+            let mut outputs = (0..7)
+                .map(|index| (format!("wide_{index}"), object_output(32)))
+                .collect::<BTreeMap<_, _>>();
+            for index in 0..(5 + extra_scalars) {
+                outputs.insert(format!("scalar_{index}"), boolean_output());
+            }
+            outputs
+        };
+        validate_authored_outputs(&node_budget(0))
+            .expect("236 authored nodes plus the 20-node envelope fit exactly");
+        assert!(validate_authored_outputs(&node_budget(1))
+            .expect_err("237 authored nodes exceed the downstream node budget")
+            .to_string()
+            .contains("more than 256 nodes"));
+
+        let expanded_output = |field_count| {
+            BTreeMap::from([(
+                "expanded".to_string(),
+                AuthoredOutputDeclaration::Array(AuthoredOutputArrayDeclaration {
+                    output_type: AuthoredOutputArrayType::Array,
+                    nullable: false,
+                    max_bytes: 65_536,
+                    max_items: 255,
+                    items: Box::new(AuthoredOutputSchema::Object(object_declaration(field_count))),
+                }),
+            )])
+        };
+        validate_authored_outputs(&expanded_output(14))
+            .expect("expanded schema remains below the downstream envelope-adjusted bound");
+        assert!(validate_authored_outputs(&expanded_output(15))
+            .expect_err("the result envelope pushes expanded nodes beyond 4096")
+            .to_string()
+            .contains("recursive expansion exceeds 4096 nodes"));
     }
 
     #[test]
@@ -2621,6 +3022,18 @@ outputs:
                 .expect("macro-local CEL roots parse"),
             BTreeSet::from(["person".to_string()])
         );
+        assert_eq!(
+            cel_references("person.items.exists(item, item.active)")
+                .expect("macro-local CEL members parse"),
+            CelReferences {
+                roots: BTreeSet::from(["person".to_string()]),
+                first_level_members: BTreeMap::from([(
+                "person".to_string(),
+                BTreeSet::from(["items".to_string()])
+                )]),
+                uses_index: false,
+            }
+        );
         assert_eq!(
             cel_member_roots("person.items.exists(item, item.active) && item.secret == 'outside'")
                 .expect("out-of-scope CEL roots parse"),
@@ -2629,6 +3042,43 @@ outputs:
         assert!(cel_member_roots("person.exists && 'unterminated").is_err());
     }
 
+    #[test]
+    fn registry_cel_claims_reject_structured_consultation_members_before_generation() {
+        let mut loaded =
+            load_registry_project(&project_golden("opencrvs"), None).expect("OpenCRVS project loads");
+        let set_claim_expression = |loaded: &mut LoadedRegistryProject, expression: &str| {
+            let claim = loaded
+                .project
+                .services
+                .get_mut("birth-verification")
+                .and_then(|service| service.claims.get_mut("parents"))
+                .expect("structured parents claim exists");
+            claim.output = None;
+            claim.cel = Some(expression.to_string());
+        };
+        set_claim_expression(
+            &mut loaded,
+            "birth.parents.exists(parent, parent.name != '')",
+        );
+
+        let error = validate_service_integration_links(&loaded.project, &loaded.integrations)
+            .expect_err("structured consultation members must not enter authored CEL claims");
+        assert!(error.to_string().contains(
+            "service birth-verification claim parents CEL cannot reference structured consultation output birth.parents"
+        ));
+
+        set_claim_expression(&mut loaded, r#"birth["parents"] != null"#);
+        let error = validate_service_integration_links(&loaded.project, &loaded.integrations)
+            .expect_err("registry-backed CEL index access must fail before generation");
+        assert!(error
+            .to_string()
+            .contains("registry-backed CEL cannot use index access"));
+
+        set_claim_expression(&mut loaded, "['source-free'][0] == 'source-free'");
+        validate_service_integration_links(&loaded.project, &loaded.integrations)
+            .expect("source-free CEL index behavior remains outside this registry boundary");
+    }
+
     #[test]
     fn secret_descriptor_includes_named_environment_providers() {
         let descriptor = secret_consumer_descriptor(
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/README.md b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/README.md
index a2a9312d33..79e4c3df35 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/README.md
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/README.md
@@ -19,3 +19,12 @@ from this `registryctl` build for VS Code and Zed.
 
 Project-owned Rhai handles traversal and normalization. Relay owns signature,
 correlation, selector, sender, receiver, and cardinality verification.
+
+The match response is explicitly synthetic. Its fictional parent records
+contain a source-only reference so the adapter demonstrates data minimization:
+it constructs each released parent object field by field and releases only
+`type`, `name`, and `identifier`. The closed `parents` output permits at most
+two objects and caps both the array and each item by canonical serialized
+bytes. The adapter never spreads or returns a whole source parent record.
+`parents` is one top-level credential claim and is disclosed or withheld as a
+whole unit; this project does not declare nested selective disclosure.
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/adapter.rhai b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/adapter.rhai
index 93261f260a..f034e6eedf 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/adapter.rhai
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/adapter.rhai
@@ -1,3 +1,15 @@
+fn minimized_parents(source_parents) {
+    let parents = [];
+    for parent in source_parents {
+        parents.push(#{
+            type: parent.type,
+            name: parent.name,
+            identifier: parent.identifier
+        });
+    }
+    parents
+}
+
 fn consult(ctx) {
     let verified = protocol.dci.search(#{
         selectors: #{ uin: ctx.input.uin },
@@ -16,6 +28,7 @@ fn consult(ctx) {
         sex: record.child.sex,
         child_given_name: record.child.given_name,
         child_family_name: record.child.family_name,
-        place_of_birth: record.place_of_birth
+        place_of_birth: record.place_of_birth,
+        parents: minimized_parents(record.parents)
     })
 }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/ambiguous.json b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/ambiguous.json
index e1a86e9449..f4fcea3ba1 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/ambiguous.json
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/ambiguous.json
@@ -1 +1 @@
-{"header":{"action":"on-search","is_msg_encrypted":false,"message_id":"01JZ0000000000000000000000","message_ts":"2026-07-12T08:30:00Z","receiver_id":"fictional-civil-registry","sender_id":"fictional-notary","status":"succ","total_count":2,"version":"1.0.0"},"message":{"correlation_id":"123e4567-e89b-42d3-a456-426614174000","search_response":[{"data":{"reg_record_type":"birth","reg_records":[{"child":{"date_of_birth":"2018-05-12","family_name":"Example","given_name":"Ada","sex":"female"},"identifier":[{"identifier_type":"UIN","identifier_value":"0000000001"}],"place_of_birth":"Fictional District"},{"child":{"date_of_birth":"2017-04-10","family_name":"Example","given_name":"Alex","sex":"male"},"identifier":[{"identifier_type":"UIN","identifier_value":"0000000001"}],"place_of_birth":"Fictional District"}],"reg_type":"civil-registry","version":"1.0.0"},"locale":"en","pagination":{"page_number":1,"page_size":2,"total_count":2},"reference_id":"01JZ0000000000000000000000","status":"succ","timestamp":"2026-07-12T08:30:00Z"}],"transaction_id":"01JZ0000000000000000000000"},"signature":"eyJhbGciOiJSUzI1NiIsImtpZCI6InJlZ2lzdHJ5LXByb2plY3Qtb3BlbmNydnMtc2lnbmluZy0yMDI2LTA3LTEyIn0.eyJoZWFkZXIiOnsiYWN0aW9uIjoib24tc2VhcmNoIiwiaXNfbXNnX2VuY3J5cHRlZCI6ZmFsc2UsIm1lc3NhZ2VfaWQiOiIwMUpaMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsIm1lc3NhZ2VfdHMiOiIyMDI2LTA3LTEyVDA4OjMwOjAwWiIsInJlY2VpdmVyX2lkIjoiZmljdGlvbmFsLWNpdmlsLXJlZ2lzdHJ5Iiwic2VuZGVyX2lkIjoiZmljdGlvbmFsLW5vdGFyeSIsInN0YXR1cyI6InN1Y2MiLCJ0b3RhbF9jb3VudCI6MiwidmVyc2lvbiI6IjEuMC4wIn0sIm1lc3NhZ2UiOnsiY29ycmVsYXRpb25faWQiOiIxMjNlNDU2Ny1lODliLTQyZDMtYTQ1Ni00MjY2MTQxNzQwMDAiLCJzZWFyY2hfcmVzcG9uc2UiOlt7ImRhdGEiOnsicmVnX3JlY29yZF90eXBlIjoiYmlydGgiLCJyZWdfcmVjb3JkcyI6W3siY2hpbGQiOnsiZGF0ZV9vZl9iaXJ0aCI6IjIwMTgtMDUtMTIiLCJmYW1pbHlfbmFtZSI6IkV4YW1wbGUiLCJnaXZlbl9uYW1lIjoiQWRhIiwic2V4IjoiZmVtYWxlIn0sImlkZW50aWZpZXIiOlt7ImlkZW50aWZpZXJfdHlwZSI6IlVJTiIsImlkZW50aWZpZXJfdmFsdWUiOiIwMDAwMDAwMDAxIn1dLCJwbGFjZV9vZl9iaXJ0aCI6IkZpY3Rpb25hbCBEaXN0cmljdCJ9LHsiY2hpbGQiOnsiZGF0ZV9vZl9iaXJ0aCI6IjIwMTctMDQtMTAiLCJmYW1pbHlfbmFtZSI6IkV4YW1wbGUiLCJnaXZlbl9uYW1lIjoiQWxleCIsInNleCI6Im1hbGUifSwiaWRlbnRpZmllciI6W3siaWRlbnRpZmllcl90eXBlIjoiVUlOIiwiaWRlbnRpZmllcl92YWx1ZSI6IjAwMDAwMDAwMDEifV0sInBsYWNlX29mX2JpcnRoIjoiRmljdGlvbmFsIERpc3RyaWN0In1dLCJyZWdfdHlwZSI6ImNpdmlsLXJlZ2lzdHJ5IiwidmVyc2lvbiI6IjEuMC4wIn0sImxvY2FsZSI6ImVuIiwicGFnaW5hdGlvbiI6eyJwYWdlX251bWJlciI6MSwicGFnZV9zaXplIjoyLCJ0b3RhbF9jb3VudCI6Mn0sInJlZmVyZW5jZV9pZCI6IjAxSlowMDAwMDAwMDAwMDAwMDAwMDAwMDAwIiwic3RhdHVzIjoic3VjYyIsInRpbWVzdGFtcCI6IjIwMjYtMDctMTJUMDg6MzA6MDBaIn1dLCJ0cmFuc2FjdGlvbl9pZCI6IjAxSlowMDAwMDAwMDAwMDAwMDAwMDAwMDAwIn19.eZikrqdltAg6JauPItvEjfqTF4Q_Wak6ARn3nbrZnDQws1qzPpJYtXEqym3j8U4y6wslOA7kMDhRmcefrXxIhwIaC8OkpupkjOhT3eumcmV6PvCEKqe2bcQ_av2Hu8e42SJo-hjnhHvIT0qklr9foZ3508de7p9HBjhW0OMnaQGH825l0Hscw9JYcaP6mxefrXi4vTDRSCr4D-mAm-8DfM55GmvcsPg7UcprNstW9fjv1swt2zpSbZCIAcM_HlaSTBUJNMaPizGeJEmFDUoY1fvY48_hHXAL10b8DIgRM5paaatYUz5hN-0uvqUMgGwjc6BNyHGdIBt1oplUwQIVew"}
+{"header":{"action":"on-search","is_msg_encrypted":false,"message_id":"01JZ0000000000000000000000","message_ts":"2026-07-12T08:30:00Z","receiver_id":"fictional-civil-registry","sender_id":"fictional-notary","status":"succ","total_count":2,"version":"1.0.0"},"message":{"correlation_id":"123e4567-e89b-42d3-a456-426614174000","search_response":[{"data":{"reg_record_type":"birth","reg_records":[{"child":{"date_of_birth":"2018-05-12","family_name":"Example","given_name":"Ada","sex":"female"},"identifier":[{"identifier_type":"UIN","identifier_value":"0000000001"}],"place_of_birth":"Fictional District"},{"child":{"date_of_birth":"2017-04-10","family_name":"Example","given_name":"Alex","sex":"male"},"identifier":[{"identifier_type":"UIN","identifier_value":"0000000001"}],"place_of_birth":"Fictional District"}],"reg_type":"civil-registry","version":"1.0.0"},"locale":"en","pagination":{"page_number":1,"page_size":2,"total_count":2},"reference_id":"01JZ0000000000000000000000","status":"succ","timestamp":"2026-07-12T08:30:00Z"}],"transaction_id":"01JZ0000000000000000000000"},"signature":"eyJhbGciOiJSUzI1NiIsImtpZCI6InJlZ2lzdHJ5LXByb2plY3Qtb3BlbmNydnMtc2lnbmluZy0yMDI2LTA3LTI5In0.eyJoZWFkZXIiOnsiYWN0aW9uIjoib24tc2VhcmNoIiwiaXNfbXNnX2VuY3J5cHRlZCI6ZmFsc2UsIm1lc3NhZ2VfaWQiOiIwMUpaMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsIm1lc3NhZ2VfdHMiOiIyMDI2LTA3LTEyVDA4OjMwOjAwWiIsInJlY2VpdmVyX2lkIjoiZmljdGlvbmFsLWNpdmlsLXJlZ2lzdHJ5Iiwic2VuZGVyX2lkIjoiZmljdGlvbmFsLW5vdGFyeSIsInN0YXR1cyI6InN1Y2MiLCJ0b3RhbF9jb3VudCI6MiwidmVyc2lvbiI6IjEuMC4wIn0sIm1lc3NhZ2UiOnsiY29ycmVsYXRpb25faWQiOiIxMjNlNDU2Ny1lODliLTQyZDMtYTQ1Ni00MjY2MTQxNzQwMDAiLCJzZWFyY2hfcmVzcG9uc2UiOlt7ImRhdGEiOnsicmVnX3JlY29yZF90eXBlIjoiYmlydGgiLCJyZWdfcmVjb3JkcyI6W3siY2hpbGQiOnsiZGF0ZV9vZl9iaXJ0aCI6IjIwMTgtMDUtMTIiLCJmYW1pbHlfbmFtZSI6IkV4YW1wbGUiLCJnaXZlbl9uYW1lIjoiQWRhIiwic2V4IjoiZmVtYWxlIn0sImlkZW50aWZpZXIiOlt7ImlkZW50aWZpZXJfdHlwZSI6IlVJTiIsImlkZW50aWZpZXJfdmFsdWUiOiIwMDAwMDAwMDAxIn1dLCJwbGFjZV9vZl9iaXJ0aCI6IkZpY3Rpb25hbCBEaXN0cmljdCJ9LHsiY2hpbGQiOnsiZGF0ZV9vZl9iaXJ0aCI6IjIwMTctMDQtMTAiLCJmYW1pbHlfbmFtZSI6IkV4YW1wbGUiLCJnaXZlbl9uYW1lIjoiQWxleCIsInNleCI6Im1hbGUifSwiaWRlbnRpZmllciI6W3siaWRlbnRpZmllcl90eXBlIjoiVUlOIiwiaWRlbnRpZmllcl92YWx1ZSI6IjAwMDAwMDAwMDEifV0sInBsYWNlX29mX2JpcnRoIjoiRmljdGlvbmFsIERpc3RyaWN0In1dLCJyZWdfdHlwZSI6ImNpdmlsLXJlZ2lzdHJ5IiwidmVyc2lvbiI6IjEuMC4wIn0sImxvY2FsZSI6ImVuIiwicGFnaW5hdGlvbiI6eyJwYWdlX251bWJlciI6MSwicGFnZV9zaXplIjoyLCJ0b3RhbF9jb3VudCI6Mn0sInJlZmVyZW5jZV9pZCI6IjAxSlowMDAwMDAwMDAwMDAwMDAwMDAwMDAwIiwic3RhdHVzIjoic3VjYyIsInRpbWVzdGFtcCI6IjIwMjYtMDctMTJUMDg6MzA6MDBaIn1dLCJ0cmFuc2FjdGlvbl9pZCI6IjAxSlowMDAwMDAwMDAwMDAwMDAwMDAwMDAwIn19.gmCbq8ODSdaKuDo_MCkUszSrRD0VLgHoAbb2usIikqSB6N-1RrdWu4ei_f2dqg8iMw741vUav5Jt668jZ6IBe4YeWRSt3B2fY3dyvHt7sdE0dLMsBibrKxVUQNoWhGgKR-9yr3E62OakjvefXmU3PYrwka5jgLEH-HrIfyGGwaQP8YgVr-AfbFwG-PTbqHt36Q0bhRVIvUF8q2AzwWfmnP9TQnpXtded0oaJD_v1BSrt8dV3vvd9gMcqPR2Dvq2Kz0khCNmKAlZ7A5Qb5iyXwXpuLvAxfZHLgOE7GEI5uLKe0Lo8wC9Bf96HeJYpl_KhVQkIHPpvi1BXhu2NGtzE4A"}
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/jwks.json b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/jwks.json
index df5037c025..5ebbcca929 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/jwks.json
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/jwks.json
@@ -3,17 +3,17 @@
     {
       "alg": "RS256",
       "e": "AQAB",
-      "kid": "registry-project-opencrvs-signing-2026-07-12",
+      "kid": "registry-project-opencrvs-signing-2026-07-29",
       "kty": "RSA",
-      "n": "jxJy6qhNUNMb1t-qO6fzeUecmmOjQifsUzC3C_MyqymrSJWPNUfO9XgxiADey42o2hty14tQsc5QeK_jkjKaUaAQCNAPICXLBQmUqH95poHyqI3O1rDxTAl-AO5aihb8rsogLX45kAO6Ue0Nf8tykbi9Om_BnnPOCQ-zlzzfqsdFDXMj32GkbgTeB3wa8sIkp6nwp5MQmug964yhJm_VAeHW6ZIx47tDkDux6PR2eEEjX1GkdAGzFserBmmZmxeW3UCEMb7hH1Sh63hU0P6qn-ovk9CNGhe-26cn6PvPcn0do_F70pdCe7wRaSSFvWHPUDwvkDQMrXtgFzDJhkArQw",
+      "n": "suvPPzlyWOqQMQmshuXSY3kKPWGq7nurD40v3rkNEysrza1s-vGW61OrM89ZwiI5VJV8dNdC1EWYNqHs_PFtphx9u8vVUKwisMU8pdtSOmCoZpDdQoRA7M3yHg11suV399TEoi2A-eIjLTnoxo6vqmt7ocqtwSDYuGj1V0gnYdWuOM-MSoFKKtydHnIzdHwcQA8s3-lti1Q4HK_RvC-aEb6CPqxU4hxqT7ig8afc8SRr_kfj9SAdDr08cQNXqjclGbEfHGAVtPYTL6D_iczOvDnh2TfarNd-rxbh3WEfLa2Fm4dcvjvVR0ChEX56SoVYeWQ33Re5P17AvpiB9MUy4Q",
       "use": "sig"
     },
     {
       "alg": "RSA-OAEP-256",
       "e": "AQAB",
-      "kid": "registry-project-opencrvs-encryption-2026-07-12",
+      "kid": "registry-project-opencrvs-encryption-2026-07-29",
       "kty": "RSA",
-      "n": "jxJy6qhNUNMb1t-qO6fzeUecmmOjQifsUzC3C_MyqymrSJWPNUfO9XgxiADey42o2hty14tQsc5QeK_jkjKaUaAQCNAPICXLBQmUqH95poHyqI3O1rDxTAl-AO5aihb8rsogLX45kAO6Ue0Nf8tykbi9Om_BnnPOCQ-zlzzfqsdFDXMj32GkbgTeB3wa8sIkp6nwp5MQmug964yhJm_VAeHW6ZIx47tDkDux6PR2eEEjX1GkdAGzFserBmmZmxeW3UCEMb7hH1Sh63hU0P6qn-ovk9CNGhe-26cn6PvPcn0do_F70pdCe7wRaSSFvWHPUDwvkDQMrXtgFzDJhkArQw",
+      "n": "suvPPzlyWOqQMQmshuXSY3kKPWGq7nurD40v3rkNEysrza1s-vGW61OrM89ZwiI5VJV8dNdC1EWYNqHs_PFtphx9u8vVUKwisMU8pdtSOmCoZpDdQoRA7M3yHg11suV399TEoi2A-eIjLTnoxo6vqmt7ocqtwSDYuGj1V0gnYdWuOM-MSoFKKtydHnIzdHwcQA8s3-lti1Q4HK_RvC-aEb6CPqxU4hxqT7ig8afc8SRr_kfj9SAdDr08cQNXqjclGbEfHGAVtPYTL6D_iczOvDnh2TfarNd-rxbh3WEfLa2Fm4dcvjvVR0ChEX56SoVYeWQ33Re5P17AvpiB9MUy4Q",
       "use": "enc"
     }
   ]
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/match.json b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/match.json
index 94e5999ff7..8bbf9d2845 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/match.json
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/match.json
@@ -1 +1 @@
-{"header":{"action":"on-search","is_msg_encrypted":false,"message_id":"01JZ0000000000000000000000","message_ts":"2026-07-12T08:30:00Z","receiver_id":"fictional-civil-registry","sender_id":"fictional-notary","status":"succ","total_count":1,"version":"1.0.0"},"message":{"correlation_id":"123e4567-e89b-42d3-a456-426614174000","search_response":[{"data":{"reg_record_type":"birth","reg_records":[{"child":{"date_of_birth":"2018-05-12","family_name":"Example","given_name":"Ada","sex":"female"},"identifier":[{"identifier_type":"UIN","identifier_value":"0000000001"}],"place_of_birth":"Fictional District"}],"reg_type":"civil-registry","version":"1.0.0"},"locale":"en","pagination":{"page_number":1,"page_size":2,"total_count":1},"reference_id":"01JZ0000000000000000000000","status":"succ","timestamp":"2026-07-12T08:30:00Z"}],"transaction_id":"01JZ0000000000000000000000"},"signature":"eyJhbGciOiJSUzI1NiIsImtpZCI6InJlZ2lzdHJ5LXByb2plY3Qtb3BlbmNydnMtc2lnbmluZy0yMDI2LTA3LTEyIn0.eyJoZWFkZXIiOnsiYWN0aW9uIjoib24tc2VhcmNoIiwiaXNfbXNnX2VuY3J5cHRlZCI6ZmFsc2UsIm1lc3NhZ2VfaWQiOiIwMUpaMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsIm1lc3NhZ2VfdHMiOiIyMDI2LTA3LTEyVDA4OjMwOjAwWiIsInJlY2VpdmVyX2lkIjoiZmljdGlvbmFsLWNpdmlsLXJlZ2lzdHJ5Iiwic2VuZGVyX2lkIjoiZmljdGlvbmFsLW5vdGFyeSIsInN0YXR1cyI6InN1Y2MiLCJ0b3RhbF9jb3VudCI6MSwidmVyc2lvbiI6IjEuMC4wIn0sIm1lc3NhZ2UiOnsiY29ycmVsYXRpb25faWQiOiIxMjNlNDU2Ny1lODliLTQyZDMtYTQ1Ni00MjY2MTQxNzQwMDAiLCJzZWFyY2hfcmVzcG9uc2UiOlt7ImRhdGEiOnsicmVnX3JlY29yZF90eXBlIjoiYmlydGgiLCJyZWdfcmVjb3JkcyI6W3siY2hpbGQiOnsiZGF0ZV9vZl9iaXJ0aCI6IjIwMTgtMDUtMTIiLCJmYW1pbHlfbmFtZSI6IkV4YW1wbGUiLCJnaXZlbl9uYW1lIjoiQWRhIiwic2V4IjoiZmVtYWxlIn0sImlkZW50aWZpZXIiOlt7ImlkZW50aWZpZXJfdHlwZSI6IlVJTiIsImlkZW50aWZpZXJfdmFsdWUiOiIwMDAwMDAwMDAxIn1dLCJwbGFjZV9vZl9iaXJ0aCI6IkZpY3Rpb25hbCBEaXN0cmljdCJ9XSwicmVnX3R5cGUiOiJjaXZpbC1yZWdpc3RyeSIsInZlcnNpb24iOiIxLjAuMCJ9LCJsb2NhbGUiOiJlbiIsInBhZ2luYXRpb24iOnsicGFnZV9udW1iZXIiOjEsInBhZ2Vfc2l6ZSI6MiwidG90YWxfY291bnQiOjF9LCJyZWZlcmVuY2VfaWQiOiIwMUpaMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsInN0YXR1cyI6InN1Y2MiLCJ0aW1lc3RhbXAiOiIyMDI2LTA3LTEyVDA4OjMwOjAwWiJ9XSwidHJhbnNhY3Rpb25faWQiOiIwMUpaMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCJ9fQ.Qoz4qKHuDl7vl2iGxOjI2EQCMobTTyzxkScYg-fF0w7t7pYvD-MMNzX55KAUjlgG7Jbb2VIsJs5gOxJyMdFrYFz-IlaHy3gGk1AoURUdGzjRVIRxNf6ffOIO2tEBRLbn_1PMz-_FcVYGAVXkvW8t_y1EG1CEqdbH1IAFMYagrQAW59dbWvr6SDr8gSSt-dK5CvZZ1Iagky7OPTBVJxdsRF9f7esWrLr3twJfRFLh6IbiexnbEUhPqHnXRQ4h6wyblUC52Rhmwx_ME50uEIEvVD4CAcgordABRJkCRbBeNp9qCAtk5TZV8V8nOAMooaen7AyIhKLud8sqki4W_LfeMQ"}
+{"header":{"action":"on-search","is_msg_encrypted":false,"message_id":"01JZ0000000000000000000000","message_ts":"2026-07-12T08:30:00Z","receiver_id":"fictional-civil-registry","sender_id":"fictional-notary","status":"succ","total_count":1,"version":"1.0.0"},"message":{"correlation_id":"123e4567-e89b-42d3-a456-426614174000","search_response":[{"data":{"reg_record_type":"birth","reg_records":[{"child":{"date_of_birth":"2018-05-12","family_name":"Example","given_name":"Ada","sex":"female"},"identifier":[{"identifier_type":"UIN","identifier_value":"0000000001"}],"place_of_birth":"Fictional District","parents":[{"identifier":"PARENT-0001","name":"Mira Example","source_only_reference":"FICT-PARENT-SOURCE-1","type":"mother"},{"identifier":"PARENT-0002","name":"Noah Example","source_only_reference":"FICT-PARENT-SOURCE-2","type":"father"}]}],"reg_type":"civil-registry","version":"1.0.0"},"locale":"en","pagination":{"page_number":1,"page_size":2,"total_count":1},"reference_id":"01JZ0000000000000000000000","status":"succ","timestamp":"2026-07-12T08:30:00Z"}],"transaction_id":"01JZ0000000000000000000000"},"signature":"eyJhbGciOiJSUzI1NiIsImtpZCI6InJlZ2lzdHJ5LXByb2plY3Qtb3BlbmNydnMtc2lnbmluZy0yMDI2LTA3LTI5In0.eyJoZWFkZXIiOnsiYWN0aW9uIjoib24tc2VhcmNoIiwiaXNfbXNnX2VuY3J5cHRlZCI6ZmFsc2UsIm1lc3NhZ2VfaWQiOiIwMUpaMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsIm1lc3NhZ2VfdHMiOiIyMDI2LTA3LTEyVDA4OjMwOjAwWiIsInJlY2VpdmVyX2lkIjoiZmljdGlvbmFsLWNpdmlsLXJlZ2lzdHJ5Iiwic2VuZGVyX2lkIjoiZmljdGlvbmFsLW5vdGFyeSIsInN0YXR1cyI6InN1Y2MiLCJ0b3RhbF9jb3VudCI6MSwidmVyc2lvbiI6IjEuMC4wIn0sIm1lc3NhZ2UiOnsiY29ycmVsYXRpb25faWQiOiIxMjNlNDU2Ny1lODliLTQyZDMtYTQ1Ni00MjY2MTQxNzQwMDAiLCJzZWFyY2hfcmVzcG9uc2UiOlt7ImRhdGEiOnsicmVnX3JlY29yZF90eXBlIjoiYmlydGgiLCJyZWdfcmVjb3JkcyI6W3siY2hpbGQiOnsiZGF0ZV9vZl9iaXJ0aCI6IjIwMTgtMDUtMTIiLCJmYW1pbHlfbmFtZSI6IkV4YW1wbGUiLCJnaXZlbl9uYW1lIjoiQWRhIiwic2V4IjoiZmVtYWxlIn0sImlkZW50aWZpZXIiOlt7ImlkZW50aWZpZXJfdHlwZSI6IlVJTiIsImlkZW50aWZpZXJfdmFsdWUiOiIwMDAwMDAwMDAxIn1dLCJwbGFjZV9vZl9iaXJ0aCI6IkZpY3Rpb25hbCBEaXN0cmljdCIsInBhcmVudHMiOlt7ImlkZW50aWZpZXIiOiJQQVJFTlQtMDAwMSIsIm5hbWUiOiJNaXJhIEV4YW1wbGUiLCJzb3VyY2Vfb25seV9yZWZlcmVuY2UiOiJGSUNULVBBUkVOVC1TT1VSQ0UtMSIsInR5cGUiOiJtb3RoZXIifSx7ImlkZW50aWZpZXIiOiJQQVJFTlQtMDAwMiIsIm5hbWUiOiJOb2FoIEV4YW1wbGUiLCJzb3VyY2Vfb25seV9yZWZlcmVuY2UiOiJGSUNULVBBUkVOVC1TT1VSQ0UtMiIsInR5cGUiOiJmYXRoZXIifV19XSwicmVnX3R5cGUiOiJjaXZpbC1yZWdpc3RyeSIsInZlcnNpb24iOiIxLjAuMCJ9LCJsb2NhbGUiOiJlbiIsInBhZ2luYXRpb24iOnsicGFnZV9udW1iZXIiOjEsInBhZ2Vfc2l6ZSI6MiwidG90YWxfY291bnQiOjF9LCJyZWZlcmVuY2VfaWQiOiIwMUpaMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsInN0YXR1cyI6InN1Y2MiLCJ0aW1lc3RhbXAiOiIyMDI2LTA3LTEyVDA4OjMwOjAwWiJ9XSwidHJhbnNhY3Rpb25faWQiOiIwMUpaMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCJ9fQ.Q0Y4-EK2ysgv93e73ekjIt34JdMcrrXnFj6wxO1KPg-FswflcC3mnjJTap8EozswAE4rHp4aHvtB_KuKwOc7DyJnt5e-P104UjgE8hzThNIe-D3VQb45K5guN_IrU4fQZV0jdtHMIV15D7omN46Db0e-4RL6-t6Pz6erDEvh_U6Jd_qAwwP-WaJ_2waUta9svCpKk9wGHjjqRSY5ZuI1YUwzuXSse7cyzJ7dUkOmXMOdAHu_4W71SZdNVahK-8RGU77wGLbByIxCDgi5LsQuvIXtOki3HjDJhWgVU-eOGKS_XyJi81DKrX_npJzyNpIIWIjLOtpCXw9vTk5kM2Z7NQ"}
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/no-match.json b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/no-match.json
index 10498c6359..29345c1ce0 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/no-match.json
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/bodies/no-match.json
@@ -1 +1 @@
-{"header":{"action":"on-search","is_msg_encrypted":false,"message_id":"01JZ0000000000000000000000","message_ts":"2026-07-12T08:30:00Z","receiver_id":"fictional-civil-registry","sender_id":"fictional-notary","status":"succ","total_count":0,"version":"1.0.0"},"message":{"correlation_id":"123e4567-e89b-42d3-a456-426614174000","search_response":[{"data":{"reg_record_type":"birth","reg_records":[],"reg_type":"civil-registry","version":"1.0.0"},"locale":"en","pagination":{"page_number":1,"page_size":2,"total_count":0},"reference_id":"01JZ0000000000000000000000","status":"succ","timestamp":"2026-07-12T08:30:00Z"}],"transaction_id":"01JZ0000000000000000000000"},"signature":"eyJhbGciOiJSUzI1NiIsImtpZCI6InJlZ2lzdHJ5LXByb2plY3Qtb3BlbmNydnMtc2lnbmluZy0yMDI2LTA3LTEyIn0.eyJoZWFkZXIiOnsiYWN0aW9uIjoib24tc2VhcmNoIiwiaXNfbXNnX2VuY3J5cHRlZCI6ZmFsc2UsIm1lc3NhZ2VfaWQiOiIwMUpaMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsIm1lc3NhZ2VfdHMiOiIyMDI2LTA3LTEyVDA4OjMwOjAwWiIsInJlY2VpdmVyX2lkIjoiZmljdGlvbmFsLWNpdmlsLXJlZ2lzdHJ5Iiwic2VuZGVyX2lkIjoiZmljdGlvbmFsLW5vdGFyeSIsInN0YXR1cyI6InN1Y2MiLCJ0b3RhbF9jb3VudCI6MCwidmVyc2lvbiI6IjEuMC4wIn0sIm1lc3NhZ2UiOnsiY29ycmVsYXRpb25faWQiOiIxMjNlNDU2Ny1lODliLTQyZDMtYTQ1Ni00MjY2MTQxNzQwMDAiLCJzZWFyY2hfcmVzcG9uc2UiOlt7ImRhdGEiOnsicmVnX3JlY29yZF90eXBlIjoiYmlydGgiLCJyZWdfcmVjb3JkcyI6W10sInJlZ190eXBlIjoiY2l2aWwtcmVnaXN0cnkiLCJ2ZXJzaW9uIjoiMS4wLjAifSwibG9jYWxlIjoiZW4iLCJwYWdpbmF0aW9uIjp7InBhZ2VfbnVtYmVyIjoxLCJwYWdlX3NpemUiOjIsInRvdGFsX2NvdW50IjowfSwicmVmZXJlbmNlX2lkIjoiMDFKWjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAiLCJzdGF0dXMiOiJzdWNjIiwidGltZXN0YW1wIjoiMjAyNi0wNy0xMlQwODozMDowMFoifV0sInRyYW5zYWN0aW9uX2lkIjoiMDFKWjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAifX0.Gaq-PIGoReiZGlHpHaCZeMkuFrhKEvpqH-dfEvD4KTChGSmPnlXZaSQJdBqFcX9iKvTGUdckF65wUkUnCci0-RPk9XhINY1vO6WpJiRmnJLrWXAnlL1kW-qZ2pxf5qwfjxos-MQcpGlNvXgg317FG2M0ecWYOeWMMCAwbElOQ7ZdlzhywyXcMVbN8KcXsQjIhQ8IQMLm9LLoQa8XC0HHIa8nAKupEmlq3X3Rr8mZ-9YuXWmR6eHTJBHNxTyTn_--7_2fhQjqP7bOiiOf4aUS7dfzCTzGJBafbhhzaR1VtAJBlwOO8MuphGtiquvY_a0B2NAtLbYtzhIugjpewAsi8Q"}
+{"header":{"action":"on-search","is_msg_encrypted":false,"message_id":"01JZ0000000000000000000000","message_ts":"2026-07-12T08:30:00Z","receiver_id":"fictional-civil-registry","sender_id":"fictional-notary","status":"succ","total_count":0,"version":"1.0.0"},"message":{"correlation_id":"123e4567-e89b-42d3-a456-426614174000","search_response":[{"data":{"reg_record_type":"birth","reg_records":[],"reg_type":"civil-registry","version":"1.0.0"},"locale":"en","pagination":{"page_number":1,"page_size":2,"total_count":0},"reference_id":"01JZ0000000000000000000000","status":"succ","timestamp":"2026-07-12T08:30:00Z"}],"transaction_id":"01JZ0000000000000000000000"},"signature":"eyJhbGciOiJSUzI1NiIsImtpZCI6InJlZ2lzdHJ5LXByb2plY3Qtb3BlbmNydnMtc2lnbmluZy0yMDI2LTA3LTI5In0.eyJoZWFkZXIiOnsiYWN0aW9uIjoib24tc2VhcmNoIiwiaXNfbXNnX2VuY3J5cHRlZCI6ZmFsc2UsIm1lc3NhZ2VfaWQiOiIwMUpaMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCIsIm1lc3NhZ2VfdHMiOiIyMDI2LTA3LTEyVDA4OjMwOjAwWiIsInJlY2VpdmVyX2lkIjoiZmljdGlvbmFsLWNpdmlsLXJlZ2lzdHJ5Iiwic2VuZGVyX2lkIjoiZmljdGlvbmFsLW5vdGFyeSIsInN0YXR1cyI6InN1Y2MiLCJ0b3RhbF9jb3VudCI6MCwidmVyc2lvbiI6IjEuMC4wIn0sIm1lc3NhZ2UiOnsiY29ycmVsYXRpb25faWQiOiIxMjNlNDU2Ny1lODliLTQyZDMtYTQ1Ni00MjY2MTQxNzQwMDAiLCJzZWFyY2hfcmVzcG9uc2UiOlt7ImRhdGEiOnsicmVnX3JlY29yZF90eXBlIjoiYmlydGgiLCJyZWdfcmVjb3JkcyI6W10sInJlZ190eXBlIjoiY2l2aWwtcmVnaXN0cnkiLCJ2ZXJzaW9uIjoiMS4wLjAifSwibG9jYWxlIjoiZW4iLCJwYWdpbmF0aW9uIjp7InBhZ2VfbnVtYmVyIjoxLCJwYWdlX3NpemUiOjIsInRvdGFsX2NvdW50IjowfSwicmVmZXJlbmNlX2lkIjoiMDFKWjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAiLCJzdGF0dXMiOiJzdWNjIiwidGltZXN0YW1wIjoiMjAyNi0wNy0xMlQwODozMDowMFoifV0sInRyYW5zYWN0aW9uX2lkIjoiMDFKWjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAifX0.p94kn8OqfscqJbFj8cj1LiPjXsy6S_TXWFUVRFjDGRVjWohToQVwLm_1qU3b3tC6NYmG-FqioHvp3dO2UkApTQbU3gvAb84Hp3Ve7gM2Klu-P1_qStyFK2TXB2u1MDObtD7hPZRwwfQv2m6WptGejCqCVL660a9j4V9cfqoR9yq8opoQWKq8eg6Ejs0gZp1yMpw80ck1_3YSSlktRIt3sHjqoc7OtqrpN0wMc9jCTufx-OD-NvgAD7ir4H-XrLb1Ww88zjeIbEDlkvcK8jzP_edt5919N2CKATbYw9bF_Vyt-hzQCpPkI2NoTdKumcKyjMSnCb1wNRl7rVRlz3k1pg"}
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/match.yaml
index 147bd5b648..4b1f9f1c9b 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/match.yaml
@@ -61,6 +61,9 @@ expect:
     child_given_name: Ada
     child_family_name: Example
     place_of_birth: Fictional District
+    parents:
+      - { type: mother, name: Mira Example, identifier: PARENT-0001 }
+      - { type: father, name: Noah Example, identifier: PARENT-0002 }
   claims:
     birth-record-exists: true
     date-of-birth: 2018-05-12
@@ -69,4 +72,7 @@ expect:
     child-family-name: Example
     child-birth-date: 2018-05-12
     child-place-of-birth: Fictional District
+    parents:
+      - { type: mother, name: Mira Example, identifier: PARENT-0001 }
+      - { type: father, name: Noah Example, identifier: PARENT-0002 }
     age-band: 5-17
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/no-match.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/no-match.yaml
index 7461d7d375..3d9c0083f2 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/no-match.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/no-match.yaml
@@ -45,4 +45,4 @@ interactions:
 expect:
   outcome: no_match
   outputs: {}
-  claims: { birth-record-exists: false, date-of-birth: null, sex: null, child-given-name: null, child-family-name: null, child-birth-date: null, child-place-of-birth: null, age-band: null }
+  claims: { birth-record-exists: false, date-of-birth: null, sex: null, child-given-name: null, child-family-name: null, child-birth-date: null, child-place-of-birth: null, parents: null, age-band: null }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/integration.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/integration.yaml
index 8254b230ca..be82001b42 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/integration.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/integration.yaml
@@ -46,5 +46,24 @@ outputs:
   child_given_name: { type: [string, "null"], maxLength: 80 }
   child_family_name: { type: [string, "null"], maxLength: 80 }
   place_of_birth: { type: [string, "null"], maxLength: 120 }
+  parents:
+    type: array
+    nullable: false
+    max_bytes: 1024
+    max_items: 2
+    items:
+      type: object
+      nullable: false
+      max_bytes: 384
+      fields:
+        type:
+          required: true
+          schema: { type: string, maxLength: 16 }
+        name:
+          required: true
+          schema: { type: string, maxLength: 160 }
+        identifier:
+          required: false
+          schema: { type: [string, "null"], maxLength: 64 }
 
 limits: { calls: 1, source_bytes: 512KiB, request_bytes: 32KiB, deadline: 20s }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml
index a7b369a1c4..d048986656 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml
@@ -2,7 +2,7 @@ version: 1
 starter:
   id: opencrvs-dci
   release: 0.15.2
-  content_digest: sha256:bb0c7209783b74cfc131eeb274d40b2adab0e4f8491f400c07e2f8ed2d2ce64c
+  content_digest: sha256:199f1025ab1307e1d906997ca83116c7929d5aa633e0b01297868b4425da8e1e
 registry: { id: fictional-civil-registry }
 integrations:
   birth-record: { file: integrations/birth-record/integration.yaml }
@@ -31,6 +31,7 @@ services:
       child-family-name: { output: birth.child_family_name, disclosure: value }
       child-birth-date: { output: birth.date_of_birth, disclosure: value }
       child-place-of-birth: { output: birth.place_of_birth, disclosure: value }
+      parents: { output: birth.parents, disclosure: value }
       age-band:
         cel: >-
           birth.matched && birth.date_of_birth != null
@@ -49,4 +50,4 @@ services:
         format: dc+sd-jwt
         type: https://credentials.invalid/birth-attributes/v1
         validity: 10m
-        claims: [child-given-name, child-family-name, child-birth-date, child-place-of-birth]
+        claims: [child-given-name, child-family-name, child-birth-date, child-place-of-birth, parents]
diff --git a/crates/registryctl/tests/project_authoring.rs b/crates/registryctl/tests/project_authoring.rs
index b3592bbef3..7066ef27ef 100644
--- a/crates/registryctl/tests/project_authoring.rs
+++ b/crates/registryctl/tests/project_authoring.rs
@@ -5342,6 +5342,57 @@ fn integration_input_pattern_schema_matches_the_wire_limit() {
     assert!(schema.validate(&authored).is_err());
 }
 
+#[test]
+fn integration_output_schema_accepts_only_bounded_closed_recursive_shapes() {
+    let schema: serde_json::Value = serde_json::from_slice(
+        &std::fs::read(
+            Path::new(env!("CARGO_MANIFEST_DIR"))
+                .join("schemas/project-authoring/integration.schema.json"),
+        )
+        .expect("integration schema reads"),
+    )
+    .expect("integration schema parses");
+    let schema = jsonschema::JSONSchema::options()
+        .with_draft(jsonschema::Draft::Draft202012)
+        .compile(&schema)
+        .expect("integration schema compiles");
+    let authored: serde_norway::Value = serde_norway::from_slice(
+        &std::fs::read(golden("opencrvs").join("integrations/birth-record/integration.yaml"))
+            .expect("OpenCRVS integration reads"),
+    )
+    .expect("OpenCRVS integration parses");
+    let authored = serde_json::to_value(authored).expect("integration converts to JSON");
+    assert!(
+        schema.validate(&authored).is_ok(),
+        "bounded recursive output is public authoring"
+    );
+
+    let mut missing_item_ceiling = authored.clone();
+    missing_item_ceiling["outputs"]["parents"]
+        .as_object_mut()
+        .expect("parents schema")
+        .remove("max_items");
+    assert!(schema.validate(&missing_item_ceiling).is_err());
+
+    let mut open_object = authored.clone();
+    open_object["outputs"]["parents"]["items"]["additionalProperties"] =
+        serde_json::Value::Bool(true);
+    assert!(schema.validate(&open_object).is_err());
+
+    let mut empty_object = authored.clone();
+    empty_object["outputs"]["parents"]["items"]["fields"] = serde_json::json!({});
+    assert!(schema.validate(&empty_object).is_err());
+
+    let mut nested_source_pointer = authored.clone();
+    nested_source_pointer["outputs"]["parents"]["items"]["fields"]["name"]["schema"]
+        ["x-registry-source"] = serde_json::json!("/name");
+    assert!(schema.validate(&nested_source_pointer).is_err());
+
+    let mut excessive_array = authored;
+    excessive_array["outputs"]["parents"]["max_items"] = serde_json::json!(257);
+    assert!(schema.validate(&excessive_array).is_err());
+}
+
 #[test]
 fn exact_selector_authored_member_order_is_canonical() {
     let first_root = tempfile::tempdir().expect("first temporary directory");
@@ -5816,7 +5867,7 @@ fn check_and_build_produce_deterministic_product_inputs() {
     assert_eq!(first_closure, directory_closure(&output));
     assert_eq!(
         closure_digest(&first_closure),
-        "f9ca6af65849bfdeb6598e6fa3b0f83834a74845d5ff4f32be6418bdf66c5cde",
+        "99930e933a393918279331327af8677578f363b7693b4a0fc3eeb19f6f3df3fc",
         "project output, including its deterministic manifest, must match the cross-machine golden digest"
     );
 }
@@ -6826,6 +6877,26 @@ fn authored_oid4vci_binding_generates_the_complete_notary_owned_issuer() {
         "household-eligibility",
         "household_reference",
     );
+    let baseline_build = build_registry_project(&ProjectBuildOptions {
+        project_directory: project.clone(),
+        environment: "local".to_string(),
+        against: None,
+        anchor: None,
+    })
+    .expect("OID4VCI project without registrar clients remains compatible");
+    let baseline_output = resolve_build_output(
+        &project,
+        baseline_build.output.expect("baseline build output"),
+    );
+    let baseline_approval: serde_json::Value = serde_json::from_slice(
+        &std::fs::read(baseline_output.join("private/notary/approval/project-state.json"))
+            .expect("baseline approval state reads"),
+    )
+    .expect("baseline approval state parses");
+    merge_environment_yaml(
+        &project.join("environments/local.yaml"),
+        "oid4vci:\n  registrar_clients: [benefits-service]\n",
+    );
 
     let build = build_registry_project(&ProjectBuildOptions {
         project_directory: project.clone(),
@@ -6836,6 +6907,48 @@ fn authored_oid4vci_binding_generates_the_complete_notary_owned_issuer() {
     .expect("typed OID4VCI authority project builds through the production validator");
     let output = resolve_build_output(&project, build.output.expect("build output"));
     let notary = read_yaml(&output.join("private/notary/config/notary.yaml"));
+    let approval: serde_json::Value = serde_json::from_slice(
+        &std::fs::read(output.join("private/notary/approval/project-state.json"))
+            .expect("registrar approval state reads"),
+    )
+    .expect("registrar approval state parses");
+
+    assert_ne!(
+        baseline_approval["semantic_digests"]["operator_security"],
+        approval["semantic_digests"]["operator_security"],
+        "registrar trust must alter operator-security review semantics"
+    );
+    assert_eq!(
+        baseline_approval["semantic_digests"]["claim"], approval["semantic_digests"]["claim"],
+        "registrar trust must not alter claim semantics"
+    );
+    let baseline_trust = baseline_approval["promotion_projection"]["fields"]
+        .as_array()
+        .expect("baseline promotion fields are an array")
+        .iter()
+        .find(|field| field["kind"].as_str() == Some("trust"))
+        .expect("baseline trust promotion field exists");
+    let registrar_trust = approval["promotion_projection"]["fields"]
+        .as_array()
+        .expect("registrar promotion fields are an array")
+        .iter()
+        .find(|field| field["kind"].as_str() == Some("trust"))
+        .expect("registrar trust promotion field exists");
+    assert_ne!(
+        baseline_trust["digest"], registrar_trust["digest"],
+        "registrar clients must be projected as trust"
+    );
+    assert_eq!(
+        registrar_trust["authority_members"]
+            .as_array()
+            .expect("registrar trust authority members")
+            .len(),
+        baseline_trust["authority_members"]
+            .as_array()
+            .expect("baseline trust authority members")
+            .len()
+            + 1
+    );
 
     assert_eq!(
         notary["instance"]["public_base_url"].as_str(),
@@ -6854,6 +6967,23 @@ fn authored_oid4vci_binding_generates_the_complete_notary_owned_issuer() {
         notary["auth"]["oidc"]["issuer"].as_str(),
         Some("https://esignet.example.invalid")
     );
+    assert_eq!(
+        notary["auth"]["oidc"]["audiences"],
+        serde_norway::from_str::<serde_norway::Value>(
+            "[example-wallet-client, https://notary.example.invalid]"
+        )
+        .expect("OIDC audiences parse")
+    );
+    assert_eq!(
+        notary["auth"]["oidc"]["allowed_clients"],
+        serde_norway::from_str::<serde_norway::Value>("[example-wallet-client, benefits-service]")
+            .expect("OIDC clients parse")
+    );
+    assert_eq!(
+        notary["auth"]["oidc"]["allowed_token_types"],
+        serde_norway::from_str::<serde_norway::Value>("[JWT]")
+            .expect("OIDC access-token types parse")
+    );
     assert_eq!(
         notary["auth"]["access_token_signing"]["signing_key_id"].as_str(),
         Some("oid4vci-access-token")
@@ -6911,6 +7041,16 @@ fn authored_oid4vci_binding_generates_the_complete_notary_owned_issuer() {
         notary["subject_access"]["allowed_wallet_origins"][0].as_str(),
         Some("https://wallet.example.invalid")
     );
+    assert_eq!(
+        notary["subject_access"]["citizen_clients"]["allowed_client_ids"],
+        serde_norway::from_str::<serde_norway::Value>("[example-wallet-client]")
+            .expect("citizen client ids parse")
+    );
+    assert_eq!(
+        notary["subject_access"]["citizen_clients"]["allowed_audiences"],
+        serde_norway::from_str::<serde_norway::Value>("[example-wallet-client]")
+            .expect("citizen audiences parse")
+    );
     assert_eq!(
         notary["subject_access"]["allowed_operations"]["evaluate"].as_bool(),
         Some(false)
@@ -7034,6 +7174,21 @@ fn authored_oid4vci_binding_rejects_open_or_incoherent_trust_topologies() {
             "notary_state: null\n",
             "OID4VCI requires a Notary PostgreSQL state binding",
         ),
+        (
+            "invalid registrar client",
+            "oid4vci:\n  registrar_clients: ['']\n",
+            "OID4VCI registrar client id must not be empty",
+        ),
+        (
+            "duplicate registrar client",
+            "oid4vci:\n  registrar_clients: [registrar-a, registrar-a]\n",
+            "OID4VCI registrar_clients must not contain duplicates",
+        ),
+        (
+            "citizen client reused as registrar",
+            "oid4vci:\n  registrar_clients: [example-wallet-client]\n",
+            "OID4VCI registrar_clients must not contain the citizen client id",
+        ),
     ] {
         let temporary = tempfile::tempdir().expect("temporary directory");
         let project = copy_project("custom-system", temporary.path());
@@ -7063,6 +7218,37 @@ fn authored_oid4vci_binding_rejects_open_or_incoherent_trust_topologies() {
         assert_authoring_diagnostic(&error, "registryctl.authoring.environment.invalid");
     }
 
+    let temporary = tempfile::tempdir().expect("oversized registrar-client temporary directory");
+    let project = copy_project("custom-system", temporary.path());
+    let project_path = project.join("registry-stack.yaml");
+    let mut document = read_yaml(&project_path);
+    document["services"]["household-eligibility"]["credential_profiles"]["household-eligibility"]
+        ["claims"] = serde_norway::from_str("[household-record-exists]")
+        .expect("single registry-backed credential claim");
+    write_yaml(&project_path, &document);
+    author_oid4vci_binding(
+        &project,
+        "household-eligibility",
+        "household-eligibility",
+        "household_reference",
+    );
+    let registrar_clients = (0..65)
+        .map(|index| serde_norway::Value::String(format!("registrar-{index}")))
+        .collect::<Vec<_>>();
+    let environment_path = project.join("environments/local.yaml");
+    let mut environment = read_yaml(&environment_path);
+    environment["oid4vci"]["registrar_clients"] = serde_norway::Value::Sequence(registrar_clients);
+    write_yaml(&environment_path, &environment);
+    let error = check_registry_project(&ProjectCheckOptions {
+        project_directory: project,
+        environment: "local".to_string(),
+        explain: false,
+        against: None,
+        anchor: None,
+    })
+    .expect_err("oversized registrar-client trust must fail closed");
+    assert_authoring_diagnostic(&error, "registryctl.authoring.environment.invalid");
+
     for (name, scopes, expected) in [
         (
             "no access scope",
diff --git a/crates/registryctl/tests/project_authoring_schema_parity.rs b/crates/registryctl/tests/project_authoring_schema_parity.rs
index 6035fc0964..3de481b8c0 100644
--- a/crates/registryctl/tests/project_authoring_schema_parity.rs
+++ b/crates/registryctl/tests/project_authoring_schema_parity.rs
@@ -248,8 +248,8 @@ fn published_field_knowledge_is_complete_typed_reachable_and_editor_exact() {
         index.coverage_by_schema(),
         [
             (SchemaKind::Project, 220),
-            (SchemaKind::Environment, 198),
-            (SchemaKind::Integration, 142),
+            (SchemaKind::Environment, 200),
+            (SchemaKind::Integration, 166),
             (SchemaKind::Fixture, 62),
             (SchemaKind::Entity, 35),
         ]
@@ -261,11 +261,11 @@ fn published_field_knowledge_is_complete_typed_reachable_and_editor_exact() {
         index.coverage_by_path_kind(),
         [
             (FieldPathKind::Root, 5),
-            (FieldPathKind::Property, 461),
-            (FieldPathKind::MapKey, 25),
-            (FieldPathKind::MapValue, 32),
-            (FieldPathKind::ArrayItem, 33),
-            (FieldPathKind::Branch, 101),
+            (FieldPathKind::Property, 478),
+            (FieldPathKind::MapKey, 26),
+            (FieldPathKind::MapValue, 33),
+            (FieldPathKind::ArrayItem, 34),
+            (FieldPathKind::Branch, 107),
         ]
         .into_iter()
         .collect(),
@@ -275,11 +275,11 @@ fn published_field_knowledge_is_complete_typed_reachable_and_editor_exact() {
         index.coverage_by_sensitivity(),
         [
             (Sensitivity::Public, 6),
-            (Sensitivity::Internal, 414),
-            (Sensitivity::Sensitive, 67),
+            (Sensitivity::Internal, 432),
+            (Sensitivity::Sensitive, 69),
             (Sensitivity::SecretReference, 14),
             (Sensitivity::RedactedFixture, 50),
-            (Sensitivity::Structural, 106),
+            (Sensitivity::Structural, 112),
         ]
         .into_iter()
         .collect(),
@@ -287,12 +287,12 @@ fn published_field_knowledge_is_complete_typed_reachable_and_editor_exact() {
     );
     assert_eq!(
         index.by_path().len(),
-        657,
+        683,
         "the field-knowledge gate covers every published schema path"
     );
     assert_eq!(
         index.references().len(),
-        260,
+        272,
         "every published local reference remains resolved in the deterministic reference index"
     );
     assert_eq!(
@@ -788,8 +788,8 @@ fn exact_published_structural_contract_inventory_is_release_gated() {
             (
                 "environment",
                 PublishedStructuralInventory {
-                    nodes: 223,
-                    local_refs: 85,
+                    nodes: 225,
+                    local_refs: 86,
                     union_nodes: 6,
                     union_branches: 16,
                     conditionals: 7,
@@ -797,48 +797,48 @@ fn exact_published_structural_contract_inventory_is_release_gated() {
                     closed_objects: 36,
                     typed_maps: 4,
                     open_maps: 0,
-                    arrays: 5,
+                    arrays: 6,
                     scalar_types: 42,
                     nullable_nodes: 0,
                     integer_lower_bounds: 16,
                     integer_upper_bounds: 16,
                     string_length_bounds: 17,
                     string_patterns: 14,
-                    array_size_bounds: 5,
-                    unique_arrays: 5,
+                    array_size_bounds: 6,
+                    unique_arrays: 6,
                     object_size_bounds: 5,
                     property_name_constraints: 4,
                     enums: 2,
                     consts: 6,
-                    defaults: 2,
+                    defaults: 3,
                     deprecations: 0,
                 },
             ),
             (
                 "integration",
                 PublishedStructuralInventory {
-                    nodes: 165,
-                    local_refs: 35,
-                    union_nodes: 10,
-                    union_branches: 23,
+                    nodes: 195,
+                    local_refs: 46,
+                    union_nodes: 12,
+                    union_branches: 29,
                     conditionals: 0,
-                    objects: 33,
-                    closed_objects: 27,
-                    typed_maps: 6,
+                    objects: 38,
+                    closed_objects: 31,
+                    typed_maps: 7,
                     open_maps: 0,
                     arrays: 9,
-                    scalar_types: 50,
+                    scalar_types: 59,
                     nullable_nodes: 0,
-                    integer_lower_bounds: 16,
-                    integer_upper_bounds: 16,
+                    integer_lower_bounds: 22,
+                    integer_upper_bounds: 22,
                     string_length_bounds: 14,
                     string_patterns: 20,
                     array_size_bounds: 9,
                     unique_arrays: 8,
-                    object_size_bounds: 8,
-                    property_name_constraints: 3,
+                    object_size_bounds: 9,
+                    property_name_constraints: 4,
                     enums: 10,
-                    consts: 14,
+                    consts: 17,
                     defaults: 3,
                     deprecations: 0,
                 },
diff --git a/crates/registryctl/tests/project_documentation_reference.rs b/crates/registryctl/tests/project_documentation_reference.rs
index b30d5d8eb3..c866221bae 100644
--- a/crates/registryctl/tests/project_documentation_reference.rs
+++ b/crates/registryctl/tests/project_documentation_reference.rs
@@ -312,7 +312,7 @@ fn human_intent_sidecar_and_documentation_contracts_are_strict_schemas() {
     let intent_schema = compile_schema(&intent_schema_document);
     let intent = read_json(schema_root.join("project-authoring/documentation-intent.json"));
     assert_valid(&intent_schema, &intent, "documentation intent sidecar");
-    assert_eq!(intent["structural_reviews"].as_array().unwrap().len(), 191);
+    assert_eq!(intent["structural_reviews"].as_array().unwrap().len(), 200);
 
     for file in [
         "registry.project.configuration_reference.v1.schema.json",
@@ -437,17 +437,17 @@ fn embedded_coverage_is_complete_and_generates_the_canonical_reference() {
         CONFIGURATION_REFERENCE_COVERAGE_SCHEMA_ID
     );
     assert_eq!(coverage.coverage.schema_count, 7);
-    assert_eq!(coverage.coverage.path_count, 1771);
+    assert_eq!(coverage.coverage.path_count, 1803);
     assert_eq!(
         coverage.coverage.by_schema,
         [
             (ConfigurationSchemaKind::Project, 220),
-            (ConfigurationSchemaKind::Environment, 198),
-            (ConfigurationSchemaKind::Integration, 142),
+            (ConfigurationSchemaKind::Environment, 200),
+            (ConfigurationSchemaKind::Integration, 166),
             (ConfigurationSchemaKind::Fixture, 62),
             (ConfigurationSchemaKind::Entity, 35),
             (ConfigurationSchemaKind::Relay, 584),
-            (ConfigurationSchemaKind::Notary, 530),
+            (ConfigurationSchemaKind::Notary, 536),
         ]
         .into_iter()
         .collect()
@@ -456,22 +456,22 @@ fn embedded_coverage_is_complete_and_generates_the_canonical_reference() {
         coverage.coverage.by_path_kind,
         [
             (FieldPathKind::Root, 7),
-            (FieldPathKind::Property, 1_413),
-            (FieldPathKind::MapKey, 25),
-            (FieldPathKind::MapValue, 47),
-            (FieldPathKind::ArrayItem, 178),
-            (FieldPathKind::Branch, 101),
+            (FieldPathKind::Property, 1_435),
+            (FieldPathKind::MapKey, 26),
+            (FieldPathKind::MapValue, 49),
+            (FieldPathKind::ArrayItem, 179),
+            (FieldPathKind::Branch, 107),
         ]
         .into_iter()
         .collect(),
         "the exact reviewed structural taxonomy remains release-gated"
     );
-    assert_eq!(coverage.reviewed_intent_assignment_required_count, 1771);
+    assert_eq!(coverage.reviewed_intent_assignment_required_count, 1803);
     assert_eq!(
         coverage.reviewed_intent_assignment_covered_count + coverage.missing_intent.len(),
         coverage.reviewed_intent_assignment_required_count
     );
-    assert_eq!(coverage.reviewed_intent_assignment_covered_count, 1771);
+    assert_eq!(coverage.reviewed_intent_assignment_covered_count, 1803);
     assert!(
         coverage.distinct_reviewed_intent_count < coverage.reviewed_intent_assignment_covered_count,
         "assignment coverage must not imply one unique explanation per path"
@@ -488,12 +488,12 @@ fn embedded_coverage_is_complete_and_generates_the_canonical_reference() {
             coverage.distinct_reviewed_intents_reused_count,
             coverage.reviewed_intent_assignments_using_reused_intent_count,
         ),
-        (596, 82, 1_257),
+        (617, 86, 1_272),
         "the exact intent-text reuse baseline must change intentionally with reviewed documentation"
     );
     assert_eq!(
         coverage.coverage.by_intent_profile.values().sum::<usize>(),
-        1114,
+        1120,
         "every Relay and Notary path, including both roots, records its exact reviewed profile"
     );
     assert_eq!(
@@ -636,7 +636,7 @@ fn embedded_coverage_is_complete_and_generates_the_canonical_reference() {
                 })
                 .count(),
         ),
-        (523, 307, 0, 941),
+        (523, 309, 0, 971),
         "the exact empty-string semantic coverage prevents constrained strings from regressing to allowed"
     );
     assert_eq!(
@@ -654,7 +654,7 @@ fn embedded_coverage_is_complete_and_generates_the_canonical_reference() {
                     })
             })
             .count(),
-        208,
+        209,
         "schema semantics must retain rejections that the former minLength-only heuristic missed"
     );
     let intent_counts =
diff --git a/docs/site/public/generated/configuration-reference-coverage.v1.json b/docs/site/public/generated/configuration-reference-coverage.v1.json
index cf418b0ab1..03e7ce4f51 100644
--- a/docs/site/public/generated/configuration-reference-coverage.v1.json
+++ b/docs/site/public/generated/configuration-reference-coverage.v1.json
@@ -39,38 +39,38 @@
   },
   "coverage": {
     "schema_count": 7,
-    "path_count": 1771,
-    "reference_count": 485,
+    "path_count": 1803,
+    "reference_count": 500,
     "by_schema": {
       "project": 220,
-      "environment": 198,
-      "integration": 142,
+      "environment": 200,
+      "integration": 166,
       "fixture": 62,
       "entity": 35,
       "relay": 584,
-      "notary": 530
+      "notary": 536
     },
     "by_path_kind": {
       "root": 7,
-      "property": 1413,
-      "map_key": 25,
-      "map_value": 47,
-      "array_item": 178,
-      "branch": 101
+      "property": 1435,
+      "map_key": 26,
+      "map_value": 49,
+      "array_item": 179,
+      "branch": 107
     },
     "by_sensitivity": {
       "public": 16,
-      "internal": 1145,
-      "sensitive": 399,
+      "internal": 1168,
+      "sensitive": 401,
       "secret_reference": 41,
       "redacted_fixture": 50,
-      "structural": 120
+      "structural": 127
     },
     "by_intent_source": {
-      "schema_description": 504,
-      "reviewed_override": 248,
+      "schema_description": 517,
+      "reviewed_override": 261,
       "structural_taxonomy": 127,
-      "reviewed_profile": 892
+      "reviewed_profile": 898
     },
     "by_intent_profile": {
       "notary_audit_internal": 4,
@@ -88,10 +88,11 @@
       "notary_deployment_sensitive": 1,
       "notary_evidence_claims_evidence_mode_consultations_inputs_open_map": 1,
       "notary_evidence_claims_evidence_mode_consultations_open_map": 1,
+      "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map": 1,
       "notary_evidence_claims_evidence_mode_consultations_outputs_open_map": 1,
       "notary_evidence_claims_rule_bindings_claims_open_map": 1,
       "notary_evidence_credential_profiles_open_map": 1,
-      "notary_evidence_internal": 92,
+      "notary_evidence_internal": 97,
       "notary_evidence_secret_reference": 5,
       "notary_evidence_sensitive": 40,
       "notary_evidence_signing_keys_open_map": 1,
@@ -148,10 +149,10 @@
       "relay_vocabularies_open_map": 1
     }
   },
-  "reviewed_intent_assignment_required_count": 1771,
-  "reviewed_intent_assignment_covered_count": 1771,
-  "distinct_reviewed_intent_count": 596,
-  "distinct_reviewed_intents_reused_count": 82,
-  "reviewed_intent_assignments_using_reused_intent_count": 1257,
+  "reviewed_intent_assignment_required_count": 1803,
+  "reviewed_intent_assignment_covered_count": 1803,
+  "distinct_reviewed_intent_count": 617,
+  "distinct_reviewed_intents_reused_count": 86,
+  "reviewed_intent_assignments_using_reused_intent_count": 1272,
   "missing_intent": []
 }
diff --git a/docs/site/public/generated/configuration-reference.v1.json b/docs/site/public/generated/configuration-reference.v1.json
index 2fbaac6eab..c412120452 100644
--- a/docs/site/public/generated/configuration-reference.v1.json
+++ b/docs/site/public/generated/configuration-reference.v1.json
@@ -38,38 +38,38 @@
   },
   "coverage": {
     "schema_count": 7,
-    "path_count": 1771,
-    "reference_count": 485,
+    "path_count": 1803,
+    "reference_count": 500,
     "by_schema": {
       "project": 220,
-      "environment": 198,
-      "integration": 142,
+      "environment": 200,
+      "integration": 166,
       "fixture": 62,
       "entity": 35,
       "relay": 584,
-      "notary": 530
+      "notary": 536
     },
     "by_path_kind": {
       "root": 7,
-      "property": 1413,
-      "map_key": 25,
-      "map_value": 47,
-      "array_item": 178,
-      "branch": 101
+      "property": 1435,
+      "map_key": 26,
+      "map_value": 49,
+      "array_item": 179,
+      "branch": 107
     },
     "by_sensitivity": {
       "public": 16,
-      "internal": 1145,
-      "sensitive": 399,
+      "internal": 1168,
+      "sensitive": 401,
       "secret_reference": 41,
       "redacted_fixture": 50,
-      "structural": 120
+      "structural": 127
     },
     "by_intent_source": {
-      "schema_description": 504,
-      "reviewed_override": 248,
+      "schema_description": 517,
+      "reviewed_override": 261,
       "structural_taxonomy": 127,
-      "reviewed_profile": 892
+      "reviewed_profile": 898
     },
     "by_intent_profile": {
       "notary_audit_internal": 4,
@@ -87,10 +87,11 @@
       "notary_deployment_sensitive": 1,
       "notary_evidence_claims_evidence_mode_consultations_inputs_open_map": 1,
       "notary_evidence_claims_evidence_mode_consultations_open_map": 1,
+      "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map": 1,
       "notary_evidence_claims_evidence_mode_consultations_outputs_open_map": 1,
       "notary_evidence_claims_rule_bindings_claims_open_map": 1,
       "notary_evidence_credential_profiles_open_map": 1,
-      "notary_evidence_internal": 92,
+      "notary_evidence_internal": 97,
       "notary_evidence_secret_reference": 5,
       "notary_evidence_sensitive": 40,
       "notary_evidence_signing_keys_open_map": 1,
@@ -26234,29 +26235,29 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/sensitive_state_key",
+        "pointer": "/$defs/oid4vci/properties/registrar_clients",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose": "Closed OIDC machine-client allow-list for registrar-created credential offers. Each client uses this authorization server and the Notary public base URL as its resource audience; citizen client classification remains separate.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "schema_value": []
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -26311,124 +26312,28 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxItems",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/subject",
-        "path_kind": "property"
-      },
-      "purpose": "Verified eSignet userinfo claim bound exactly to the credential subject identifier.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "token_claim",
-            "id_type"
-          ]
+          "value": "array"
         },
         {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/subject/properties/id_type",
-        "path_kind": "property"
+        "pointer": "/$defs/oid4vci/properties/registrar_clients/items",
+        "path_kind": "array_item"
       },
       "purpose": "Bounded visible-ASCII protocol token.",
       "purpose_source": "schema_description",
@@ -26442,14 +26347,14 @@
         "local_reference": "#/$defs/token256",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -26503,7 +26408,9 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -26531,29 +26438,29 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/subject/properties/token_claim",
+        "pointer": "/$defs/oid4vci/properties/sensitive_state_key",
         "path_kind": "property"
       },
-      "purpose": "Bounded visible-ASCII protocol token.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token256",
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "secret_reference",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -26607,38 +26514,33 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
+          "keyword": "required",
+          "value": [
+            "secret"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/token256"
+        "pointer": "/$defs/secret"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/tx_code",
+        "pointer": "/$defs/oid4vci/properties/subject",
         "path_kind": "property"
       },
-      "purpose": "Transaction-code policy. Omit for the secure required-PIN default. Set required=false only for a bounded bearer-offer interoperability profile; the compiler fixes the offer lifetime at 300 seconds.",
+      "purpose": "Verified eSignet userinfo claim bound exactly to the credential subject identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -26649,7 +26551,7 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -26713,6 +26615,13 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "token_claim",
+            "id_type"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
@@ -26722,26 +26631,26 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/tx_code/properties/required",
+        "pointer": "/$defs/oid4vci/properties/subject/properties/id_type",
         "path_kind": "property"
       },
-      "purpose": "States whether OID4VCI authorization requires a transaction code before credential issuance.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded visible-ASCII protocol token.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/token256",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": true
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
@@ -26801,20 +26710,36 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[!-~]+$"
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/token256"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/privateCidrs/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/oid4vci/properties/subject/properties/token_claim",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Bounded visible-ASCII protocol token.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -26822,16 +26747,17 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/token256",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -26885,33 +26811,39 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 64
+          "value": 256
         },
         {
           "keyword": "minLength",
-          "value": 3
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[!-~]+$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/token256"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/oid4vci/properties/tx_code",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Transaction-code policy. Omit for the secure required-PIN default. Set required=false only for a bounded bearer-offer interoperability profile; the compiler fixes the offer lifetime at 300 seconds.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -26921,14 +26853,14 @@
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -26982,17 +26914,9 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type",
-            "path"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -27002,17 +26926,17 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/delimiter",
+        "pointer": "/$defs/oid4vci/properties/tx_code/properties/required",
         "path_kind": "property"
       },
-      "purpose": "Selects the byte used to delimit fields in the bound CSV source.",
+      "purpose": "States whether OID4VCI authorization requires a transaction code before credential issuance.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -27020,7 +26944,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "schema_value": true
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
@@ -27080,45 +27005,37 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/header_row",
-        "path_kind": "property"
+        "pointer": "/$defs/privateCidrs/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Selects the one-based CSV row containing source column headers.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -27172,49 +27089,50 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
+          "keyword": "maxLength",
+          "value": 64
         },
         {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "minLength",
+          "value": 3
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/path",
-        "path_kind": "property"
+        "pointer": "/$defs/provider/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -27269,38 +27187,29 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "required",
+          "value": [
+            "type",
+            "path"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/absolutePath"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/quote",
+        "pointer": "/$defs/provider/oneOf/0/properties/delimiter",
         "path_kind": "property"
       },
-      "purpose": "Selects the byte used to quote fields in the bound CSV source.",
+      "purpose": "Selects the byte used to delimit fields in the bound CSV source.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -27392,19 +27301,21 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/type",
+        "pointer": "/$defs/provider/oneOf/0/properties/header_row",
         "path_kind": "property"
       },
-      "purpose": "Selects CSV as the environment-owned materialization provider for an authored entity.",
+      "purpose": "Selects the one-based CSV row containing source column headers.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -27469,116 +27380,27 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "csv"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
+          "keyword": "maximum",
+          "value": 4294967295
+        },
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "project_file",
-            "path",
-            "sheet"
-          ]
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/data_range",
+        "pointer": "/$defs/provider/oneOf/0/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Restricts entity materialization to the reviewed range within the selected worksheet.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -27586,16 +27408,17 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -27649,30 +27472,39 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 256
+          "value": 4096
         },
         {
           "keyword": "minLength",
-          "value": 1
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/absolutePath"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/header_row",
+        "pointer": "/$defs/provider/oneOf/0/properties/quote",
         "path_kind": "property"
       },
-      "purpose": "Selects the one-based XLSX row containing source column headers.",
+      "purpose": "Selects the byte used to quote fields in the bound CSV source.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -27749,11 +27581,11 @@
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 4294967295
+          "value": 255
         },
         {
           "keyword": "minimum",
-          "value": 1
+          "value": 0
         },
         {
           "keyword": "type",
@@ -27764,29 +27596,26 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/path",
+        "pointer": "/$defs/provider/oneOf/0/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects CSV as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/absolutePath",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -27840,58 +27669,40 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "csv"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/absolutePath"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/project_file",
-        "path_kind": "property"
+        "pointer": "/$defs/provider/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Binds a contained project-relative workbook for offline preflight and read-only runtime mounting without emitting the authoring path into Relay configuration.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -27946,38 +27757,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "required",
+          "value": [
+            "type",
+            "project_file",
+            "path",
+            "sheet"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relativePath"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/sheet",
+        "pointer": "/$defs/provider/oneOf/1/properties/data_range",
         "path_kind": "property"
       },
-      "purpose": "Names the worksheet read from the environment-owned XLSX source.",
+      "purpose": "Restricts entity materialization to the reviewed range within the selected worksheet.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -27988,7 +27792,7 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -28069,19 +27873,21 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/type",
+        "pointer": "/$defs/provider/oneOf/1/properties/header_row",
         "path_kind": "property"
       },
-      "purpose": "Selects XLSX as the environment-owned materialization provider for an authored entity.",
+      "purpose": "Selects the one-based XLSX row containing source column headers.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -28146,36 +27952,45 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "xlsx"
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/2",
-        "path_kind": "branch"
+        "pointer": "/$defs/provider/oneOf/1/properties/path",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -28230,30 +28045,39 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "path"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/absolutePath"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/2/properties/path",
+        "pointer": "/$defs/provider/oneOf/1/properties/project_file",
         "path_kind": "property"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Binds a contained project-relative workbook for offline preflight and read-only runtime mounting without emitting the authoring path into Relay configuration.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -28261,7 +28085,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/absolutePath",
+        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
       "requiredness": "required",
@@ -28335,11 +28159,11 @@
         },
         {
           "keyword": "minLength",
-          "value": 2
+          "value": 1
         },
         {
           "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
@@ -28348,16 +28172,111 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/absolutePath"
+        "pointer": "/$defs/relativePath"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/2/properties/type",
+        "pointer": "/$defs/provider/oneOf/1/properties/sheet",
         "path_kind": "property"
       },
-      "purpose": "Selects Parquet as the environment-owned materialization provider for an authored entity.",
+      "purpose": "Names the worksheet read from the environment-owned XLSX source.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/$defs/provider/oneOf/1/properties/type",
+        "path_kind": "property"
+      },
+      "purpose": "Selects XLSX as the environment-owned materialization provider for an authored entity.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -28432,14 +28351,14 @@
       "constraints": [
         {
           "keyword": "const",
-          "value": "parquet"
+          "value": "xlsx"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3",
+        "pointer": "/$defs/provider/oneOf/2",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
@@ -28522,9 +28441,7 @@
           "keyword": "required",
           "value": [
             "type",
-            "connection",
-            "schema",
-            "table"
+            "path"
           ]
         },
         {
@@ -28536,29 +28453,29 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/connection",
+        "pointer": "/$defs/provider/oneOf/2/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/secret",
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -28613,46 +28530,49 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/secret"
+        "pointer": "/$defs/absolutePath"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/schema",
+        "pointer": "/$defs/provider/oneOf/2/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects Parquet as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/postgresIdentifier",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -28715,45 +28635,134 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,62}$"
+          "keyword": "const",
+          "value": "parquet"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/$defs/provider/oneOf/3",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "type",
+            "connection",
+            "schema",
+            "table"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/postgresIdentifier"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/table",
+        "pointer": "/$defs/provider/oneOf/3/properties/connection",
         "path_kind": "property"
       },
-      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/postgresIdentifier",
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "secret_reference",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -28807,41 +28816,47 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,62}$"
+          "keyword": "required",
+          "value": [
+            "secret"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/postgresIdentifier"
+        "pointer": "/$defs/secret"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/type",
+        "pointer": "/$defs/provider/oneOf/3/properties/schema",
         "path_kind": "property"
       },
-      "purpose": "Selects PostgreSQL as the environment-owned materialization provider for an authored entity.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/postgresIdentifier",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -28904,18 +28919,26 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "postgres"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,62}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/postgresIdentifier"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/relayOrigin/anyOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/provider/oneOf/3/properties/table",
+        "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
+      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -28924,17 +28947,17 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/origin",
+        "local_reference": "#/$defs/postgresIdentifier",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -28988,17 +29011,12 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uri"
-        },
         {
           "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+          "value": "^[a-z][a-z0-9_]{0,62}$"
         },
         {
           "keyword": "type",
@@ -29007,35 +29025,120 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/origin"
+        "pointer": "/$defs/postgresIdentifier"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/relayOrigin/anyOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/provider/oneOf/3/properties/type",
+        "path_kind": "property"
       },
-      "purpose": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects PostgreSQL as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/localLoopbackOrigin",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "postgres"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/$defs/relayOrigin/anyOf/0",
+        "path_kind": "branch"
+      },
+      "purpose": "HTTPS origin without path, query, or fragment.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/origin",
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -29099,7 +29202,7 @@
         },
         {
           "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$"
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
         },
         {
           "keyword": "type",
@@ -29108,16 +29211,16 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/localLoopbackOrigin"
+        "pointer": "/$defs/origin"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/relayResource/anyOf/0",
+        "pointer": "/$defs/relayOrigin/anyOf/1",
         "path_kind": "branch"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
+      "purpose": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -29126,7 +29229,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/httpsResource",
+        "local_reference": "#/$defs/localLoopbackOrigin",
         "composed": false
       },
       "requiredness": "conditional",
@@ -29200,7 +29303,7 @@
         },
         {
           "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
+          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$"
         },
         {
           "keyword": "type",
@@ -29209,16 +29312,16 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/httpsResource"
+        "pointer": "/$defs/localLoopbackOrigin"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/relayResource/anyOf/1",
+        "pointer": "/$defs/relayResource/anyOf/0",
         "path_kind": "branch"
       },
-      "purpose": "HTTP IP-loopback resource accepted only with the local deployment profile.",
+      "purpose": "Exact HTTPS resource without query or fragment.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -29227,7 +29330,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/localLoopbackResource",
+        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
       "requiredness": "conditional",
@@ -29301,7 +29404,7 @@
         },
         {
           "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/[^?#]+$"
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
         },
         {
           "keyword": "type",
@@ -29310,17 +29413,17 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/localLoopbackResource"
+        "pointer": "/$defs/httpsResource"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/secret/properties/secret",
-        "path_kind": "property"
+        "pointer": "/$defs/relayResource/anyOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Names the operator-managed environment secret reference without containing the secret value.",
-      "purpose_source": "reviewed_override",
+      "purpose": "HTTP IP-loopback resource accepted only with the local deployment profile.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -29328,16 +29431,17 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/localLoopbackResource",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -29392,27 +29496,35 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uri"
+        },
         {
           "keyword": "pattern",
-          "value": "^[A-Z_][A-Z0-9_]{0,127}$"
+          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/[^?#]+$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/localLoopbackResource"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/service/properties/service",
+        "pointer": "/$defs/secret/properties/secret",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Names the operator-managed environment secret reference without containing the secret value.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -29420,7 +29532,6 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -29430,7 +29541,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "secret_reference",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -29484,49 +29595,46 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[A-Z_][A-Z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/source/properties/allowed_private_cidrs",
+        "pointer": "/$defs/service/properties/service",
         "path_kind": "property"
       },
-      "purpose": "Explicit private network ranges this source may resolve to.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/privateCidrs",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -29580,44 +29688,39 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/privateCidrs"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/source/properties/ca",
+        "pointer": "/$defs/source/properties/allowed_private_cidrs",
         "path_kind": "property"
       },
-      "purpose": "Pinned certificate-authority file and its rotation generation.",
+      "purpose": "Explicit private network ranges this source may resolve to.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/ca",
+        "local_reference": "#/$defs/privateCidrs",
         "composed": false
       },
       "requiredness": "optional",
@@ -29627,7 +29730,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -29681,41 +29784,44 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "file",
-            "generation"
-          ]
+          "keyword": "maxItems",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/ca"
+        "pointer": "/$defs/privateCidrs"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/source/properties/concurrency",
+        "pointer": "/$defs/source/properties/ca",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of requests that may be in flight concurrently for this source.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Pinned certificate-authority file and its rotation generation.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/ca",
         "composed": false
       },
       "requiredness": "optional",
@@ -29783,35 +29889,133 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 64
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "file",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/ca"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/source/properties/credential",
+        "pointer": "/$defs/source/properties/concurrency",
         "path_kind": "property"
       },
-      "purpose": "One supported source credential shape, containing references rather than values.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the number of requests that may be in flight concurrently for this source.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/credential",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 64
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/$defs/source/properties/credential",
+        "path_kind": "property"
+      },
+      "purpose": "One supported source credential shape, containing references rather than values.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/credential",
         "composed": false
       },
       "requiredness": "optional",
@@ -47034,26 +47238,29 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/output/properties/format",
-        "path_kind": "property"
+        "pointer": "/$defs/output/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Applies the full-date semantic format to a string-valued integration output.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Type, scalar bounds, and optional source pointer for one normalized scalar integration output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/scalarOutput",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -47109,40 +47316,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "date"
+          "keyword": "required",
+          "value": [
+            "type"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutput"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/output/properties/maxLength",
-        "path_kind": "property"
+        "pointer": "/$defs/output/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Caps the character length produced for a string-valued integration output.",
-      "purpose_source": "reviewed_override",
+      "purpose": "A recursively typed object output with a canonical byte ceiling and an always-closed field map.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/outputObject",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -47198,48 +47417,55 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 16384
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "type",
+            "nullable",
+            "max_bytes",
+            "fields"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputObject"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/output/properties/maximum",
-        "path_kind": "property"
+        "pointer": "/$defs/output/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Sets the inclusive upper bound produced for an integer-valued integration output.",
-      "purpose_source": "reviewed_override",
+      "purpose": "A recursively typed array output with canonical byte and item-count ceilings.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/outputArray",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -47295,41 +47521,47 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
+          "keyword": "required",
+          "value": [
+            "type",
+            "nullable",
+            "max_bytes",
+            "max_items",
+            "items"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputArray"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/output/properties/minimum",
+        "pointer": "/$defs/outputArray/properties/items",
         "path_kind": "property"
       },
-      "purpose": "Sets the inclusive lower bound produced for an integer-valued integration output.",
-      "purpose_source": "reviewed_override",
+      "purpose": "A recursively closed structured output schema without a source pointer.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
+        "local_reference": "#/$defs/outputSchema",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -47394,37 +47626,27 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/output/properties/type",
+        "pointer": "/$defs/outputArray/properties/max_bytes",
         "path_kind": "property"
       },
-      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the canonical serialized size of one structured output array.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
-        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
       "requiredness": "required",
@@ -47492,32 +47714,41 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType"
-      }
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/output/properties/x-registry-source",
+        "pointer": "/$defs/outputArray/properties/max_items",
         "path_kind": "property"
       },
-      "purpose": "Selects the canonical source-response location from which the HTTP output is extracted.",
+      "purpose": "Caps the number of values released in one structured output array.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -47582,33 +47813,37 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
+          "keyword": "maximum",
+          "value": 256
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci",
+        "pointer": "/$defs/outputArray/properties/nullable",
         "path_kind": "property"
       },
-      "purpose": "Enables the bounded signed DCI search helper and declares its protocol and selector bindings.",
+      "purpose": "Declares whether the complete structured output array may be null.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -47674,33 +47909,19 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "profile",
-            "path",
-            "jwks_profile",
-            "sender",
-            "receiver",
-            "registry_type",
-            "record_type",
-            "locale",
-            "selectors"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/jwks_profile",
+        "pointer": "/$defs/outputArray/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Selects the supported RSA signing-key-set profile used to verify signed DCI responses.",
+      "purpose": "Selects the array form for a structured integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -47777,30 +47998,30 @@
       "constraints": [
         {
           "keyword": "const",
-          "value": "rsa-signing-jwks-v1"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/locale",
+        "pointer": "/$defs/outputObject/properties/fields",
         "path_kind": "property"
       },
-      "purpose": "Declares the language or locale tag carried by signed DCI search requests.",
+      "purpose": "Declares the bounded closed map of fields released in one structured output object.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -47865,40 +48086,45 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$"
+          "keyword": "maxProperties",
+          "value": 32
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/path",
-        "path_kind": "property"
+        "pointer": "/$defs/outputObject/properties/fields/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Declares the exact private source path used for signed DCI search requests.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Requiredness and recursive schema for one named field of a closed structured output object.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/outputObjectField",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -47955,37 +48181,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^/[^?#]*$"
+          "keyword": "required",
+          "value": [
+            "required",
+            "schema"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputObjectField"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/profile",
-        "path_kind": "property"
+        "pointer": "/$defs/outputObject/properties/fields/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Selects the supported DCI search request profile used by the signed protocol helper.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -48046,35 +48282,44 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "dci-search-v1"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/receiver",
+        "pointer": "/$defs/outputObject/properties/max_bytes",
         "path_kind": "property"
       },
-      "purpose": "Declares the signed DCI receiver identifier included in protocol requests.",
+      "purpose": "Caps the canonical serialized size of one structured output object.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -48139,39 +48384,39 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
+          "keyword": "maximum",
+          "value": 65536
         },
         {
-          "keyword": "minLength",
+          "keyword": "minimum",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/record_type",
+        "pointer": "/$defs/outputObject/properties/nullable",
         "path_kind": "property"
       },
-      "purpose": "Declares the record type requested through the signed DCI search profile.",
+      "purpose": "Declares whether the complete structured output object may be null.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -48235,40 +48480,30 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/registry_type",
+        "pointer": "/$defs/outputObject/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Declares the registry type requested through the signed DCI search profile.",
+      "purpose": "Selects the closed object form for a structured integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -48333,33 +48568,25 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors",
+        "pointer": "/$defs/outputObjectField/properties/required",
         "path_kind": "property"
       },
-      "purpose": "Maps every selector input to its signed DCI request field and response location.",
+      "purpose": "Declares whether a named field must be present in every released structured output object.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
@@ -48429,38 +48656,29 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 8
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/outputObjectField/properties/schema",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "A recursively closed structured output schema without a source pointer.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
+        "local_reference": "#/$defs/outputSchema",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -48523,48 +48741,40 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "response_pointer"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/field",
-        "path_kind": "property"
+        "pointer": "/$defs/outputSchema/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Declares the signed DCI identifier field bound to one selector input.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Type and bounds for a scalar nested inside a structured output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/scalarOutputSchema",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -48620,48 +48830,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 160
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "type"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutputSchema"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/response_pointer",
-        "path_kind": "property"
+        "pointer": "/$defs/outputSchema/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Selects the canonical signed-record response location used to recover one selector value.",
-      "purpose_source": "reviewed_override",
+      "purpose": "A recursively typed object output with a canonical byte ceiling and an always-closed field map.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/outputObject",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -48717,45 +48931,55 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
+          "keyword": "required",
+          "value": [
+            "type",
+            "nullable",
+            "max_bytes",
+            "fields"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputObject"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/outputSchema/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose": "A recursively typed array output with canonical byte and item-count ceilings.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/inputName",
+        "local_reference": "#/$defs/outputArray",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -48812,43 +49036,49 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "keyword": "required",
+          "value": [
+            "type",
+            "nullable",
+            "max_bytes",
+            "max_items",
+            "items"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/inputName"
+        "pointer": "/$defs/outputArray"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/sender",
+        "pointer": "/$defs/protocol/properties/signed_dci",
         "path_kind": "property"
       },
-      "purpose": "Declares the signed DCI sender identifier included in protocol requests.",
+      "purpose": "Enables the bounded signed DCI search helper and declares its protocol and selector bindings.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -48913,27 +49143,33 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "profile",
+            "path",
+            "jwks_profile",
+            "sender",
+            "receiver",
+            "registry_type",
+            "record_type",
+            "locale",
+            "selectors"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/jwks_profile",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Selects the supported RSA signing-key-set profile used to verify signed DCI responses.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -48941,14 +49177,14 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -49004,45 +49240,40 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
+          "keyword": "const",
+          "value": "rsa-signing-jwks-v1"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/locale",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Declares the language or locale tag carried by signed DCI search requests.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -49098,36 +49329,121 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 2
-        },
-        {
-          "keyword": "minItems",
-          "value": 2
+          "keyword": "pattern",
+          "value": "^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$"
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/path",
+        "path_kind": "property"
+      },
+      "purpose": "Declares the exact private source path used for signed DCI search requests.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^/[^?#]*$"
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
-        "path_kind": "array_item"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/profile",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Selects the supported DCI search request profile used by the signed protocol helper.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -49135,7 +49451,7 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -49198,38 +49514,35 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
+          "keyword": "const",
+          "value": "dci-search-v1"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
-        "path_kind": "array_item"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/receiver",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Declares the signed DCI receiver identifier included in protocol requests.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49290,36 +49603,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "null"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/allow",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/record_type",
         "path_kind": "property"
       },
-      "purpose": "Constrains source access to the explicitly reviewed method and path templates in this integration contract.",
+      "purpose": "Declares the record type requested through the signed DCI search profile.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49384,40 +49704,39 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "maxLength",
+          "value": 128
         },
         {
-          "keyword": "minItems",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/allow/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/registry_type",
+        "path_kind": "property"
       },
-      "purpose": "One read-only upstream method and path pattern the adapter may call.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares the registry type requested through the signed DCI search profile.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/allowRule",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49478,34 +49797,30 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "method",
-            "path"
-          ]
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/allowRule"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/auth",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors",
         "path_kind": "property"
       },
-      "purpose": "Declares the credential interface the source contract permits without embedding an environment credential value.",
+      "purpose": "Maps every selector input to its signed DCI request field and response location.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -49514,7 +49829,6 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/credential",
         "composed": false
       },
       "requiredness": "required",
@@ -49582,32 +49896,41 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/credential"
-      }
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 8
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/product",
-        "path_kind": "property"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Names the source product whose version labels are classified by this integration contract.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49668,44 +49991,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "field",
+            "response_pointer"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/protocol",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/field",
         "path_kind": "property"
       },
-      "purpose": "Optional interoperable protocol profiles layered over the source transport.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares the signed DCI identifier field bound to one selector input.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/protocol",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49770,39 +50092,39 @@
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
+          "keyword": "maxLength",
+          "value": 160
+        },
+        {
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/request_headers",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/response_pointer",
         "path_kind": "property"
       },
-      "purpose": "Lists the bounded source request header names available to the integration adapter.",
+      "purpose": "Selects the canonical signed-record response location used to recover one selector value.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49867,27 +50189,23 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 32
+          "keyword": "pattern",
+          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/request_headers/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -49895,6 +50213,7 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -49961,39 +50280,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/response",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/sender",
         "path_kind": "property"
       },
-      "purpose": "Defines the reviewed source response representation and optional byte bound.",
+      "purpose": "Declares the signed DCI sender identifier included in protocol requests.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -50057,19 +50380,27 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/response/properties/format",
+        "pointer": "/$defs/scalarOutput/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Selects JSON decoding or text handling for reviewed source responses.",
+      "purpose": "Applies the full-date semantic format to a string-valued integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -50145,39 +50476,33 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "json",
-            "text"
-          ]
+          "keyword": "const",
+          "value": "date"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/response/properties/max_bytes",
+        "pointer": "/$defs/scalarOutput/properties/maxLength",
         "path_kind": "property"
       },
-      "purpose": "Maximum bytes accepted from one source response, defaulting to 512 KiB and capped at 8 MiB. Use a positive byte integer or canonical KiB/MiB value.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the character length produced for a string-valued integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/integrationResponseByteSize",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": "512KiB"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
@@ -50238,26 +50563,35 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationResponseByteSize"
-      }
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 16384
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/response_headers",
+        "pointer": "/$defs/scalarOutput/properties/maximum",
         "path_kind": "property"
       },
-      "purpose": "Lists the bounded source response header names available to the integration adapter.",
+      "purpose": "Sets the inclusive upper bound produced for an integer-valued integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -50328,39 +50662,39 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 32
+          "keyword": "maximum",
+          "value": 9223372036854775807
         },
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/response_headers/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/scalarOutput/properties/minimum",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Sets the inclusive lower bound produced for an integer-valued integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -50421,39 +50755,42 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/versions",
+        "pointer": "/$defs/scalarOutput/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Source versions tested by the project and versions explicitly accepted as unverified.",
+      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/versions",
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50518,25 +50855,20 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
+      "constraints": [],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/versions"
+        "pointer": "/$defs/scalarType"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/versionList/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/scalarOutput/properties/x-registry-source",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Selects the canonical source-response location from which the HTTP output is extracted.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -50546,7 +50878,7 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -50609,17 +50941,12 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
         },
         {
           "keyword": "type",
@@ -50630,11 +50957,11 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/scalarOutputSchema/properties/format",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Applies the full-date semantic format to a string-valued field inside a structured integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -50642,14 +50969,14 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -50705,34 +51032,33 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "tested"
-          ]
+          "keyword": "const",
+          "value": "date"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/0/properties/tested",
+        "pointer": "/$defs/scalarOutputSchema/properties/maxLength",
         "path_kind": "property"
       },
-      "purpose": "Requires at least one source product version to be classified as tested in this integration contract.",
+      "purpose": "Caps the character length produced for a string-valued field inside a structured integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50799,117 +51125,37 @@
       ],
       "constraints": [
         {
-          "keyword": "minItems",
+          "keyword": "maximum",
+          "value": 16384
+        },
+        {
+          "keyword": "minimum",
           "value": 1
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
+        },
         {
-          "keyword": "required",
-          "value": [
-            "unverified"
-          ]
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/1/properties/unverified",
+        "pointer": "/$defs/scalarOutputSchema/properties/maximum",
         "path_kind": "property"
       },
-      "purpose": "Requires at least one source product version to be classified as unverified in this integration contract.",
+      "purpose": "Sets the inclusive upper bound produced for an integer-valued field inside a structured integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50976,27 +51222,34 @@
       ],
       "constraints": [
         {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/versions/properties/tested",
+        "pointer": "/$defs/scalarOutputSchema/properties/minimum",
         "path_kind": "property"
       },
-      "purpose": "Bounded list of source version labels.",
-      "purpose_source": "schema_description",
+      "purpose": "Sets the inclusive lower bound produced for an integer-valued field inside a structured integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
-        "local_reference": "#/$defs/versionList",
         "composed": false
       },
       "requiredness": "optional",
@@ -51066,30 +51319,26 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 32
+          "keyword": "maximum",
+          "value": 9223372036854775807
         },
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/versionList"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/versions/properties/unverified",
+        "pointer": "/$defs/scalarOutputSchema/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Bounded list of source version labels.",
+      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -51098,10 +51347,10 @@
         "schema_types": [
           "array"
         ],
-        "local_reference": "#/$defs/versionList",
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -51166,51 +51415,35 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ],
+      "constraints": [],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/versionList"
+        "pointer": "/$defs/scalarType"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/capability",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Exactly one bounded execution mechanism for the source adaptation.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/capability",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -51266,40 +51499,45 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/capability"
-      }
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/id",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Stable project-local identifier for the integration.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -51355,41 +51593,44 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxItems",
+          "value": 2
+        },
+        {
+          "keyword": "minItems",
+          "value": 2
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/input",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
+        "path_kind": "array_item"
       },
-      "purpose": "Typed selector and parameter inputs accepted by this integration.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -51452,39 +51693,33 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/input/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
+        "path_kind": "array_item"
       },
-      "purpose": "Type, validation, and canonicalization rules for one authored input.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/input",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -51551,47 +51786,35 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "role",
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "null"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/input"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/input/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/source/properties/allow",
+        "path_kind": "property"
       },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
+      "purpose": "Constrains source access to the explicitly reviewed method and path templates in this integration contract.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -51652,31 +51875,30 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "keyword": "maxItems",
+          "value": 16
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/limits",
-        "path_kind": "property"
+        "pointer": "/$defs/source/properties/allow/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Optional tighter resource limits for one integration execution.",
+      "purpose": "One read-only upstream method and path pattern the adapter may call.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -51685,10 +51907,10 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/limits",
+        "local_reference": "#/$defs/allowRule",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -51751,9 +51973,17 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "method",
+            "path"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
@@ -51761,17 +51991,17 @@
       ],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/limits"
+        "pointer": "/$defs/allowRule"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/not_applicable",
+        "pointer": "/$defs/source/properties/auth",
         "path_kind": "property"
       },
-      "purpose": "Explicit rationale and request-fixture evidence for a normally required outcome that the source contract cannot produce.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares the credential interface the source contract permits without embedding an environment credential value.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -51779,10 +52009,10 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/notApplicable",
+        "local_reference": "#/$defs/credential",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -51847,42 +52077,32 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
+      "constraints": [],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/notApplicable"
+        "pointer": "/$defs/credential"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs",
+        "pointer": "/$defs/source/properties/product",
         "path_kind": "property"
       },
-      "purpose": "Named typed outputs, or a shorthand list of output names inferred by the authoring compiler.",
-      "purpose_source": "schema_description",
+      "purpose": "Names the source product whose version labels are classified by this integration contract.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -51945,16 +52165,29 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/protocol",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Optional interoperable protocol profiles layered over the source transport.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -51962,16 +52195,17 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/protocol",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -52027,14 +52261,9 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
         {
           "keyword": "minProperties",
           "value": 1
@@ -52043,27 +52272,30 @@
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/protocol"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/source/properties/request_headers",
+        "path_kind": "property"
       },
-      "purpose": "Type and optional source pointer for one normalized integration output.",
-      "purpose_source": "schema_description",
+      "purpose": "Lists the bounded source request header names available to the integration adapter.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/output",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -52126,44 +52358,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
+          "keyword": "maxItems",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/output"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/source/properties/request_headers/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
-        "composed": true
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -52225,36 +52456,44 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/response",
+        "path_kind": "property"
       },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the reviewed source response representation and optional byte bound.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -52310,32 +52549,23 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/response/properties/format",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Selects JSON decoding or text handling for reviewed source responses.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -52343,14 +52573,14 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -52406,34 +52636,46 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "json",
+            "text"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1/not",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/response/properties/max_bytes",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Maximum bytes accepted from one source response, defaulting to 512 KiB and capped at 8 MiB. Use a positive byte integer or canonical KiB/MiB value.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer",
+          "string"
+        ],
+        "local_reference": "#/$defs/integrationResponseByteSize",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "schema_value": "512KiB"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -52489,27 +52731,22 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "matched",
-            "outcome"
-          ]
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/integrationResponseByteSize"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/response_headers",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lists the bounded source response header names available to the integration adapter.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -52519,14 +52756,14 @@
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -52582,17 +52819,12 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "maxItems",
-          "value": 64
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
+          "value": 32
         },
         {
           "keyword": "type",
@@ -52607,11 +52839,11 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/1/items",
+        "pointer": "/$defs/source/properties/response_headers/items",
         "path_kind": "array_item"
       },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -52619,7 +52851,6 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/inputName",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -52691,36 +52922,2287 @@
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/revision",
+        "pointer": "/$defs/source/properties/versions",
         "path_kind": "property"
       },
-      "purpose": "Monotonically increasing revision of this integration contract.",
+      "purpose": "Source versions tested by the project and versions explicitly accepted as unverified.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/versions",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/versions"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versionList/items",
+        "path_kind": "array_item"
+      },
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versions/anyOf/0",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "tested"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versions/anyOf/0/properties/tested",
+        "path_kind": "property"
+      },
+      "purpose": "Requires at least one source product version to be classified as tested in this integration contract.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "minItems",
+          "value": 1
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versions/anyOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "unverified"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versions/anyOf/1/properties/unverified",
+        "path_kind": "property"
+      },
+      "purpose": "Requires at least one source product version to be classified as unverified in this integration contract.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "minItems",
+          "value": 1
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versions/properties/tested",
+        "path_kind": "property"
+      },
+      "purpose": "Bounded list of source version labels.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "local_reference": "#/$defs/versionList",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxItems",
+          "value": 32
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/versionList"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versions/properties/unverified",
+        "path_kind": "property"
+      },
+      "purpose": "Bounded list of source version labels.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "local_reference": "#/$defs/versionList",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxItems",
+          "value": 32
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/versionList"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/capability",
+        "path_kind": "property"
+      },
+      "purpose": "Exactly one bounded execution mechanism for the source adaptation.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/capability",
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/capability"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/id",
+        "path_kind": "property"
+      },
+      "purpose": "Stable project-local identifier for the integration.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/stableId"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/input",
+        "path_kind": "property"
+      },
+      "purpose": "Typed selector and parameter inputs accepted by this integration.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 16
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/input/additionalProperties",
+        "path_kind": "map_value"
+      },
+      "purpose": "Type, validation, and canonicalization rules for one authored input.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/input",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "role",
+            "type"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/input"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/input/propertyNames",
+        "path_kind": "map_key"
+      },
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/inputName",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/limits",
+        "path_kind": "property"
+      },
+      "purpose": "Optional tighter resource limits for one integration execution.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/limits",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/limits"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/not_applicable",
+        "path_kind": "property"
+      },
+      "purpose": "Explicit rationale and request-fixture evidence for a normally required outcome that the source contract cannot produce.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/notApplicable",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "minProperties",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/notApplicable"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs",
+        "path_kind": "property"
+      },
+      "purpose": "Named typed outputs, or a shorthand list of output names inferred by the authoring compiler.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "array",
+          "object"
+        ],
+        "composed": true
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": []
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/0",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 64
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/0/additionalProperties",
+        "path_kind": "map_value"
+      },
+      "purpose": "A bounded scalar or recursively closed structured schema for one normalized integration output.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "local_reference": "#/$defs/output",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/output"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/0/propertyNames",
+        "path_kind": "map_key"
+      },
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": true
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
+      "constraints": []
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/0",
+        "path_kind": "branch"
+      },
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/inputName",
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": []
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1/not",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "matched",
+            "outcome"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxItems",
+          "value": 64
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/1/items",
+        "path_kind": "array_item"
+      },
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/inputName",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/revision",
+        "path_kind": "property"
+      },
+      "purpose": "Monotonically increasing revision of this integration contract.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "integer"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -53557,21 +56039,416 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 8
+        },
+        {
+          "keyword": "pattern",
+          "value": "^bodies/(?!\\.\\.?/)(?!.*(?:/)\\.\\.?/)(?!.*//).+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody/oneOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "fixture_execution"
+      ],
+      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "consumers": [
+        "registryctl_authoring",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "privacy",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": []
+    },
+    {
+      "address": {
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody/oneOf/1/not",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "fixture_execution"
+      ],
+      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "consumers": [
+        "registryctl_authoring",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "privacy",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "file"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedClaimRef/oneOf/0",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "fixture_execution"
+      ],
+      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "consumers": [
+        "registryctl_authoring",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "privacy",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedClaimRef/oneOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "fixture_execution"
+      ],
+      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "consumers": [
+        "registryctl_authoring",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "privacy",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 8
+          "keyword": "required",
+          "value": [
+            "id"
+          ]
         },
         {
-          "keyword": "pattern",
-          "value": "^bodies/(?!\\.\\.?/)(?!.*(?:/)\\.\\.?/)(?!.*//).+$"
-        },
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedClaimRef/oneOf/1/properties/id",
+        "path_kind": "property"
+      },
+      "purpose": "Names one authored claim requested by this fixture witness.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "fixture_execution"
+      ],
+      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "consumers": [
+        "registryctl_authoring",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "privacy",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
+      ],
+      "constraints": [
         {
           "keyword": "type",
           "value": "string"
@@ -53581,26 +56458,28 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/fixtureBody/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/governedClaimRef/oneOf/1/properties/version",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Pins the requested claim to one authored claim-policy version.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -53645,35 +56524,40 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/fixtureBody/oneOf/1/not",
-        "path_kind": "branch"
+        "pointer": "/$defs/governedIdentifier/properties/scheme",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Names the authored identifier scheme selected by a consultation input mapping.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -53718,29 +56602,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "file"
-          ]
+          "keyword": "maxLength",
+          "value": 96
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/governedIdentifier/properties/value",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Supplies the synthetic string value bound to this identifier scheme.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -53750,14 +56636,14 @@
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -53802,7 +56688,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
@@ -53814,28 +56700,28 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/governedRequest/properties/claims",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lists the authored claims evaluated by this synthetic request witness.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -53880,39 +56766,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
+          "keyword": "maxItems",
+          "value": 64
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/1/properties/id",
-        "path_kind": "property"
+        "pointer": "/$defs/governedRequest/properties/claims/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Names one authored claim requested by this fixture witness.",
+      "purpose": "A requested claim ID, optionally pinned to one authored claim version.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
+          "object",
           "string"
         ],
+        "local_reference": "#/$defs/governedClaimRef",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
@@ -53964,22 +56854,22 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "array_items_share_element_contract"
       ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedClaimRef"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/1/properties/version",
+        "pointer": "/$defs/governedRequest/properties/disclosure",
         "path_kind": "property"
       },
-      "purpose": "Pins the requested claim to one authored claim-policy version.",
+      "purpose": "Selects the disclosure mode requested from the authored claim policy.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
@@ -54054,10 +56944,10 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedIdentifier/properties/scheme",
+        "pointer": "/$defs/governedRequest/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Names the authored identifier scheme selected by a consultation input mapping.",
+      "purpose": "Selects the claim-result media type requested from the governed Notary path.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
@@ -54068,9 +56958,9 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54123,14 +57013,6 @@
         "synthetic_fixture_value_redacted"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 96
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -54140,10 +57022,10 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedIdentifier/properties/value",
+        "pointer": "/$defs/governedRequest/properties/purpose",
         "path_kind": "property"
       },
-      "purpose": "Supplies the synthetic string value bound to this identifier scheme.",
+      "purpose": "Names the authored service purpose exercised by this synthetic request witness.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
@@ -54156,7 +57038,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54209,6 +57091,14 @@
         "synthetic_fixture_value_redacted"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -54218,18 +57108,19 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/claims",
+        "pointer": "/$defs/governedRequest/properties/target",
         "path_kind": "property"
       },
-      "purpose": "Lists the authored claims evaluated by this synthetic request witness.",
+      "purpose": "The synthetic subject target presented to the same governed request boundary as a live Notary evaluation.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/governedTarget",
         "composed": false
       },
       "requiredness": "required",
@@ -54288,41 +57179,41 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 64
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "type"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedTarget"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/claims/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/governedRequest/properties/variables",
+        "path_kind": "property"
       },
-      "purpose": "A requested claim ID, optionally pinned to one authored claim version.",
+      "purpose": "Supplies synthetic date variables to the governed evaluation request.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object",
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/governedClaimRef",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54372,23 +57263,27 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef"
-      }
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 16
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/disclosure",
-        "path_kind": "property"
+        "pointer": "/$defs/governedRequest/properties/variables/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Selects the disclosure mode requested from the authored claim policy.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -54398,7 +57293,7 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
@@ -54450,9 +57345,14 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "date"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -54462,23 +57362,21 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/format",
-        "path_kind": "property"
+        "pointer": "/$defs/governedRequest/properties/variables/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Selects the claim-result media type requested from the governed Notary path.",
-      "purpose_source": "schema_description",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54528,35 +57426,36 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/purpose",
+        "pointer": "/$defs/governedTarget/properties/attributes",
         "path_kind": "property"
       },
-      "purpose": "Names the authored service purpose exercised by this synthetic request witness.",
+      "purpose": "Supplies independently authored typed target attributes for consultation input mapping.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54610,40 +57509,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/target",
-        "path_kind": "property"
+        "pointer": "/$defs/governedTarget/properties/attributes/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "The synthetic subject target presented to the same governed request boundary as a live Notary evaluation.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean",
+          "integer",
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/governedTarget",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54693,45 +57590,41 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "type"
+            "string",
+            "boolean",
+            "integer",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget"
-      }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/variables",
+        "pointer": "/$defs/governedTarget/properties/id",
         "path_kind": "property"
       },
-      "purpose": "Supplies synthetic date variables to the governed evaluation request.",
+      "purpose": "Supplies an optional synthetic direct target identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54784,36 +57677,32 @@
         "synthetic_fixture_value_redacted"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 16
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/variables/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/governedTarget/properties/identifiers",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Supplies independently authored synthetic identifiers for consultation input mapping.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54863,33 +57752,35 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "date"
+          "keyword": "maxItems",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/variables/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/governedTarget/properties/identifiers/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "One synthetic target identifier with an authored scheme and string value.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/governedIdentifier",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -54945,35 +57836,46 @@
         "knowledge_only",
         "generated_docs_never_load_country_values",
         "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "scheme",
+            "value"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedIdentifier"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/attributes",
+        "pointer": "/$defs/governedTarget/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Supplies independently authored typed target attributes for consultation input mapping.",
+      "purpose": "Names the authored target entity type used for claim evaluation.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55027,38 +57929,40 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "maxLength",
+          "value": 64
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/attributes/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/interaction/properties/expect",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Exact HTTP request shape the adapter must produce.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "boolean",
-          "integer",
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/request",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55108,41 +58012,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
+            "method",
+            "path"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/request"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/id",
+        "pointer": "/$defs/interaction/properties/respond",
         "path_kind": "property"
       },
-      "purpose": "Supplies an optional synthetic direct target identifier.",
+      "purpose": "Synthetic HTTP response or timeout returned to the adapter.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/response",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55194,28 +58104,28 @@
         "generated_docs_never_load_country_values",
         "synthetic_fixture_value_redacted"
       ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/response"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/identifiers",
+        "pointer": "/$defs/request/properties/body",
         "path_kind": "property"
       },
-      "purpose": "Supplies independently authored synthetic identifiers for consultation input mapping.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the synthetic request body expectation or fixture-local file reference without reading a source.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/fixtureBody",
         "composed": false
       },
       "requiredness": "optional",
@@ -55272,25 +58182,20 @@
         "generated_docs_never_load_country_values",
         "synthetic_fixture_value_redacted"
       ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/identifiers/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/request/properties/headers",
+        "path_kind": "property"
       },
-      "purpose": "One synthetic target identifier with an authored scheme and string value.",
-      "purpose_source": "schema_description",
+      "purpose": "States the synthetic request headers expected from one offline fixture interaction.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -55298,10 +58203,9 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/governedIdentifier",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -55353,35 +58257,27 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "scheme",
-            "value"
-          ]
+          "keyword": "maxProperties",
+          "value": 32
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedIdentifier"
-      }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/type",
-        "path_kind": "property"
+        "pointer": "/$defs/request/properties/headers/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Names the authored target entity type used for claim evaluation.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -55391,9 +58287,9 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55443,16 +58339,13 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 64
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "value": 8192
         },
         {
           "keyword": "type",
@@ -55463,22 +58356,19 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/interaction/properties/expect",
-        "path_kind": "property"
+        "pointer": "/$defs/request/properties/headers/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Exact HTTP request shape the adapter must produce.",
-      "purpose_source": "schema_description",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/request",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -55530,123 +58420,32 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "method",
-            "path"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "pattern",
+          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
         }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/request"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/interaction/properties/respond",
-        "path_kind": "property"
-      },
-      "purpose": "Synthetic HTTP response or timeout returned to the adapter.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/response",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/response"
-      }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/body",
+        "pointer": "/$defs/request/properties/method",
         "path_kind": "property"
       },
-      "purpose": "Defines the synthetic request body expectation or fixture-local file reference without reading a source.",
+      "purpose": "States the synthetic request method expected from the offline integration fixture.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/fixtureBody",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -55700,32 +58499,36 @@
         "generated_docs_never_load_country_values",
         "synthetic_fixture_value_redacted"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody"
-      }
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "GET",
+            "POST"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/headers",
+        "pointer": "/$defs/request/properties/path",
         "path_kind": "property"
       },
-      "purpose": "States the synthetic request headers expected from one offline fixture interaction.",
+      "purpose": "States the synthetic request path expected from the offline integration fixture.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55779,35 +58582,43 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/[^?#]*$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/headers/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/request/properties/query",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "States the synthetic query parameters expected from one offline fixture interaction.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55857,38 +58668,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 8192
+          "keyword": "maxProperties",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/headers/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/request/properties/query/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
-        "composed": false
+        "schema_types": [
+          "array",
+          "boolean",
+          "integer",
+          "null",
+          "string"
+        ],
+        "composed": true
       },
       "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55941,36 +58757,36 @@
         "synthetic_fixture_value_redacted",
         "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/method",
-        "path_kind": "property"
+        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "States the synthetic request method expected from the offline integration fixture.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "boolean",
+          "integer",
+          "null",
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56015,14 +58831,16 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "GET",
-            "POST"
+            "string",
+            "boolean",
+            "integer",
+            "null"
           ]
         }
       ]
@@ -56030,28 +58848,28 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/path",
-        "path_kind": "property"
+        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "States the synthetic request path expected from the offline integration fixture.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56096,47 +58914,42 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/[^?#]*$"
+          "keyword": "maxItems",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/query",
-        "path_kind": "property"
+        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1/items",
+        "path_kind": "array_item"
       },
-      "purpose": "States the synthetic query parameters expected from one offline fixture interaction.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean",
+          "integer",
+          "null",
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -56186,48 +58999,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "boolean",
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/response/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "array",
-          "boolean",
-          "integer",
-          "null",
-          "string"
+          "object"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56272,39 +59083,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "status"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/response/oneOf/0/properties/body",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Defines the synthetic response body returned by the offline fixture harness to the integration.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "boolean",
-          "integer",
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/fixtureBody",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56349,45 +59168,39 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/response/oneOf/0/properties/headers",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Defines the synthetic HTTP response headers returned by the offline fixture harness.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56432,41 +59245,38 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 64
+          "keyword": "maxProperties",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/response/oneOf/0/properties/headers/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "boolean",
-          "integer",
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "not_applicable",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
@@ -56518,45 +59328,44 @@
         "knowledge_only",
         "generated_docs_never_load_country_values",
         "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 8192
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/response/oneOf/0/properties/status",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Selects the synthetic HTTP status returned by the offline fixture harness.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56601,29 +59410,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "status"
-          ]
+          "keyword": "maximum",
+          "value": 599
+        },
+        {
+          "keyword": "minimum",
+          "value": 100
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/body",
-        "path_kind": "property"
+        "pointer": "/$defs/response/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Defines the synthetic response body returned by the offline fixture harness to the integration.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -56631,17 +59442,16 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/fixtureBody",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56686,34 +59496,41 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody"
-      }
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "timeout"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/headers",
+        "pointer": "/$defs/response/oneOf/1/properties/timeout",
         "path_kind": "property"
       },
-      "purpose": "Defines the synthetic HTTP response headers returned by the offline fixture harness.",
+      "purpose": "Records bounded synthetic timeout intent; offline execution returns the timeout outcome without waiting for the authored interval.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -56767,40 +59584,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/headers/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/properties/classification",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Declares that fixture data is synthetic and safe for offline testing.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56844,36 +59659,31 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 8192
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "synthetic"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/status",
+        "pointer": "/properties/expect",
         "path_kind": "property"
       },
-      "purpose": "Selects the synthetic HTTP status returned by the offline fixture harness.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Observable adapter result required for the scenario to pass.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/expectation",
         "composed": false
       },
       "requiredness": "required",
@@ -56932,27 +59742,27 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 599
-        },
-        {
-          "keyword": "minimum",
-          "value": 100
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/expectation"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/properties/input",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Typed consultation inputs supplied to the adapter under test.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -56962,14 +59772,14 @@
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -57014,14 +59824,16 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "timeout"
-          ]
+          "keyword": "maxProperties",
+          "value": 16
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -57032,23 +59844,26 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/1/properties/timeout",
-        "path_kind": "property"
+        "pointer": "/properties/input/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Records bounded synthetic timeout intent; offline execution returns the timeout outcome without waiting for the authored interval.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
+          "boolean",
+          "integer",
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -57098,27 +59913,29 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "boolean",
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/classification",
-        "path_kind": "property"
+        "pointer": "/properties/input/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Declares that fixture data is synthetic and safe for offline testing.",
-      "purpose_source": "schema_description",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -57126,14 +59943,14 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "public",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -57177,31 +59994,32 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "synthetic"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/expect",
+        "pointer": "/properties/interactions",
         "path_kind": "property"
       },
-      "purpose": "Observable adapter result required for the scenario to pass.",
+      "purpose": "Ordered upstream request and response exchanges expected during execution.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/expectation",
         "composed": false
       },
       "requiredness": "required",
@@ -57260,26 +60078,26 @@
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
+          "keyword": "maxItems",
+          "value": 16
+        },
+        {
+          "keyword": "minItems",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/expectation"
-      }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/input",
-        "path_kind": "property"
+        "pointer": "/properties/interactions/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Typed consultation inputs supplied to the adapter under test.",
+      "purpose": "One expected upstream request paired with its synthetic response.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
@@ -57288,9 +60106,10 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/interaction",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -57342,133 +60161,52 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "expect",
+            "respond"
+          ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/interaction"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/input/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/properties/name",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Human-readable scenario name shown in test output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "boolean",
-          "integer",
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/input/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
@@ -57488,7 +60226,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "update_fixtures",
@@ -57512,35 +60250,42 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/interactions",
+        "pointer": "/properties/request",
         "path_kind": "property"
       },
-      "purpose": "Ordered upstream request and response exchanges expected during execution.",
+      "purpose": "Optional independently authored synthetic Notary request used to prove the request-to-consultation binding before Relay access.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/governedRequest",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -57596,26 +60341,30 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "target",
+            "claims",
+            "purpose"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedRequest"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/interactions/items",
-        "path_kind": "array_item"
+        "pointer": "/properties/variables",
+        "path_kind": "property"
       },
-      "purpose": "One expected upstream request paired with its synthetic response.",
+      "purpose": "Named date values available to deterministic fixture interpolation.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
@@ -57624,10 +60373,9 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/interaction",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -57679,35 +60427,27 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "expect",
-            "respond"
-          ]
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/interaction"
-      }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/name",
-        "path_kind": "property"
+        "pointer": "/properties/variables/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Human-readable scenario name shown in test output.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -57717,14 +60457,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "public",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -57744,7 +60484,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": true,
+        "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "update_fixtures",
@@ -57768,16 +60508,14 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "format",
+          "value": "date"
         },
         {
           "keyword": "type",
@@ -57788,22 +60526,19 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/request",
-        "path_kind": "property"
+        "pointer": "/properties/variables/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Optional independently authored synthetic Notary request used to prove the request-to-consultation binding before Relay access.",
-      "purpose_source": "schema_description",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/governedRequest",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -57855,55 +60590,45 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "target",
-            "claims",
-            "purpose"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "fixture",
-        "pointer": "/properties/variables",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "",
+        "path_kind": "root"
       },
-      "purpose": "Named date values available to deterministic fixture interpolation.",
+      "purpose": "Defines a bounded, materialized entity that Relay can query without coupling the project to a specific source product.",
       "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
+        "relay",
         "editor",
         "docs"
       ],
@@ -57912,45 +60637,54 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "fixture_execution"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
+        "registry_relay",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "fixture_report",
+        "project_build",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
         "privacy",
+        "relay",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "required",
+          "value": [
+            "version",
+            "id",
+            "revision",
+            "primary_key",
+            "schema",
+            "materialization"
+          ]
         },
         {
           "keyword": "type",
@@ -57960,32 +60694,31 @@
     },
     {
       "address": {
-        "schema": "fixture",
-        "pointer": "/properties/variables/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/const",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "purpose": "Requires one entity field to equal the single authored value supplied by this schema constraint.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
+        "relay",
         "editor",
         "docs"
       ],
@@ -57994,79 +60727,74 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "fixture_execution"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
+        "registry_relay",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "fixture_report",
+        "project_build",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
         "privacy",
+        "relay",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "date"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "fixture",
-        "pointer": "/properties/variables/propertyNames",
-        "path_kind": "map_key"
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/enum",
+        "path_kind": "property"
       },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "purpose": "Restricts one entity field to the unique authored values listed by this schema constraint.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "array"
+        ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
+        "relay",
         "editor",
         "docs"
       ],
@@ -58075,74 +60803,81 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "fixture_execution"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
+        "registry_relay",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "fixture_report",
+        "project_build",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
         "privacy",
+        "relay",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "minItems",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "",
-        "path_kind": "root"
+        "pointer": "/$defs/fieldSchema/properties/format",
+        "path_kind": "property"
       },
-      "purpose": "Defines a bounded, materialized entity that Relay can query without coupling the project to a specific source product.",
-      "purpose_source": "schema_description",
+      "purpose": "Adds a reviewed semantic format constraint to one string-valued entity field.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -58164,7 +60899,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
+        "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
@@ -58194,35 +60929,26 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "version",
-            "id",
-            "revision",
-            "primary_key",
-            "schema",
-            "materialization"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "date"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/const",
+        "pointer": "/$defs/fieldSchema/properties/maxLength",
         "path_kind": "property"
       },
-      "purpose": "Requires one entity field to equal the single authored value supplied by this schema constraint.",
+      "purpose": "Caps the character length accepted for one string-valued entity field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "optional",
@@ -58282,22 +61008,35 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/enum",
+        "pointer": "/$defs/fieldSchema/properties/maximum",
         "path_kind": "property"
       },
-      "purpose": "Restricts one entity field to the unique authored values listed by this schema constraint.",
+      "purpose": "Sets the inclusive upper numeric bound accepted for one entity field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -58360,32 +61099,34 @@
       ],
       "constraints": [
         {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "maximum",
+          "value": 9007199254740991
         },
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "minimum",
+          "value": -9007199254740991
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/format",
+        "pointer": "/$defs/fieldSchema/properties/minLength",
         "path_kind": "property"
       },
-      "purpose": "Adds a reviewed semantic format constraint to one string-valued entity field.",
+      "purpose": "Sets the minimum character length accepted for one string-valued entity field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "optional",
@@ -58447,18 +61188,26 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "date"
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/maxLength",
+        "pointer": "/$defs/fieldSchema/properties/minimum",
         "path_kind": "property"
       },
-      "purpose": "Caps the character length accepted for one string-valued entity field.",
+      "purpose": "Sets the inclusive lower numeric bound accepted for one entity field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
@@ -58529,11 +61278,11 @@
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 65536
+          "value": 9007199254740991
         },
         {
           "keyword": "minimum",
-          "value": 1
+          "value": -9007199254740991
         },
         {
           "keyword": "type",
@@ -58544,23 +61293,23 @@
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/maximum",
+        "pointer": "/$defs/fieldSchema/properties/pattern",
         "path_kind": "property"
       },
-      "purpose": "Sets the inclusive upper numeric bound accepted for one entity field.",
+      "purpose": "Constrains a string-valued entity field with the authored regular expression.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -58617,37 +61366,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 9007199254740991
+          "keyword": "maxLength",
+          "value": 1024
         },
         {
-          "keyword": "minimum",
-          "value": -9007199254740991
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/minLength",
+        "pointer": "/$defs/fieldSchema/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Sets the minimum character length accepted for one string-valued entity field.",
+      "purpose": "Declares the closed scalar, array, or object type accepted for one entity field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -58704,39 +61454,28 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/scalarType"
+      }
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/minimum",
+        "pointer": "/$defs/objectSchema/properties/additionalProperties",
         "path_kind": "property"
       },
-      "purpose": "Sets the inclusive lower numeric bound accepted for one entity field.",
+      "purpose": "Controls whether the entity object accepts fields outside its declared closed property set.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -58795,39 +61534,31 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 9007199254740991
-        },
-        {
-          "keyword": "minimum",
-          "value": -9007199254740991
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
+          "keyword": "const",
+          "value": false
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/pattern",
+        "pointer": "/$defs/objectSchema/properties/properties",
         "path_kind": "property"
       },
-      "purpose": "Constrains a string-valued entity field with the authored regular expression.",
+      "purpose": "Maps every declared entity property name to its closed field schema.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -58884,38 +61615,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 1024
+          "keyword": "maxProperties",
+          "value": 256
         },
         {
-          "keyword": "minLength",
+          "keyword": "minProperties",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/type",
+        "pointer": "/$defs/objectSchema/properties/properties/additionalProperties",
         "path_kind": "property"
       },
-      "purpose": "Declares the closed scalar, array, or object type accepted for one entity field.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded schema keywords supported for one scalar materialized field.",
+      "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
-        "local_reference": "#/$defs/scalarType",
+        "local_reference": "#/$defs/fieldSchema",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -58972,30 +61703,44 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "type"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
       "local_reference": {
         "schema": "entity",
-        "pointer": "/$defs/scalarType"
+        "pointer": "/$defs/fieldSchema"
       }
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/additionalProperties",
+        "pointer": "/$defs/objectSchema/properties/properties/propertyNames",
         "path_kind": "property"
       },
-      "purpose": "Controls whether the entity object accepts fields outside its declared closed property set.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable lowercase record field name.",
+      "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/propertyName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -59052,25 +61797,33 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": false
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/propertyName"
+      }
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/properties",
+        "pointer": "/$defs/objectSchema/properties/required",
         "path_kind": "property"
       },
-      "purpose": "Maps every declared entity property name to its closed field schema.",
+      "purpose": "Lists the entity properties that every validated materialized record must contain.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -59133,38 +61886,130 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
+          "keyword": "maxItems",
           "value": 256
         },
         {
-          "keyword": "minProperties",
+          "keyword": "minItems",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/properties/additionalProperties",
-        "path_kind": "property"
+        "pointer": "/$defs/objectSchema/properties/required/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Bounded schema keywords supported for one scalar materialized field.",
+      "purpose": "Portable lowercase record field name.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/fieldSchema",
+        "local_reference": "#/$defs/propertyName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.entity.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/propertyName"
+      }
+    },
+    {
+      "address": {
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/type",
+        "path_kind": "property"
+      },
+      "purpose": "Declares the materialized entity record schema as an object.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -59223,47 +62068,34 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
+          "keyword": "const",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema"
-      }
+      ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/properties/propertyNames",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Portable lowercase record field name.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/propertyName",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -59311,31 +62143,28 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/propertyName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/required",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Lists the entity properties that every validated materialized record must contain.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
@@ -59345,14 +62174,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -59400,16 +62229,17 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "maxItems",
-          "value": 256
+          "value": 2
         },
         {
           "keyword": "minItems",
-          "value": 1
+          "value": 2
         },
         {
           "keyword": "type",
@@ -59424,24 +62254,21 @@
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/required/items",
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
         "path_kind": "array_item"
       },
-      "purpose": "Portable lowercase record field name.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/propertyName",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -59499,27 +62326,23 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/propertyName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/type",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
+        "path_kind": "array_item"
       },
-      "purpose": "Declares the materialized entity record schema as an object.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
@@ -59527,7 +62350,7 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -59582,38 +62405,42 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "const",
-          "value": "object"
+          "value": "null"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/properties/id",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Stable project-local identifier for the entity.",
+      "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -59661,45 +62488,48 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/properties/materialization",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Authored resource, refresh, and bounded recovery-set retention applied while building entity generations.",
+      "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -59747,46 +62577,45 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 2
-        },
-        {
-          "keyword": "minItems",
-          "value": 2
+          "keyword": "required",
+          "value": [
+            "max_records",
+            "max_bytes",
+            "refresh",
+            "retain_generations"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
-        "path_kind": "array_item"
+        "pointer": "/properties/materialization/properties/max_bytes",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Maximum encoded size of one generation, up to 1 GiB, as bytes or a KiB/MiB quantity.",
+      "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
-        "composed": false
+        "schema_types": [
+          "integer",
+          "string"
+        ],
+        "composed": true
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -59813,7 +62642,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
@@ -59839,43 +62668,35 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
-        "path_kind": "array_item"
+        "pointer": "/properties/materialization/properties/max_bytes/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -59924,23 +62745,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "null"
+          "keyword": "maximum",
+          "value": 1073741824
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/id",
-        "path_kind": "property"
+        "pointer": "/properties/materialization/properties/max_bytes/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Stable project-local identifier for the entity.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
@@ -59948,17 +62777,16 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -60006,37 +62834,34 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^(?:(?:[1-9][0-9]{0,5}|10[0-3][0-9]{4}|104[0-7][0-9]{3}|1048[0-4][0-9]{2}|10485[0-6][0-9]|104857[0-6])KiB|(?:[1-9][0-9]{0,2}|10[0-1][0-9]|102[0-4])MiB)$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization",
+        "pointer": "/properties/materialization/properties/max_records",
         "path_kind": "property"
       },
-      "purpose": "Authored resource, refresh, and bounded recovery-set retention applied while building entity generations.",
+      "purpose": "Maximum number of records allowed in one generation.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
@@ -60069,7 +62894,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
@@ -60099,34 +62924,32 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "max_records",
-            "max_bytes",
-            "refresh",
-            "retain_generations"
-          ]
+          "keyword": "maximum",
+          "value": 100000000
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_bytes",
+        "pointer": "/properties/materialization/properties/refresh",
         "path_kind": "property"
       },
-      "purpose": "Maximum encoded size of one generation, up to 1 GiB, as bytes or a KiB/MiB quantity.",
+      "purpose": "Refresh cadence as a canonical positive duration no greater than 30 days, or manual when an operator initiates every refresh.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "integer",
           "string"
         ],
         "composed": true
@@ -60193,7 +63016,7 @@
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_bytes/oneOf/0",
+        "pointer": "/properties/materialization/properties/refresh/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
@@ -60202,9 +63025,7 @@
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "conditional",
@@ -60267,23 +63088,15 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 1073741824
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
+          "keyword": "const",
+          "value": "manual"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_bytes/oneOf/1",
+        "pointer": "/properties/materialization/properties/refresh/oneOf/1",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
@@ -60358,7 +63171,7 @@
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,5}|10[0-3][0-9]{4}|104[0-7][0-9]{3}|1048[0-4][0-9]{2}|10485[0-6][0-9]|104857[0-6])KiB|(?:[1-9][0-9]{0,2}|10[0-1][0-9]|102[0-4])MiB)$"
+          "value": "^(?:(?:[1-9][0-9]{0,8}|1[0-9]{9}|2[0-4][0-9]{8}|25[0-8][0-9]{7}|259[0-1][0-9]{6}|2592000000)ms|(?:[1-9][0-9]{0,5}|1[0-9]{6}|2[0-4][0-9]{5}|25[0-8][0-9]{4}|259[0-1][0-9]{3}|2592000)s|(?:[1-9][0-9]{0,3}|[1-3][0-9]{4}|4[0-2][0-9]{3}|43[0-1][0-9]{2}|43200)m|(?:[1-9][0-9]{0,1}|[1-6][0-9]{2}|7[0-1][0-9]{1}|720)h|(?:[1-9][0-9]{0,0}|[1-2][0-9]{1}|30)d)$"
         },
         {
           "keyword": "type",
@@ -60369,10 +63182,10 @@
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_records",
+        "pointer": "/properties/materialization/properties/retain_generations",
         "path_kind": "property"
       },
-      "purpose": "Maximum number of records allowed in one generation.",
+      "purpose": "Number of completed cache generations, including the active generation, retained as a bounded recovery set after successful publication. This does not make arbitrary retained generations selectable for rollback.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
@@ -60443,7 +63256,7 @@
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 100000000
+          "value": 16
         },
         {
           "keyword": "minimum",
@@ -60458,10 +63271,10 @@
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization/properties/refresh",
+        "pointer": "/properties/primary_key",
         "path_kind": "property"
       },
-      "purpose": "Refresh cadence as a canonical positive duration no greater than 30 days, or manual when an operator initiates every refresh.",
+      "purpose": "Field whose value uniquely identifies each materialized record.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
@@ -60470,7 +63283,8 @@
         "schema_types": [
           "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/stableId",
+        "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
@@ -60499,162 +63313,6 @@
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/refresh/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "manual"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/refresh/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
       "example": {
         "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
@@ -60683,27 +63341,30 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,8}|1[0-9]{9}|2[0-4][0-9]{8}|25[0-8][0-9]{7}|259[0-1][0-9]{6}|2592000000)ms|(?:[1-9][0-9]{0,5}|1[0-9]{6}|2[0-4][0-9]{5}|25[0-8][0-9]{4}|259[0-1][0-9]{3}|2592000)s|(?:[1-9][0-9]{0,3}|[1-3][0-9]{4}|4[0-2][0-9]{3}|43[0-1][0-9]{2}|43200)m|(?:[1-9][0-9]{0,1}|[1-6][0-9]{2}|7[0-1][0-9]{1}|720)h|(?:[1-9][0-9]{0,0}|[1-2][0-9]{1}|30)d)$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization/properties/retain_generations",
+        "pointer": "/properties/revision",
         "path_kind": "property"
       },
-      "purpose": "Number of completed cache generations, including the active generation, retained as a bounded recovery set after successful publication. This does not make arbitrary retained generations selectable for rollback.",
+      "purpose": "Monotonically increasing revision of this entity definition.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
@@ -60774,7 +63435,7 @@
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 16
+          "value": 4294967295
         },
         {
           "keyword": "minimum",
@@ -60789,24 +63450,24 @@
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/primary_key",
+        "pointer": "/properties/schema",
         "path_kind": "property"
       },
-      "purpose": "Field whose value uniquely identifies each materialized record.",
+      "purpose": "Closed JSON object schema for materialized records.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/objectSchema",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -60863,34 +63524,37 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "type",
+            "additionalProperties",
+            "required",
+            "properties"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "entity",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/objectSchema"
       }
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/revision",
+        "pointer": "/properties/version",
         "path_kind": "property"
       },
-      "purpose": "Monotonically increasing revision of this entity definition.",
+      "purpose": "Entity authoring format version.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -60900,7 +63564,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
@@ -60922,7 +63586,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
+        "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
@@ -60952,50 +63616,41 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
+          "keyword": "const",
           "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "entity",
-        "pointer": "/properties/schema",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "",
+        "key_path": "",
+        "path_kind": "root"
       },
-      "purpose": "Closed JSON object schema for materialized records.",
+      "purpose": "Root configuration document. Parsed from YAML at startup.",
       "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
+      "intent_profile": "relay_root_structural",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/objectSchema",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
+      "state": "runtime",
       "products": [
-        "registryctl",
         "relay",
-        "editor",
         "docs"
       ],
       "availability": "published",
@@ -61003,37 +63658,30 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
+        "operator_preflight"
       ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registryctl_authoring",
         "registry_relay",
-        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "privacy",
         "relay",
-        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
@@ -61044,50 +63692,50 @@
         {
           "keyword": "required",
           "value": [
-            "type",
-            "additionalProperties",
-            "required",
-            "properties"
+            "server",
+            "catalog",
+            "auth",
+            "audit",
+            "datasets"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "entity",
-        "pointer": "/properties/version",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
+        "key_path": "datasets[].aggregates[].access.aggregate_only_execution",
         "path_kind": "property"
       },
-      "purpose": "Entity authoring format version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "boolean"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "public",
-      "state": "authored",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
       "products": [
-        "registryctl",
         "relay",
-        "editor",
         "docs"
       ],
       "availability": "published",
@@ -61095,77 +63743,72 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
+        "operator_preflight"
       ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registryctl_authoring",
         "registry_relay",
-        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "privacy",
         "relay",
-        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": 1
+          "keyword": "type",
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "",
-        "key_path": "",
-        "path_kind": "root"
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
+        "key_path": "datasets[].entities[].aggregates[].access.aggregate_only_execution",
+        "path_kind": "property"
       },
-      "purpose": "Root configuration document. Parsed from YAML at startup.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_root_structural",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -61204,22 +63847,13 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "server",
-            "catalog",
-            "auth",
-            "audit",
-            "datasets"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
@@ -61227,7 +63861,7 @@
       "address": {
         "schema": "relay",
         "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
-        "key_path": "datasets[].aggregates[].access.aggregate_only_execution",
+        "key_path": "datasets[].tables[].aggregates[].access.aggregate_only_execution",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61295,15 +63929,95 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "boolean"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].aggregates[].access.aggregate_scope",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
-        "key_path": "datasets[].entities[].aggregates[].access.aggregate_only_execution",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].entities[].aggregates[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61314,13 +64028,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -61371,15 +64086,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
-        "key_path": "datasets[].tables[].aggregates[].access.aggregate_only_execution",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].tables[].aggregates[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61390,13 +64108,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -61447,15 +64166,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].aggregates[].access.aggregate_scope",
+        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].aggregates[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61534,8 +64256,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].entities[].aggregates[].access.aggregate_scope",
+        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].entities[].aggregates[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61614,8 +64336,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].tables[].aggregates[].access.aggregate_scope",
+        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].tables[].aggregates[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61694,8 +64416,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].aggregates[].access.metadata_scope",
+        "pointer": "/$defs/AggregateConfig/properties/access",
+        "key_path": "datasets[].aggregates[].access",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61707,16 +64429,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -61765,8 +64487,8 @@
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -61774,8 +64496,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].entities[].aggregates[].access.metadata_scope",
+        "pointer": "/$defs/AggregateConfig/properties/access",
+        "key_path": "datasets[].entities[].aggregates[].access",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61787,16 +64509,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -61845,8 +64567,8 @@
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -61854,8 +64576,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].tables[].aggregates[].access.metadata_scope",
+        "pointer": "/$defs/AggregateConfig/properties/access",
+        "key_path": "datasets[].tables[].aggregates[].access",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61867,16 +64589,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -61925,8 +64647,8 @@
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -61934,8 +64656,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/access",
-        "key_path": "datasets[].aggregates[].access",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
+        "key_path": "datasets[].aggregates[].allowed_filters",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61946,17 +64668,168 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62004,39 +64877,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/access",
-        "key_path": "datasets[].entities[].aggregates[].access",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].aggregates[].allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/AllowedFilter",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62083,40 +64952,47 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "null",
-            "object"
+            "field",
+            "ops"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/access",
-        "key_path": "datasets[].tables[].aggregates[].access",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/AllowedFilter",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62163,39 +65039,47 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "null",
-            "object"
+            "field",
+            "ops"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
-        "key_path": "datasets[].aggregates[].allowed_filters",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62241,17 +65125,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters",
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
+        "key_path": "datasets[].aggregates[].default_group_by",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -62270,8 +65165,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62326,8 +65221,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters",
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
+        "key_path": "datasets[].entities[].aggregates[].default_group_by",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -62346,8 +65241,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62402,115 +65297,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].aggregates[].allowed_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AllowedFilter",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
+        "key_path": "datasets[].tables[].aggregates[].default_group_by",
+        "path_kind": "property"
       },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62556,46 +65364,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[]",
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
+        "key_path": "datasets[].aggregates[].default_group_by[]",
         "path_kind": "array_item"
       },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
@@ -62643,29 +65439,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
-        "key_path": "datasets[].aggregates[].default_group_by",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
+        "key_path": "datasets[].entities[].aggregates[].default_group_by[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -62675,16 +65460,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62732,16 +65516,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
-        "key_path": "datasets[].entities[].aggregates[].default_group_by",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
+        "key_path": "datasets[].tables[].aggregates[].default_group_by[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -62751,16 +65535,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62808,15 +65591,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
-        "key_path": "datasets[].tables[].aggregates[].default_group_by",
+        "pointer": "/$defs/AggregateConfig/properties/description",
+        "key_path": "datasets[].aggregates[].description",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -62827,16 +65610,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62884,16 +65666,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
-        "key_path": "datasets[].aggregates[].default_group_by[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/description",
+        "key_path": "datasets[].entities[].aggregates[].description",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -62907,11 +65689,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62966,9 +65748,9 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
-        "key_path": "datasets[].entities[].aggregates[].default_group_by[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/description",
+        "key_path": "datasets[].tables[].aggregates[].description",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -62982,11 +65764,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63041,9 +65823,9 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
-        "key_path": "datasets[].tables[].aggregates[].default_group_by[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/dimensions",
+        "key_path": "datasets[].aggregates[].dimensions",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -63053,15 +65835,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63109,15 +65892,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/description",
-        "key_path": "datasets[].aggregates[].description",
+        "pointer": "/$defs/AggregateConfig/properties/dimensions",
+        "key_path": "datasets[].entities[].aggregates[].dimensions",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -63128,15 +65911,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63184,15 +65968,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/description",
-        "key_path": "datasets[].entities[].aggregates[].description",
+        "pointer": "/$defs/AggregateConfig/properties/dimensions",
+        "key_path": "datasets[].tables[].aggregates[].dimensions",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -63203,15 +65987,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63259,16 +66044,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/description",
-        "key_path": "datasets[].tables[].aggregates[].description",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
+        "key_path": "datasets[].aggregates[].dimensions[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -63278,15 +66063,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateDimensionConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63332,18 +66118,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions",
-        "key_path": "datasets[].aggregates[].dimensions",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -63353,16 +66151,104 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateDimensionConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig"
+      }
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/AggregateDimensionConfig",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63408,37 +66294,49 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions",
-        "key_path": "datasets[].entities[].aggregates[].dimensions",
+        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
+        "key_path": "datasets[].aggregates[].disclosure_control",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63486,35 +66384,39 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions",
-        "key_path": "datasets[].tables[].aggregates[].dimensions",
+        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63562,19 +66464,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
-        "key_path": "datasets[].aggregates[].dimensions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -63583,14 +66489,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateDimensionConfig",
+        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63636,14 +66542,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -63651,15 +66549,15 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig"
+        "pointer": "/$defs/DisclosureControlConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/group_by",
+        "key_path": "datasets[].aggregates[].group_by",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -63669,16 +66567,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateDimensionConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63724,30 +66622,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/group_by",
+        "key_path": "datasets[].entities[].aggregates[].group_by",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -63757,16 +66643,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateDimensionConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63812,49 +66698,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
-        "key_path": "datasets[].aggregates[].disclosure_control",
+        "pointer": "/$defs/AggregateConfig/properties/group_by",
+        "key_path": "datasets[].tables[].aggregates[].group_by",
         "path_kind": "property"
       },
-      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63902,39 +66776,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
+        "key_path": "datasets[].aggregates[].group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63982,39 +66851,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
+        "key_path": "datasets[].entities[].aggregates[].group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64062,20 +66926,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by",
-        "key_path": "datasets[].aggregates[].group_by",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
+        "key_path": "datasets[].tables[].aggregates[].group_by[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -64085,16 +66945,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64142,35 +67001,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by",
-        "key_path": "datasets[].entities[].aggregates[].group_by",
+        "pointer": "/$defs/AggregateConfig/properties/id",
+        "key_path": "datasets[].aggregates[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate identifier within a resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64217,96 +67076,28 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by",
-        "key_path": "datasets[].tables[].aggregates[].group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
-        "key_path": "datasets[].aggregates[].group_by[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/id",
+        "key_path": "datasets[].entities[].aggregates[].id",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate identifier within a resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -64315,13 +67106,14 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64367,21 +67159,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
-        "key_path": "datasets[].entities[].aggregates[].group_by[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/id",
+        "key_path": "datasets[].tables[].aggregates[].id",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate identifier within a resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -64390,13 +67190,14 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64442,18 +67243,26 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
-        "key_path": "datasets[].tables[].aggregates[].group_by[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/indicators",
+        "key_path": "datasets[].aggregates[].indicators",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -64463,15 +67272,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64519,35 +67329,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/id",
-        "key_path": "datasets[].aggregates[].id",
+        "pointer": "/$defs/AggregateConfig/properties/indicators",
+        "key_path": "datasets[].entities[].aggregates[].indicators",
         "path_kind": "property"
       },
-      "purpose": "Aggregate identifier within a resource.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64593,45 +67403,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/id",
-        "key_path": "datasets[].entities[].aggregates[].id",
+        "pointer": "/$defs/AggregateConfig/properties/indicators",
+        "key_path": "datasets[].tables[].aggregates[].indicators",
         "path_kind": "property"
       },
-      "purpose": "Aggregate identifier within a resource.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64677,45 +67479,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/id",
-        "key_path": "datasets[].tables[].aggregates[].id",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
+        "key_path": "datasets[].aggregates[].indicators[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Aggregate identifier within a resource.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/AggregateId",
+        "local_reference": "#/$defs/AggregateIndicatorConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64762,25 +67556,31 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateId"
+        "pointer": "/$defs/AggregateIndicatorConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators",
-        "key_path": "datasets[].aggregates[].indicators",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
+        "key_path": "datasets[].entities[].aggregates[].indicators[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -64790,16 +67590,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateIndicatorConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64845,18 +67645,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators",
-        "key_path": "datasets[].entities[].aggregates[].indicators",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
+        "key_path": "datasets[].tables[].aggregates[].indicators[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -64866,16 +67680,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateIndicatorConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64921,21 +67735,35 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators",
-        "key_path": "datasets[].tables[].aggregates[].indicators",
+        "pointer": "/$defs/AggregateConfig/properties/joins",
+        "key_path": "datasets[].aggregates[].joins",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -65006,28 +67834,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
-        "key_path": "datasets[].aggregates[].indicators[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/joins",
+        "key_path": "datasets[].entities[].aggregates[].joins",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateIndicatorConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65073,51 +67901,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
-        "key_path": "datasets[].entities[].aggregates[].indicators[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/joins",
+        "key_path": "datasets[].tables[].aggregates[].joins",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateIndicatorConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65163,31 +67977,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
-        "key_path": "datasets[].tables[].aggregates[].indicators[]",
+        "pointer": "/$defs/AggregateConfig/properties/joins/items",
+        "key_path": "datasets[].aggregates[].joins[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -65200,7 +68000,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateIndicatorConfig",
+        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -65256,11 +68056,7 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
+            "relationship"
           ]
         },
         {
@@ -65270,34 +68066,34 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig"
+        "pointer": "/$defs/AggregateJoinConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins",
-        "key_path": "datasets[].aggregates[].joins",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/joins/items",
+        "key_path": "datasets[].entities[].aggregates[].joins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65343,37 +68139,47 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relationship"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateJoinConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins",
-        "key_path": "datasets[].entities[].aggregates[].joins",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/joins/items",
+        "key_path": "datasets[].tables[].aggregates[].joins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65419,21 +68225,31 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relationship"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateJoinConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins",
-        "key_path": "datasets[].tables[].aggregates[].joins",
+        "pointer": "/$defs/AggregateConfig/properties/measures",
+        "key_path": "datasets[].aggregates[].measures",
         "path_kind": "property"
       },
-      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -65504,9 +68320,9 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins/items",
-        "key_path": "datasets[].aggregates[].joins[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/measures",
+        "key_path": "datasets[].entities[].aggregates[].measures",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -65516,16 +68332,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65571,28 +68387,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins/items",
-        "key_path": "datasets[].entities[].aggregates[].joins[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/measures",
+        "key_path": "datasets[].tables[].aggregates[].measures",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -65602,16 +68408,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65657,31 +68463,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins/items",
-        "key_path": "datasets[].tables[].aggregates[].joins[]",
+        "pointer": "/$defs/AggregateConfig/properties/measures/items",
+        "key_path": "datasets[].aggregates[].measures[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "One measure inside an aggregate.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -65690,7 +68486,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateJoinConfig",
+        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -65746,7 +68542,9 @@
         {
           "keyword": "required",
           "value": [
-            "relationship"
+            "name",
+            "function",
+            "column"
           ]
         },
         {
@@ -65756,34 +68554,34 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig"
+        "pointer": "/$defs/AggregateMeasure"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures",
-        "key_path": "datasets[].aggregates[].measures",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/measures/items",
+        "key_path": "datasets[].entities[].aggregates[].measures[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "One measure inside an aggregate.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65829,37 +68627,49 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "function",
+            "column"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures",
-        "key_path": "datasets[].entities[].aggregates[].measures",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/measures/items",
+        "key_path": "datasets[].tables[].aggregates[].measures[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "One measure inside an aggregate.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65905,21 +68715,33 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "function",
+            "column"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures",
-        "key_path": "datasets[].tables[].aggregates[].measures",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].aggregates[].required_filter_bindings",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -65990,11 +68812,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures/items",
-        "key_path": "datasets[].aggregates[].measures[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings",
+        "path_kind": "property"
       },
-      "purpose": "One measure inside an aggregate.",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -66002,16 +68824,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66057,32 +68879,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "function",
-            "column"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures/items",
-        "key_path": "datasets[].entities[].aggregates[].measures[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings",
+        "path_kind": "property"
       },
-      "purpose": "One measure inside an aggregate.",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -66090,16 +68900,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66145,33 +68955,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "function",
-            "column"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures/items",
-        "key_path": "datasets[].tables[].aggregates[].measures[]",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].aggregates[].required_filter_bindings[]",
         "path_kind": "array_item"
       },
-      "purpose": "One measure inside an aggregate.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -66180,7 +68978,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateMeasure",
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -66236,9 +69034,7 @@
         {
           "keyword": "required",
           "value": [
-            "name",
-            "function",
-            "column"
+            "field"
           ]
         },
         {
@@ -66248,34 +69044,34 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure"
+        "pointer": "/$defs/RequiredFilterBindingConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].aggregates[].required_filter_bindings",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66321,37 +69117,47 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66397,20 +69203,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters",
+        "key_path": "datasets[].aggregates[].required_filters",
         "path_kind": "property"
       },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
+      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -66426,8 +69242,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66482,28 +69298,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].aggregates[].required_filter_bindings[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/required_filters",
+        "key_path": "datasets[].entities[].aggregates[].required_filters",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66549,47 +69365,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/required_filters",
+        "key_path": "datasets[].tables[].aggregates[].required_filters",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66635,27 +69441,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[]",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
+        "key_path": "datasets[].aggregates[].required_filters[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -66666,14 +69462,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
@@ -66721,47 +69516,36 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters",
-        "key_path": "datasets[].aggregates[].required_filters",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
+        "key_path": "datasets[].entities[].aggregates[].required_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66809,35 +69593,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters",
-        "key_path": "datasets[].entities[].aggregates[].required_filters",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
+        "key_path": "datasets[].tables[].aggregates[].required_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66885,32 +69668,33 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters",
-        "key_path": "datasets[].tables[].aggregates[].required_filters",
+        "pointer": "/$defs/AggregateConfig/properties/source_entity",
+        "key_path": "datasets[].aggregates[].source_entity",
         "path_kind": "property"
       },
-      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -66961,16 +69745,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
-        "key_path": "datasets[].aggregates[].required_filters[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/source_entity",
+        "key_path": "datasets[].entities[].aggregates[].source_entity",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -66980,15 +69767,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67036,16 +69825,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
-        "key_path": "datasets[].entities[].aggregates[].required_filters[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/source_entity",
+        "key_path": "datasets[].tables[].aggregates[].source_entity",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -67055,15 +69847,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67111,16 +69905,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
-        "key_path": "datasets[].tables[].aggregates[].required_filters[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/spatial",
+        "key_path": "datasets[].aggregates[].spatial",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -67130,15 +69927,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67184,17 +69983,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/source_entity",
-        "key_path": "datasets[].aggregates[].source_entity",
+        "pointer": "/$defs/AggregateConfig/properties/spatial",
+        "key_path": "datasets[].entities[].aggregates[].spatial",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67206,16 +70018,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67261,11 +70073,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -67273,8 +70095,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/source_entity",
-        "key_path": "datasets[].entities[].aggregates[].source_entity",
+        "pointer": "/$defs/AggregateConfig/properties/spatial",
+        "key_path": "datasets[].tables[].aggregates[].spatial",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67286,16 +70108,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67341,11 +70163,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -67353,8 +70185,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/source_entity",
-        "key_path": "datasets[].tables[].aggregates[].source_entity",
+        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
+        "key_path": "datasets[].aggregates[].temporal_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67433,8 +70265,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/spatial",
-        "key_path": "datasets[].aggregates[].spatial",
+        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
+        "key_path": "datasets[].entities[].aggregates[].temporal_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67446,16 +70278,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67501,21 +70333,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -67523,8 +70345,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/spatial",
-        "key_path": "datasets[].entities[].aggregates[].spatial",
+        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
+        "key_path": "datasets[].tables[].aggregates[].temporal_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67536,16 +70358,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67591,21 +70413,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -67613,8 +70425,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/spatial",
-        "key_path": "datasets[].tables[].aggregates[].spatial",
+        "pointer": "/$defs/AggregateConfig/properties/title",
+        "key_path": "datasets[].aggregates[].title",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67626,16 +70438,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67681,21 +70493,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -67703,8 +70505,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
-        "key_path": "datasets[].aggregates[].temporal_field",
+        "pointer": "/$defs/AggregateConfig/properties/title",
+        "key_path": "datasets[].entities[].aggregates[].title",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67783,8 +70585,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
-        "key_path": "datasets[].entities[].aggregates[].temporal_field",
+        "pointer": "/$defs/AggregateConfig/properties/title",
+        "key_path": "datasets[].tables[].aggregates[].title",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67863,8 +70665,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
-        "key_path": "datasets[].tables[].aggregates[].temporal_field",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
+        "key_path": "datasets[].aggregates[].dimensions[].codelist",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67943,8 +70745,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/title",
-        "key_path": "datasets[].aggregates[].title",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].codelist",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68023,8 +70825,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/title",
-        "key_path": "datasets[].entities[].aggregates[].title",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].codelist",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68103,8 +70905,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/title",
-        "key_path": "datasets[].tables[].aggregates[].title",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
+        "key_path": "datasets[].aggregates[].dimensions[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68115,17 +70917,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -68173,18 +70973,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
-        "key_path": "datasets[].aggregates[].dimensions[].codelist",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68195,17 +70992,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -68253,18 +71048,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].codelist",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68275,17 +71067,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -68333,18 +71123,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].codelist",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
+        "key_path": "datasets[].aggregates[].dimensions[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68355,17 +71142,90 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].id",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -68413,18 +71273,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
-        "key_path": "datasets[].aggregates[].dimensions[].field",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68498,8 +71355,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].field",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
+        "key_path": "datasets[].aggregates[].dimensions[].label",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68573,8 +71430,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].field",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].label",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68648,8 +71505,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
-        "key_path": "datasets[].aggregates[].dimensions[].id",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].label",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68723,8 +71580,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].id",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
+        "key_path": "datasets[].aggregates[].indicators[].column",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68798,8 +71655,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].id",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].column",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68873,8 +71730,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
-        "key_path": "datasets[].aggregates[].dimensions[].label",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].column",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68948,8 +71805,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].label",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
+        "key_path": "datasets[].aggregates[].indicators[].decimals",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68960,15 +71817,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69014,17 +71873,124 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].label",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].decimals",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "integer",
+          "null"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
+        {
+          "keyword": "type",
+          "value": [
+            "integer",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].decimals",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69035,15 +72001,109 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "integer",
+          "null"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
+        {
+          "keyword": "type",
+          "value": [
+            "integer",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
+        "key_path": "datasets[].aggregates[].indicators[].definition_uri",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69091,15 +72151,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
-        "key_path": "datasets[].aggregates[].indicators[].column",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].definition_uri",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69110,15 +72173,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69166,15 +72231,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].column",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].definition_uri",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69185,15 +72253,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69241,15 +72311,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].column",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
+        "key_path": "datasets[].aggregates[].indicators[].frequency",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69260,15 +72333,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69316,15 +72391,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
-        "key_path": "datasets[].aggregates[].indicators[].decimals",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].frequency",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69335,14 +72413,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -69391,22 +72469,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
           "value": [
-            "integer",
+            "string",
             "null"
           ]
         }
@@ -69415,8 +72481,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].decimals",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].frequency",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69427,14 +72493,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -69483,22 +72549,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
           "value": [
-            "integer",
+            "string",
             "null"
           ]
         }
@@ -69507,29 +72561,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].decimals",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
+        "key_path": "datasets[].aggregates[].indicators[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69576,52 +72629,146 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
         },
         {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].function",
+        "path_kind": "property"
+      },
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/AggregateFunction",
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
-        "key_path": "datasets[].aggregates[].indicators[].definition_uri",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69668,19 +72815,33 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].definition_uri",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
+        "key_path": "datasets[].aggregates[].indicators[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69691,17 +72852,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69749,18 +72908,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].definition_uri",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69771,17 +72927,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69829,18 +72983,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
-        "key_path": "datasets[].aggregates[].indicators[].frequency",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69851,17 +73002,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69909,18 +73058,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].frequency",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
+        "key_path": "datasets[].aggregates[].indicators[].label",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69931,17 +73077,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69989,18 +73133,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].frequency",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].label",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70011,17 +73152,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -70069,22 +73208,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
-        "key_path": "datasets[].aggregates[].indicators[].function",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].label",
         "path_kind": "property"
       },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -70093,12 +73229,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -70146,38 +73281,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].function",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
+        "key_path": "datasets[].aggregates[].indicators[].unit_measure",
         "path_kind": "property"
       },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -70186,12 +73304,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -70239,38 +73356,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].function",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_measure",
         "path_kind": "property"
       },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -70279,12 +73379,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -70332,34 +73431,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
-        "key_path": "datasets[].aggregates[].indicators[].id",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_measure",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70426,15 +73508,107 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
+        "key_path": "datasets[].aggregates[].indicators[].unit_mult",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "integer",
+          "null"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "format",
+          "value": "int32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
+        {
+          "keyword": "type",
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].id",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_mult",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70445,15 +73619,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -70499,17 +73675,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].id",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_mult",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70520,15 +73711,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -70574,17 +73767,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
-        "key_path": "datasets[].aggregates[].indicators[].label",
+        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
+        "key_path": "datasets[].aggregates[].joins[].relationship",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70658,8 +73866,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].label",
+        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
+        "key_path": "datasets[].entities[].aggregates[].joins[].relationship",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70733,8 +73941,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].label",
+        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
+        "key_path": "datasets[].tables[].aggregates[].joins[].relationship",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70808,8 +74016,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
-        "key_path": "datasets[].aggregates[].indicators[].unit_measure",
+        "pointer": "/$defs/AggregateMeasure/properties/column",
+        "key_path": "datasets[].aggregates[].measures[].column",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70883,8 +74091,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_measure",
+        "pointer": "/$defs/AggregateMeasure/properties/column",
+        "key_path": "datasets[].entities[].aggregates[].measures[].column",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70958,8 +74166,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_measure",
+        "pointer": "/$defs/AggregateMeasure/properties/column",
+        "key_path": "datasets[].tables[].aggregates[].measures[].column",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -71033,29 +74241,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
-        "key_path": "datasets[].aggregates[].indicators[].unit_mult",
+        "pointer": "/$defs/AggregateMeasure/properties/function",
+        "key_path": "datasets[].aggregates[].measures[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -71102,144 +74309,53 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "int32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
-        },
-        {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "integer",
-            "null"
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
           ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_mult",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_mult",
+        "pointer": "/$defs/AggregateMeasure/properties/function",
+        "key_path": "datasets[].entities[].aggregates[].measures[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -71286,35 +74402,37 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "int32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
-        "key_path": "datasets[].aggregates[].joins[].relationship",
+        "pointer": "/$defs/AggregateMeasure/properties/function",
+        "key_path": "datasets[].tables[].aggregates[].measures[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -71323,11 +74441,12 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -71375,17 +74494,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
-        "key_path": "datasets[].entities[].aggregates[].joins[].relationship",
+        "pointer": "/$defs/AggregateMeasure/properties/name",
+        "key_path": "datasets[].aggregates[].measures[].name",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -71459,8 +74595,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
-        "key_path": "datasets[].tables[].aggregates[].joins[].relationship",
+        "pointer": "/$defs/AggregateMeasure/properties/name",
+        "key_path": "datasets[].entities[].aggregates[].measures[].name",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -71534,8 +74670,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/column",
-        "key_path": "datasets[].aggregates[].measures[].column",
+        "pointer": "/$defs/AggregateMeasure/properties/name",
+        "key_path": "datasets[].tables[].aggregates[].measures[].name",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -71609,8 +74745,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/column",
-        "key_path": "datasets[].entities[].aggregates[].measures[].column",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -71621,15 +74757,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -71675,17 +74813,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/column",
-        "key_path": "datasets[].tables[].aggregates[].measures[].column",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -71696,15 +74846,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -71750,37 +74902,50 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/function",
-        "key_path": "datasets[].aggregates[].measures[].function",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -71827,53 +74992,129 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
+        "key_path": "datasets[].aggregates[].spatial.collection_id",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": [
+            "string",
+            "null"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/function",
-        "key_path": "datasets[].entities[].aggregates[].measures[].function",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
+        "key_path": "datasets[].entities[].aggregates[].spatial.collection_id",
         "path_kind": "property"
       },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -71920,37 +75161,103 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
+            "string",
+            "null"
           ]
-        },
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
+        "key_path": "datasets[].tables[].aggregates[].spatial.collection_id",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/function",
-        "key_path": "datasets[].tables[].aggregates[].measures[].function",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
+        "key_path": "datasets[].aggregates[].spatial.dimension",
         "path_kind": "property"
       },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -71959,12 +75266,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -72012,34 +75318,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/name",
-        "key_path": "datasets[].aggregates[].measures[].name",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
+        "key_path": "datasets[].entities[].aggregates[].spatial.dimension",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72113,8 +75402,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/name",
-        "key_path": "datasets[].entities[].aggregates[].measures[].name",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
+        "key_path": "datasets[].tables[].aggregates[].spatial.dimension",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72188,8 +75477,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/name",
-        "key_path": "datasets[].tables[].aggregates[].measures[].name",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
+        "key_path": "datasets[].aggregates[].spatial.geometry_entity",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72263,8 +75552,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
+        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_entity",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72275,17 +75564,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72331,29 +75618,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
+        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_entity",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72364,17 +75639,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72420,29 +75693,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
+        "key_path": "datasets[].aggregates[].spatial.geometry_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72453,17 +75714,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72509,29 +75768,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
-        "key_path": "datasets[].aggregates[].spatial.collection_id",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
+        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72542,17 +75789,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72600,18 +75845,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
-        "key_path": "datasets[].entities[].aggregates[].spatial.collection_id",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
+        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72622,17 +75864,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72680,18 +75920,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
-        "key_path": "datasets[].tables[].aggregates[].spatial.collection_id",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
+        "key_path": "datasets[].aggregates[].spatial.geometry_id_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72702,17 +75939,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72760,18 +75995,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
-        "key_path": "datasets[].aggregates[].spatial.dimension",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
+        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_id_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72845,8 +76077,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
-        "key_path": "datasets[].entities[].aggregates[].spatial.dimension",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
+        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_id_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72920,8 +76152,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
-        "key_path": "datasets[].tables[].aggregates[].spatial.dimension",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
+        "key_path": "datasets[].aggregates[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72932,15 +76164,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72986,17 +76219,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
-        "key_path": "datasets[].aggregates[].spatial.geometry_entity",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
+        "key_path": "datasets[].entities[].aggregates[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73007,15 +76252,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -73061,17 +76307,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
-        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_entity",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
+        "key_path": "datasets[].tables[].aggregates[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73082,15 +76340,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -73136,17 +76395,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
-        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_entity",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].aggregates[].spatial.mode",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73163,7 +76434,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -73211,6 +76482,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "admin_area"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -73220,8 +76495,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
-        "key_path": "datasets[].aggregates[].spatial.geometry_field",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].entities[].aggregates[].spatial.mode",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73238,7 +76513,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -73286,6 +76561,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "admin_area"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -73295,8 +76574,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
-        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_field",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].tables[].aggregates[].spatial.mode",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73313,7 +76592,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -73361,6 +76640,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "admin_area"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -73370,8 +76653,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
-        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_field",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].aggregates[].allowed_filters[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73445,8 +76728,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
-        "key_path": "datasets[].aggregates[].spatial.geometry_id_field",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73520,8 +76803,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
-        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_id_field",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].entities[].api.allowed_filters[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73595,8 +76878,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
-        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_id_field",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73670,96 +76953,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
-        "key_path": "datasets[].aggregates[].spatial.max_geometry_vertices",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
-        "key_path": "datasets[].entities[].aggregates[].spatial.max_geometry_vertices",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].tables[].api.allowed_filters[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73770,16 +76965,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -73825,29 +77019,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
-        "key_path": "datasets[].tables[].aggregates[].spatial.max_geometry_vertices",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].aggregates[].allowed_filters[].ops",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73858,16 +77040,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -73913,29 +77094,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].aggregates[].spatial.mode",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73946,13 +77115,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -74000,21 +77169,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": "admin_area"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].entities[].aggregates[].spatial.mode",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].entities[].api.allowed_filters[].ops",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -74025,13 +77190,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -74079,21 +77244,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": "admin_area"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].tables[].aggregates[].spatial.mode",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -74104,13 +77265,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -74158,21 +77319,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": "admin_area"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].aggregates[].allowed_filters[].field",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].tables[].api.allowed_filters[].ops",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -74183,13 +77340,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -74239,19 +77396,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].field",
-        "path_kind": "property"
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].aggregates[].allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -74260,13 +77417,14 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -74312,21 +77470,35 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].entities[].api.allowed_filters[].field",
-        "path_kind": "property"
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -74335,13 +77507,14 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -74387,21 +77560,35 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].field",
-        "path_kind": "property"
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].entities[].api.allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -74410,13 +77597,104 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/FilterOp",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -74462,21 +77740,35 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].tables[].api.allowed_filters[].field",
-        "path_kind": "property"
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].tables[].api.allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -74485,13 +77777,14 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -74537,29 +77830,44 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].aggregates[].allowed_filters[].ops",
+        "pointer": "/$defs/ApiKeyConfig/properties/fingerprint",
+        "key_path": "auth.api_keys[].fingerprint",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_auth_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/CredentialFingerprintSchema",
         "composed": false
       },
       "requiredness": "required",
@@ -74568,8 +77876,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -74604,47 +77912,66 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "provider",
+              "name"
+            ],
+            [
+              "provider",
+              "path"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/CredentialFingerprintSchema"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops",
+        "pointer": "/$defs/ApiKeyConfig/properties/id",
+        "key_path": "auth.api_keys[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -74679,30 +78006,33 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].entities[].api.allowed_filters[].ops",
+        "pointer": "/$defs/ApiKeyConfig/properties/scopes",
+        "key_path": "auth.api_keys[].scopes",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -74712,14 +78042,15 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -74754,11 +78085,14 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -74771,30 +78105,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops",
-        "path_kind": "property"
+        "pointer": "/$defs/ApiKeyConfig/properties/scopes/items",
+        "key_path": "auth.api_keys[].scopes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -74829,29 +78163,32 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].tables[].api.allowed_filters[].ops",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/claims",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Claims released on success. Non-empty; at least one `required`.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -74921,101 +78258,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].aggregates[].allowed_filters[].ops[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FilterOp",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops[]",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/claims/items",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[]",
         "path_kind": "array_item"
       },
-      "purpose": "Filter operator opted into per field.",
+      "purpose": "A single released claim. Exactly one of `source_field` or `expression`\nmust be set: a claim is either a direct source-field projection or a\nCEL-computed value.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -75023,14 +78270,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/FilterOp",
+        "local_reference": "#/$defs/ReleaseClaimConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
@@ -75079,50 +78326,47 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
+            "name"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/FilterOp"
+        "pointer": "/$defs/ReleaseClaimConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].entities[].api.allowed_filters[].ops[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AttributeReleaseProfile/properties/description",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].description",
+        "path_kind": "property"
       },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -75169,33 +78413,22 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AttributeReleaseProfile/properties/id",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].id",
+        "path_kind": "property"
       },
-      "purpose": "Filter operator opted into per field.",
+      "purpose": "Profile identifier, lower-kebab/snake (`^[a-z][a-z0-9_-]*$`). Globally\nunique with `version`.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -75205,14 +78438,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -75258,34 +78490,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].tables[].api.allowed_filters[].ops[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AttributeReleaseProfile/properties/purpose",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].purpose",
+        "path_kind": "property"
       },
-      "purpose": "Filter operator opted into per field.",
+      "purpose": "Data-purpose this profile is bound to. When the backing entity declares\n`governed_policy.permitted_purposes`, this must be a member.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -75295,14 +78513,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -75348,54 +78565,41 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/fingerprint",
-        "key_path": "auth.api_keys[].fingerprint",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/release_conditions",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/CredentialFingerprintSchema",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -75430,49 +78634,39 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            [
-              "provider",
-              "name"
-            ],
-            [
-              "provider",
-              "path"
-            ]
+            "expression"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/id",
-        "key_path": "auth.api_keys[].id",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/release_scope",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_scope",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
+      "purpose": "Dataset-bound scope a caller must hold to invoke this release. The\nstable profile is exactly `<dataset_id>:identity_release`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -75488,8 +78682,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -75524,14 +78718,11 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -75544,31 +78735,32 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/scopes",
-        "key_path": "auth.api_keys[].scopes",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/response",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].response",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/ReleaseResponseConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -75603,47 +78795,49 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseResponseConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/scopes/items",
-        "key_path": "auth.api_keys[].scopes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AttributeReleaseProfile/properties/subject",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].subject",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ReleaseSubjectConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -75688,40 +78882,52 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "source_field",
+            "id_type"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseSubjectConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/claims",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/title",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].title",
         "path_kind": "property"
       },
-      "purpose": "Claims released on success. Non-empty; at least one `required`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -75769,18 +78975,21 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/claims/items",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AttributeReleaseProfile/properties/version",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].version",
+        "path_kind": "property"
       },
-      "purpose": "A single released claim. Exactly one of `source_field` or `expression`\nmust be set: a claim is either a direct source-field projection or a\nCEL-computed value.",
+      "purpose": "Profile version. Globally unique with `id`; no silent \"latest\".",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -75788,16 +78997,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ReleaseClaimConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -75843,48 +79051,36 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/description",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].description",
+        "pointer": "/$defs/AuditConfig/oneOf/0/properties/sink",
+        "key_path": "audit.sink",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -75926,29 +79122,33 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "const",
           "value": [
-            "string",
-            "null"
+            "file",
+            "stdout",
+            "syslog"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/id",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].id",
+        "pointer": "/$defs/AuditConfig/oneOf/1/properties/path",
+        "key_path": "audit.path",
         "path_kind": "property"
       },
-      "purpose": "Profile identifier, lower-kebab/snake (`^[a-z][a-z0-9_-]*$`). Globally\nunique with `version`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_audit_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -75964,8 +79164,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -76000,12 +79200,14 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -76017,27 +79219,29 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/purpose",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].purpose",
+        "pointer": "/$defs/AuditConfig/oneOf/1/properties/rotate",
+        "key_path": "audit.rotate",
         "path_kind": "property"
       },
-      "purpose": "Data-purpose this profile is bound to. When the backing entity declares\n`governed_policy.permitted_purposes`, this must be a member.",
+      "purpose": "In-process rotation for the `file` audit sink.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RotateConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -76079,42 +79283,51 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "max_size_mb",
+            "max_files"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RotateConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/release_conditions",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions",
+        "pointer": "/$defs/AuditConfig/properties/chain",
+        "key_path": "audit.chain",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Retains the compatibility switch in the authored contract; Relay audit envelopes remain integrity-chained regardless of this setting.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "boolean"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -76156,35 +79369,25 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "expression"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/release_scope",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_scope",
+        "pointer": "/$defs/AuditConfig/properties/format",
+        "key_path": "audit.format",
         "path_kind": "property"
       },
-      "purpose": "Dataset-bound scope a caller must hold to invoke this release. The\nstable profile is exactly `<dataset_id>:identity_release`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -76192,13 +79395,15 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AuditFormat",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -76240,45 +79445,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "jsonl"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditFormat"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/response",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].response",
+        "pointer": "/$defs/AuditConfig/properties/hash_secret_env",
+        "key_path": "audit.hash_secret_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Name of the environment variable holding the per-deploy secret\nused to HMAC sensitive audit values (single-record primary keys,\nsensitive query parameters). Runtime startup fails closed when\nthis field is unset, empty, or points to a missing, empty, or\nweak secret. Direct middleware tests can opt into the explicit\nunkeyed dev-only hasher without using runtime config.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/ReleaseResponseConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -76313,52 +79525,57 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[^=\\x00]*[^=\\x00\\x09-\\x0D\\x20\\x85\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000][^=\\x00]*$"
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "string"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseResponseConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/subject",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].subject",
+        "pointer": "/$defs/AuditConfig/properties/include_health",
+        "key_path": "audit.include_health",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
+      "purpose": "Include `/healthz` liveness probes in the audit stream. `/ready` is\nalways excluded because auditing it would advance the chain after its\nzero-backlog shipping check and self-invalidate the next probe.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/ReleaseSubjectConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -76393,56 +79610,42 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "source_field",
-            "id_type"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseSubjectConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/title",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].title",
+        "pointer": "/$defs/AuditConfig/properties/write_policy",
+        "key_path": "audit.write_policy",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Behavior when an audit record fails to write.\n\n`fail_closed` (default) fails the request with a stable error code so\nthat no request outcome is returned without a durable audit record.\n`availability_first` logs the failure and lets the request succeed for\ndeployments that explicitly accept best-effort audit durability.\nPer-route-family selection is out of scope; this is a single\ndeployment-wide policy.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AuditWritePolicySchema",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -76487,43 +79690,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "availability_first",
+            "fail_closed",
+            "fail_closed_route_families"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditWritePolicySchema"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/version",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].version",
-        "path_kind": "property"
+        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig/items",
+        "key_path": "consultation.audit_pseudonym_materials[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Profile version. Globally unique with `id`; no silent \"latest\".",
+      "purpose": "One public epoch id bound to one secret source reference.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AuditPseudonymMaterialConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -76569,22 +79781,33 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "key_id",
+            "source"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/oneOf/0/properties/sink",
-        "key_path": "audit.sink",
+        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/key_id",
+        "key_path": "consultation.audit_pseudonym_materials[].key_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -76592,6 +79815,7 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AuditPseudonymKeyIdSchema",
         "composed": false
       },
       "requiredness": "required",
@@ -76640,50 +79864,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": [
-            "file",
-            "stdout",
-            "syslog"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z0-9][a-z0-9._-]{0,63}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymKeyIdSchema"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/oneOf/1/properties/path",
-        "key_path": "audit.path",
+        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/source",
+        "key_path": "consultation.audit_pseudonym_materials[].source",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_sensitive",
+      "purpose": "Closed v1 set of audit-pseudonym secret source providers.\n\nThe configured name is a reference only. Secret values cannot be embedded\nin this model and are loaded exactly once during runtime compilation.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AuditPseudonymSecretSourceConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -76718,51 +79944,59 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "provider",
+            "name"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymSecretSourceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/oneOf/1/properties/rotate",
-        "key_path": "audit.rotate",
+        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/name",
+        "key_path": "consultation.audit_pseudonym_materials[].source.name",
         "path_kind": "property"
       },
-      "purpose": "In-process rotation for the `file` audit sink.",
+      "purpose": "Portable environment-variable name used only as a secret reference.\n\nDebug output is redacted even though the name is not itself key material,\npreventing configuration diagnostics from disclosing secret topology.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RotateConfig",
+        "local_reference": "#/$defs/AuditPseudonymSecretEnvironmentName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -76797,55 +80031,54 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "max_size_mb",
-            "max_files"
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/RotateConfig"
+        "pointer": "/$defs/AuditPseudonymSecretEnvironmentName"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/chain",
-        "key_path": "audit.chain",
+        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/provider",
+        "key_path": "consultation.audit_pseudonym_materials[].source.provider",
         "path_kind": "property"
       },
-      "purpose": "Retains the compatibility switch in the authored contract; Relay audit envelopes remain integrity-chained regardless of this setting.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_audit_internal",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -76887,44 +80120,48 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "environment"
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/format",
-        "key_path": "audit.format",
+        "pointer": "/$defs/AuthConfig/properties/api_keys",
+        "key_path": "auth.api_keys",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/AuditFormat",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -76959,56 +80196,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": "jsonl"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditFormat"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/hash_secret_env",
-        "key_path": "audit.hash_secret_env",
-        "path_kind": "property"
+        "pointer": "/$defs/AuthConfig/properties/api_keys/items",
+        "key_path": "auth.api_keys[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Name of the environment variable holding the per-deploy secret\nused to HMAC sensitive audit values (single-record primary keys,\nsensitive query parameters). Runtime startup fails closed when\nthis field is unset, empty, or points to a missing, empty, or\nweak secret. Direct middleware tests can opt into the explicit\nunkeyed dev-only hasher without using runtime config.",
+      "purpose": "One configured API key, identified by an id and a fingerprint reference.\nThe raw key never appears in config.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_secret_reference",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/ApiKeyConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -77050,47 +80282,53 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[^=\\x00]*[^=\\x00\\x09-\\x0D\\x20\\x85\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000][^=\\x00]*$"
+          "keyword": "required",
+          "value": [
+            "id",
+            "fingerprint"
+          ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ApiKeyConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/include_health",
-        "key_path": "audit.include_health",
+        "pointer": "/$defs/AuthConfig/properties/failure_throttle",
+        "key_path": "auth.failure_throttle",
         "path_kind": "property"
       },
-      "purpose": "Include `/healthz` liveness probes in the audit stream. `/ready` is\nalways excluded because auditing it would advance the chain after its\nzero-backlog shipping check and self-invalidate the next probe.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
+        "local_reference": "#/$defs/AuthFailureThrottleConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -77132,25 +80370,30 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuthFailureThrottleConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/write_policy",
-        "key_path": "audit.write_policy",
+        "pointer": "/$defs/AuthConfig/properties/mode",
+        "key_path": "auth.mode",
         "path_kind": "property"
       },
-      "purpose": "Behavior when an audit record fails to write.\n\n`fail_closed` (default) fails the request with a stable error code so\nthat no request outcome is returned without a durable audit record.\n`availability_first` logs the failure and lets the request succeed for\ndeployments that explicitly accept best-effort audit durability.\nPer-route-family selection is out of scope; this is a single\ndeployment-wide policy.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -77158,15 +80401,14 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AuditWritePolicySchema",
+        "local_reference": "#/$defs/AuthMode",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -77208,15 +80450,15 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "const",
           "value": [
-            "availability_first",
-            "fail_closed",
-            "fail_closed_route_families"
+            "api_key",
+            "oidc"
           ]
         },
         {
@@ -77226,34 +80468,35 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AuditWritePolicySchema"
+        "pointer": "/$defs/AuthMode"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig/items",
-        "key_path": "consultation.audit_pseudonym_materials[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AuthConfig/properties/oidc",
+        "key_path": "auth.oidc",
+        "path_kind": "property"
       },
-      "purpose": "One public epoch id bound to one secret source reference.",
+      "purpose": "OIDC / OAuth2 resource-server configuration. The relay validates\nincoming bearer JWTs against a configured external IdP. No tokens\nare minted here.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/AuditPseudonymMaterialConfig",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -77302,45 +80545,44 @@
         {
           "keyword": "required",
           "value": [
-            "key_id",
-            "source"
+            "issuer",
+            "audiences"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/key_id",
-        "key_path": "consultation.audit_pseudonym_materials[].key_id",
+        "pointer": "/$defs/AuthFailureThrottleConfig/properties/enabled",
+        "key_path": "auth.failure_throttle.enabled",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
-        "local_reference": "#/$defs/AuditPseudonymKeyIdSchema",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -77386,45 +80628,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z0-9][a-z0-9._-]{0,63}$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymKeyIdSchema"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/source",
-        "key_path": "consultation.audit_pseudonym_materials[].source",
+        "pointer": "/$defs/AuthFailureThrottleConfig/properties/max_failures",
+        "key_path": "auth.failure_throttle.max_failures",
         "path_kind": "property"
       },
-      "purpose": "Closed v1 set of audit-pseudonym secret source providers.\n\nThe configured name is a reference only. Secret values cannot be embedded\nin this model and are loaded exactly once during runtime compilation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/AuditPseudonymSecretSourceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -77471,50 +80705,51 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "provider",
-            "name"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretSourceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/name",
-        "key_path": "consultation.audit_pseudonym_materials[].source.name",
+        "pointer": "/$defs/AuthFailureThrottleConfig/properties/window_seconds",
+        "key_path": "auth.failure_throttle.window_seconds",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a secret reference.\n\nDebug output is redacted even though the name is not itself key material,\npreventing configuration diagnostics from disclosing secret topology.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/AuditPseudonymSecretEnvironmentName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -77549,57 +80784,61 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/provider",
-        "key_path": "consultation.audit_pseudonym_materials[].source.provider",
+        "pointer": "/$defs/CatalogConfig/properties/authority_type",
+        "key_path": "catalog.authority_type",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "BRegDCAT-AP: type IRI for the `foaf:Agent` publisher. When set, emits\n`dcterms:type` on the publisher node.\n\nBRegDCAT-AP 2.1.0 SHACL checks publisher type values against the ADMS\npublishertype scheme (`http://purl.org/adms/publishertype/...`).\nThe relay does not enforce a vocabulary: any IRI passes through.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_catalog_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -77617,12 +80856,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -77634,49 +80873,47 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": "environment"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/api_keys",
-        "key_path": "auth.api_keys",
+        "pointer": "/$defs/CatalogConfig/properties/base_url",
+        "key_path": "catalog.base_url",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay catalog identity and public metadata exposed for governed discovery.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
+      "intent_profile": "relay_catalog_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -77721,44 +80958,44 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/api_keys/items",
-        "key_path": "auth.api_keys[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/CatalogConfig/properties/default_spatial_coverage",
+        "key_path": "catalog.default_spatial_coverage",
+        "path_kind": "property"
       },
-      "purpose": "One configured API key, identified by an id and a fingerprint reference.\nThe raw key never appears in config.",
+      "purpose": "BRegDCAT-AP: default `dcterms:spatial` IRI applied to datasets that\ndo not declare their own `spatial_coverage`. Typically an EU\nauthority country IRI under\n`http://publications.europa.eu/resource/authority/country/`.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
+      "intent_profile": "relay_catalog_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/ApiKeyConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -77776,12 +81013,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -77793,63 +81030,52 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "id",
-            "fingerprint"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/failure_throttle",
-        "key_path": "auth.failure_throttle",
+        "pointer": "/$defs/CatalogConfig/properties/participant_id",
+        "key_path": "catalog.participant_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Identifies the participant in catalog output; when omitted, Relay derives the participant identifier from the reviewed catalog base URL.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_catalog_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/AuthFailureThrottleConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -77867,12 +81093,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -77884,52 +81110,50 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/mode",
-        "key_path": "auth.mode",
+        "pointer": "/$defs/CatalogConfig/properties/publisher",
+        "key_path": "catalog.publisher",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_catalog_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AuthMode",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -77947,12 +81171,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -77964,60 +81188,49 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "api_key",
-            "oidc"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthMode"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/oidc",
-        "key_path": "auth.oidc",
+        "pointer": "/$defs/CatalogConfig/properties/publisher_iri",
+        "key_path": "catalog.publisher_iri",
         "path_kind": "property"
       },
-      "purpose": "OIDC / OAuth2 resource-server configuration. The relay validates\nincoming bearer JWTs against a configured external IdP. No tokens\nare minted here.",
+      "purpose": "BRegDCAT-AP: identifier IRI for the `foaf:Agent` publisher. Use a\ncontrolled-vocabulary corporate body IRI when publishing strict\nBRegDCAT-AP.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_catalog_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -78035,12 +81248,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78052,26 +81265,19 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "issuer",
-            "audiences"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -78079,31 +81285,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig/properties/enabled",
-        "key_path": "auth.failure_throttle.enabled",
+        "pointer": "/$defs/CatalogConfig/properties/title",
+        "key_path": "catalog.title",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_catalog_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -78121,12 +81326,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78138,48 +81343,47 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig/properties/max_failures",
-        "key_path": "auth.failure_throttle.max_failures",
+        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
+        "key_path": "config_trust.antirollback_state_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_config_trust_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -78214,60 +81418,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig/properties/window_seconds",
-        "key_path": "auth.failure_throttle.window_seconds",
+        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
+        "key_path": "config_trust.break_glass_override_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_config_trust_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -78302,61 +81497,52 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/authority_type",
-        "key_path": "catalog.authority_type",
+        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
+        "key_path": "config_trust.bundle_path",
         "path_kind": "property"
       },
-      "purpose": "BRegDCAT-AP: type IRI for the `foaf:Agent` publisher. When set, emits\n`dcterms:type` on the publisher node.\n\nBRegDCAT-AP 2.1.0 SHACL checks publisher type values against the ADMS\npublishertype scheme (`http://purl.org/adms/publishertype/...`).\nThe relay does not enforce a vocabulary: any IRI passes through.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_public",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_config_trust_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -78374,12 +81560,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78391,33 +81577,32 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/base_url",
-        "key_path": "catalog.base_url",
+        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
+        "key_path": "config_trust.trust_anchor_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay catalog identity and public metadata exposed for governed discovery.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_catalog_sensitive",
+      "intent_profile": "relay_config_trust_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -78488,32 +81673,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/default_spatial_coverage",
-        "key_path": "catalog.default_spatial_coverage",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence",
+        "key_path": "consultation.artifacts.evidence",
         "path_kind": "property"
       },
-      "purpose": "BRegDCAT-AP: default `dcterms:spatial` IRI applied to datasets that\ndo not declare their own `spatial_coverage`. Typically an EU\nauthority country IRI under\n`http://publications.europa.eu/resource/authority/country/`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_public",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -78531,12 +81714,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78548,52 +81731,48 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/participant_id",
-        "key_path": "catalog.participant_id",
-        "path_kind": "property"
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence/items",
+        "key_path": "consultation.artifacts.evidence[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Identifies the participant in catalog output; when omitted, Relay derives the participant identifier from the reviewed catalog base URL.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_catalog_public",
+      "purpose": "One bounded, hash-pinned integration evidence file.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationEvidenceArtifactConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -78611,12 +81790,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78628,50 +81807,59 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "class",
+            "path",
+            "sha256"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/publisher",
-        "key_path": "catalog.publisher",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs",
+        "key_path": "consultation.artifacts.integration_packs",
         "path_kind": "property"
       },
-      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_catalog_public",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -78689,12 +81877,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78706,49 +81894,48 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/publisher_iri",
-        "key_path": "catalog.publisher_iri",
-        "path_kind": "property"
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs/items",
+        "key_path": "consultation.artifacts.integration_packs[]",
+        "path_kind": "array_item"
       },
-      "purpose": "BRegDCAT-AP: identifier IRI for the `foaf:Agent` publisher. Use a\ncontrolled-vocabulary corporate body IRI when publishing strict\nBRegDCAT-AP.",
+      "purpose": "One hash-pinned public contract or reviewed integration pack.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_public",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -78766,12 +81953,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78783,50 +81970,59 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "path",
+            "hash",
+            "sha256"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/title",
-        "key_path": "catalog.title",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings",
+        "key_path": "consultation.artifacts.private_bindings",
         "path_kind": "property"
       },
-      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_catalog_public",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -78844,12 +82040,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78861,47 +82057,48 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
-        "key_path": "config_trust.antirollback_state_path",
-        "path_kind": "property"
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings/items",
+        "key_path": "consultation.artifacts.private_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
+      "purpose": "One hash-pinned public contract or reviewed integration pack.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -78936,51 +82133,59 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path",
+            "hash",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
-        "key_path": "config_trust.break_glass_override_path",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts",
+        "key_path": "consultation.artifacts.public_contracts",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -79015,52 +82220,48 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
-        "key_path": "config_trust.bundle_path",
-        "path_kind": "property"
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts/items",
+        "key_path": "consultation.artifacts.public_contracts[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
+      "purpose": "One hash-pinned public contract or reviewed integration pack.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -79095,49 +82296,60 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path",
+            "hash",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
-        "key_path": "config_trust.trust_anchor_path",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts",
+        "key_path": "consultation.artifacts.rhai_scripts",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -79172,46 +82384,45 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence",
-        "key_path": "consultation.artifacts.evidence",
-        "path_kind": "property"
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts/items",
+        "key_path": "consultation.artifacts.rhai_scripts[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "One hash-pinned private binding or standalone Rhai script.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationArtifactReferenceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -79257,40 +82468,50 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactReferenceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence/items",
-        "key_path": "consultation.artifacts.evidence[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.rhai_scripts[].path",
+        "path_kind": "property"
       },
-      "purpose": "One bounded, hash-pinned integration evidence file.",
+      "purpose": "Normalized bundle-root-relative path.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ConsultationEvidenceArtifactConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -79325,54 +82546,45 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "class",
-            "path",
-            "sha256"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs",
-        "key_path": "consultation.artifacts.integration_packs",
+        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.rhai_scripts[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -79420,37 +82632,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs/items",
-        "key_path": "consultation.artifacts.integration_packs[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ConsultationConfig/properties/artifacts",
+        "key_path": "consultation.artifacts",
+        "path_kind": "property"
       },
-      "purpose": "One hash-pinned public contract or reviewed integration pack.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -79499,30 +82716,30 @@
         {
           "keyword": "required",
           "value": [
-            "path",
-            "hash",
-            "sha256"
+            "public_contracts",
+            "integration_packs",
+            "private_bindings",
+            "evidence"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings",
-        "key_path": "consultation.artifacts.private_bindings",
+        "pointer": "/$defs/ConsultationConfig/properties/audit_pseudonym_materials",
+        "key_path": "consultation.audit_pseudonym_materials",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Bounded startup catalog of audit-pseudonym material references.\n\nThe 1..=32 bound and cross-entry uniqueness are enforced by config\nvalidation and repeated by the material provider before loading secrets.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -79531,6 +82748,7 @@
         "schema_types": [
           "array"
         ],
+        "local_reference": "#/$defs/AuditPseudonymMaterialCatalogConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -79587,17 +82805,21 @@
           "keyword": "type",
           "value": "array"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings/items",
-        "key_path": "consultation.artifacts.private_bindings[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ConsultationConfig/properties/authorized_workload",
+        "key_path": "consultation.authorized_workload",
+        "path_kind": "property"
       },
-      "purpose": "One hash-pinned public contract or reviewed integration pack.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -79606,14 +82828,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
+        "local_reference": "#/$defs/ConsultationWorkloadConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -79662,9 +82884,10 @@
         {
           "keyword": "required",
           "value": [
-            "path",
-            "hash",
-            "sha256"
+            "audience",
+            "client_claim_selector",
+            "client_value",
+            "principal_id"
           ]
         },
         {
@@ -79674,19 +82897,19 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+        "pointer": "/$defs/ConsultationWorkloadConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts",
-        "key_path": "consultation.artifacts.public_contracts",
+        "pointer": "/$defs/ConsultationConfig/properties/source_credentials",
+        "key_path": "consultation.source_credentials",
         "path_kind": "property"
       },
       "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -79694,16 +82917,18 @@
         "schema_types": [
           "array"
         ],
+        "local_reference": "#/$defs/ConsultationSourceCredentialCatalogConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -79738,11 +82963,14 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -79750,17 +82978,21 @@
           "keyword": "type",
           "value": "array"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts/items",
-        "key_path": "consultation.artifacts.public_contracts[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ConsultationConfig/properties/state_plane",
+        "key_path": "consultation.state_plane",
+        "path_kind": "property"
       },
-      "purpose": "One hash-pinned public contract or reviewed integration pack.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -79769,14 +83001,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
+        "local_reference": "#/$defs/ConsultationStatePlaneConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -79825,9 +83057,10 @@
         {
           "keyword": "required",
           "value": [
-            "path",
-            "hash",
-            "sha256"
+            "database_url_env",
+            "chain_key_epoch_id",
+            "serving_fence_lock_key",
+            "audit_pseudonym_keyring_lock_key"
           ]
         },
         {
@@ -79837,93 +83070,17 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+        "pointer": "/$defs/ConsultationStatePlaneConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts",
-        "key_path": "consultation.artifacts.rhai_scripts",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/class",
+        "key_path": "consultation.artifacts.evidence[].class",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts/items",
-        "key_path": "consultation.artifacts.rhai_scripts[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One hash-pinned private binding or standalone Rhai script.",
+      "purpose": "Closed evidence classes understood by consultation source-plan v1.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
@@ -79931,16 +83088,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ConsultationArtifactReferenceConfig",
+        "local_reference": "#/$defs/ConsultationEvidenceClassConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -79987,31 +83144,32 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "path",
-            "sha256"
+            "conformance",
+            "negative_security",
+            "minimization"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactReferenceConfig"
+        "pointer": "/$defs/ConsultationEvidenceClassConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.rhai_scripts[].path",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/path",
+        "key_path": "consultation.artifacts.evidence[].path",
         "path_kind": "property"
       },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -80084,12 +83242,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.rhai_scripts[].sha256",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/sha256",
+        "key_path": "consultation.artifacts.evidence[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -80163,32 +83321,31 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/artifacts",
-        "key_path": "consultation.artifacts",
-        "path_kind": "property"
+        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig/items",
+        "key_path": "consultation.source_credentials[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Closed V1 source-credential provider configuration.\n\nEnvironment names are opaque references and are redacted from `Debug`.\nThere is deliberately no field capable of carrying an embedded username,\npassword, bearer token, or provider-specific extension.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/ConsultationSourceCredentialConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -80223,50 +83380,75 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "public_contracts",
-            "integration_packs",
-            "private_bindings",
-            "evidence"
+            [
+              "type",
+              "ref",
+              "generation",
+              "client_id_env",
+              "client_secret_env"
+            ],
+            [
+              "type",
+              "ref",
+              "generation",
+              "token_env"
+            ],
+            [
+              "type",
+              "ref",
+              "generation",
+              "username_env",
+              "password_env"
+            ],
+            [
+              "type",
+              "ref",
+              "generation",
+              "value_env"
+            ]
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/audit_pseudonym_materials",
-        "key_path": "consultation.audit_pseudonym_materials",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/generation",
+        "key_path": "consultation.source_credentials[].generation",
         "path_kind": "property"
       },
-      "purpose": "Bounded startup catalog of audit-pseudonym material references.\n\nThe 1..=32 bound and cross-entry uniqueness are enforced by config\nvalidation and repeated by the material provider before loading secrets.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
-        "local_reference": "#/$defs/AuditPseudonymMaterialCatalogConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -80275,8 +83457,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -80311,52 +83493,63 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/authorized_workload",
-        "key_path": "consultation.authorized_workload",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/password_env",
+        "key_path": "consultation.source_credentials[].password_env",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ConsultationWorkloadConfig",
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -80391,59 +83584,55 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "audience",
-            "client_claim_selector",
-            "client_value",
-            "principal_id"
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig"
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/source_credentials",
-        "key_path": "consultation.source_credentials",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/ref",
+        "key_path": "consultation.source_credentials[].ref",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Exact private-binding credential reference grammar.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/ConsultationSourceCredentialCatalogConfig",
+        "local_reference": "#/$defs/ConsultationSourceCredentialReference",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -80492,44 +83681,47 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig"
+        "pointer": "/$defs/ConsultationSourceCredentialReference"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/state_plane",
-        "key_path": "consultation.state_plane",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/type",
+        "key_path": "consultation.source_credentials[].type",
         "path_kind": "property"
       },
       "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ConsultationStatePlaneConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -80564,43 +83756,43 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "const",
           "value": [
-            "database_url_env",
-            "chain_key_epoch_id",
-            "serving_fence_lock_key",
-            "audit_pseudonym_keyring_lock_key"
+            "api_key_header",
+            "api_key_query",
+            "basic",
+            "oauth_client_credentials",
+            "static_bearer"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/class",
-        "key_path": "consultation.artifacts.evidence[].class",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/username_env",
+        "key_path": "consultation.source_credentials[].username_env",
         "path_kind": "property"
       },
-      "purpose": "Closed evidence classes understood by consultation source-plan v1.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -80608,7 +83800,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationEvidenceClassConfig",
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
@@ -80617,8 +83809,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -80653,21 +83845,19 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "conformance",
-            "negative_security",
-            "minimization"
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
@@ -80676,19 +83866,19 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceClassConfig"
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/path",
-        "key_path": "consultation.artifacts.evidence[].path",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/1/properties/token_env",
+        "key_path": "consultation.source_credentials[].token_env",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -80696,16 +83886,17 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -80747,26 +83938,33 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/sha256",
-        "key_path": "consultation.artifacts.evidence[].sha256",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/2/properties/value_env",
+        "key_path": "consultation.source_credentials[].value_env",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -80774,6 +83972,7 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
@@ -80782,8 +83981,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -80818,52 +84017,58 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig/items",
-        "key_path": "consultation.source_credentials[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_id_env",
+        "key_path": "consultation.source_credentials[].client_id_env",
+        "path_kind": "property"
       },
-      "purpose": "Closed V1 source-credential provider configuration.\n\nEnvironment names are opaque references and are redacted from `Debug`.\nThere is deliberately no field capable of carrying an embedded username,\npassword, bearer token, or provider-specific extension.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ConsultationSourceCredentialConfig",
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -80905,78 +84110,51 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "ref",
-              "generation",
-              "client_id_env",
-              "client_secret_env"
-            ],
-            [
-              "type",
-              "ref",
-              "generation",
-              "token_env"
-            ],
-            [
-              "type",
-              "ref",
-              "generation",
-              "username_env",
-              "password_env"
-            ],
-            [
-              "type",
-              "ref",
-              "generation",
-              "value_env"
-            ]
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig"
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/generation",
-        "key_path": "consultation.source_credentials[].generation",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_secret_env",
+        "key_path": "consultation.source_credentials[].client_secret_env",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -81018,56 +84196,50 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/password_env",
-        "key_path": "consultation.source_credentials[].password_env",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/audit_pseudonym_keyring_lock_key",
+        "key_path": "consultation.state_plane.audit_pseudonym_keyring_lock_key",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81109,32 +84281,37 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+          "keyword": "format",
+          "value": "int64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/ref",
-        "key_path": "consultation.source_credentials[].ref",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/chain_key_epoch_id",
+        "key_path": "consultation.state_plane.chain_key_epoch_id",
         "path_kind": "property"
       },
-      "purpose": "Exact private-binding credential reference grammar.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -81143,12 +84320,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationSourceCredentialReference",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -81199,30 +84375,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialReference"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/type",
-        "key_path": "consultation.source_credentials[].type",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/database_url_env",
+        "key_path": "consultation.state_plane.database_url_env",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "purpose": "Portable environment-variable name that resolves the state-plane URL.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -81230,6 +84398,7 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationDatabaseUrlEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
@@ -81239,7 +84408,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -81281,54 +84450,52 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": [
-            "api_key_header",
-            "api_key_query",
-            "basic",
-            "oauth_client_credentials",
-            "static_bearer"
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationDatabaseUrlEnvironmentName"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/username_env",
-        "key_path": "consultation.source_credentials[].username_env",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/root_certificate_path",
+        "key_path": "consultation.state_plane.root_certificate_path",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81370,51 +84537,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/1/properties/token_env",
-        "key_path": "consultation.source_credentials[].token_env",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/serving_fence_lock_key",
+        "key_path": "consultation.state_plane.serving_fence_lock_key",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81456,33 +84618,38 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+          "keyword": "format",
+          "value": "int64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/2/properties/value_env",
-        "key_path": "consultation.source_credentials[].value_env",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
+        "key_path": "consultation.artifacts.integration_packs[].hash",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -81490,7 +84657,6 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
@@ -81500,7 +84666,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81542,33 +84708,30 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+          "value": "^sha256:[0-9a-f]{64}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_id_env",
-        "key_path": "consultation.source_credentials[].client_id_env",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
+        "key_path": "consultation.artifacts.private_bindings[].hash",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -81576,7 +84739,6 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
@@ -81586,7 +84748,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81628,33 +84790,30 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+          "value": "^sha256:[0-9a-f]{64}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_secret_env",
-        "key_path": "consultation.source_credentials[].client_secret_env",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
+        "key_path": "consultation.artifacts.public_contracts[].hash",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -81662,7 +84821,6 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
@@ -81672,7 +84830,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81714,45 +84872,42 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+          "value": "^sha256:[0-9a-f]{64}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/audit_pseudonym_keyring_lock_key",
-        "key_path": "consultation.state_plane.audit_pseudonym_keyring_lock_key",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.integration_packs[].path",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Normalized bundle-root-relative path.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -81803,33 +84958,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/chain_key_epoch_id",
-        "key_path": "consultation.state_plane.chain_key_epoch_id",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.private_bindings[].path",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Normalized bundle-root-relative path.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -81902,13 +85045,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/database_url_env",
-        "key_path": "consultation.state_plane.database_url_env",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.public_contracts[].path",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name that resolves the state-plane URL.",
+      "purpose": "Normalized bundle-root-relative path.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -81916,17 +85059,16 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationDatabaseUrlEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81968,52 +85110,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationDatabaseUrlEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/root_certificate_path",
-        "key_path": "consultation.state_plane.root_certificate_path",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.integration_packs[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -82048,53 +85181,51 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/serving_fence_lock_key",
-        "key_path": "consultation.state_plane.serving_fence_lock_key",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.private_bindings[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -82129,45 +85260,34 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "int64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
-        "key_path": "consultation.artifacts.integration_packs[].hash",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.public_contracts[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -82183,8 +85303,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -82219,14 +85339,11 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -82243,12 +85360,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
-        "key_path": "consultation.artifacts.private_bindings[].hash",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/audience",
+        "key_path": "consultation.authorized_workload.audience",
         "path_kind": "property"
       },
-      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -82261,7 +85378,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -82312,10 +85429,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -82325,13 +85438,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
-        "key_path": "consultation.artifacts.public_contracts[].hash",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_claim_selector",
+        "key_path": "consultation.authorized_workload.client_claim_selector",
         "path_kind": "property"
       },
-      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
+      "purpose": "Closed set of verified OAuth claims that may identify Registry Notary.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -82339,6 +85452,7 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationClientClaimSelectorConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -82347,8 +85461,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -82383,36 +85497,40 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
+          "keyword": "enum",
+          "value": [
+            "azp",
+            "client_id"
+          ]
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationClientClaimSelectorConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.integration_packs[].path",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_value",
+        "key_path": "consultation.authorized_workload.client_value",
         "path_kind": "property"
       },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -82485,12 +85603,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.private_bindings[].path",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/principal_id",
+        "key_path": "consultation.authorized_workload.principal_id",
         "path_kind": "property"
       },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -82563,27 +85681,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.public_contracts[].path",
+        "pointer": "/$defs/CorsConfig/properties/allowed_origins",
+        "key_path": "server.cors.allowed_origins",
         "path_kind": "property"
       },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_server_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -82634,20 +85753,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.integration_packs[].sha256",
-        "path_kind": "property"
+        "pointer": "/$defs/CorsConfig/properties/allowed_origins/items",
+        "key_path": "server.cors.allowed_origins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_server_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -82657,14 +85776,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -82699,18 +85818,17 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -82720,13 +85838,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.private_bindings[].sha256",
+        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/name",
+        "key_path": "auth.api_keys[].fingerprint.name",
         "path_kind": "property"
       },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -82734,6 +85852,7 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/RuntimeEnvironmentNameSchema",
         "composed": false
       },
       "requiredness": "required",
@@ -82742,8 +85861,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -82778,34 +85897,40 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
+          "value": "^[^=\\x00]+$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RuntimeEnvironmentNameSchema"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.public_contracts[].sha256",
+        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/provider",
+        "key_path": "auth.api_keys[].fingerprint.provider",
         "path_kind": "property"
       },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -82821,8 +85946,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -82857,17 +85982,22 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
+          "keyword": "const",
+          "value": [
+            "env",
+            "file"
+          ]
         },
         {
           "keyword": "type",
@@ -82878,13 +86008,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/audience",
-        "key_path": "consultation.authorized_workload.audience",
+        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/1/properties/path",
+        "key_path": "auth.api_keys[].fingerprint.path",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "intent_profile": "relay_auth_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -82901,7 +86031,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -82943,8 +86073,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
@@ -82956,28 +86085,29 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_claim_selector",
-        "key_path": "consultation.authorized_workload.client_claim_selector",
+        "pointer": "/$defs/CsvFormatConfig/properties/delimiter",
+        "key_path": "datasets[].tables[].source.format.csv.delimiter",
         "path_kind": "property"
       },
-      "purpose": "Closed set of verified OAuth claims that may identify Registry Notary.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
-        "local_reference": "#/$defs/ConsultationClientClaimSelectorConfig",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -83024,49 +86154,55 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "azp",
-            "client_id"
-          ]
+          "keyword": "format",
+          "value": "uint8"
+        },
+        {
+          "keyword": "maximum",
+          "value": 255
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationClientClaimSelectorConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_value",
-        "key_path": "consultation.authorized_workload.client_value",
+        "pointer": "/$defs/CsvFormatConfig/properties/header_row",
+        "key_path": "datasets[].tables[].source.format.csv.header_row",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83101,50 +86237,64 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/principal_id",
-        "key_path": "consultation.authorized_workload.principal_id",
+        "pointer": "/$defs/CsvFormatConfig/properties/quote",
+        "key_path": "datasets[].tables[].source.format.csv.quote",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83179,51 +86329,63 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint8"
+        },
+        {
+          "keyword": "maximum",
+          "value": 255
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CorsConfig/properties/allowed_origins",
-        "key_path": "server.cors.allowed_origins",
+        "pointer": "/$defs/DatasetConfig/properties/access_rights",
+        "key_path": "datasets[].access_rights",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
+      "purpose": "Access rights classification, mirrors DCAT-AP `dcterms:accessRights`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/AccessRights",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83258,50 +86420,60 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "public",
+            "restricted",
+            "non_public"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AccessRights"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CorsConfig/properties/allowed_origins/items",
-        "key_path": "server.cors.allowed_origins[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DatasetConfig/properties/aggregates",
+        "key_path": "datasets[].aggregates",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83336,51 +86508,48 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/name",
-        "key_path": "auth.api_keys[].fingerprint.name",
-        "path_kind": "property"
+        "pointer": "/$defs/DatasetConfig/properties/aggregates/items",
+        "key_path": "datasets[].aggregates[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
+      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/RuntimeEnvironmentNameSchema",
+        "local_reference": "#/$defs/AggregateConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83415,57 +86584,60 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[^=\\x00]+$"
+          "keyword": "required",
+          "value": [
+            "id",
+            "description",
+            "disclosure_control"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/RuntimeEnvironmentNameSchema"
+        "pointer": "/$defs/AggregateConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/provider",
-        "key_path": "auth.api_keys[].fingerprint.provider",
+        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation",
+        "key_path": "datasets[].applicable_legislation",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
+      "purpose": "DCAT-AP `dcatap:applicableLegislation` IRIs. This is evidence\npublished for standard consumers, not an application-specific\nauthorization or source-of-truth verdict.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83500,39 +86672,30 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "env",
-            "file"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/1/properties/path",
-        "key_path": "auth.api_keys[].fingerprint.path",
-        "path_kind": "property"
+        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation/items",
+        "key_path": "datasets[].applicable_legislation[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -83542,14 +86705,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83584,14 +86747,12 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -83603,8 +86764,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CsvFormatConfig/properties/delimiter",
-        "key_path": "datasets[].tables[].source.format.csv.delimiter",
+        "pointer": "/$defs/DatasetConfig/properties/conforms_to",
+        "key_path": "datasets[].conforms_to",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -83615,13 +86776,12 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -83671,33 +86831,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint8"
-        },
-        {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CsvFormatConfig/properties/header_row",
-        "key_path": "datasets[].tables[].source.format.csv.header_row",
-        "path_kind": "property"
+        "pointer": "/$defs/DatasetConfig/properties/conforms_to/items",
+        "key_path": "datasets[].conforms_to[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -83707,17 +86852,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -83763,53 +86906,38 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CsvFormatConfig/properties/quote",
-        "key_path": "datasets[].tables[].source.format.csv.quote",
+        "pointer": "/$defs/DatasetConfig/properties/defaults",
+        "key_path": "datasets[].defaults",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Optional table defaults for reducing repetition within one dataset.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "object"
         ],
+        "local_reference": "#/$defs/DatasetDefaultsConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -83855,36 +86983,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint8"
-        },
-        {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetDefaultsConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/access_rights",
-        "key_path": "datasets[].access_rights",
+        "pointer": "/$defs/DatasetConfig/properties/description",
+        "key_path": "datasets[].description",
         "path_kind": "property"
       },
-      "purpose": "Access rights classification, mirrors DCAT-AP `dcterms:accessRights`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -83893,12 +87010,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AccessRights",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -83946,29 +87062,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "public",
-            "restricted",
-            "non_public"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AccessRights"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/aggregates",
-        "key_path": "datasets[].aggregates",
+        "pointer": "/$defs/DatasetConfig/properties/entities",
+        "key_path": "datasets[].entities",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -84043,12 +87147,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/aggregates/items",
-        "key_path": "datasets[].aggregates[]",
+        "pointer": "/$defs/DatasetConfig/properties/entities/items",
+        "key_path": "datasets[].entities[]",
         "path_kind": "array_item"
       },
-      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -84057,7 +87161,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateConfig",
+        "local_reference": "#/$defs/EntityConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -84113,9 +87217,10 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "description",
-            "disclosure_control"
+            "name",
+            "table",
+            "access",
+            "api"
           ]
         },
         {
@@ -84125,17 +87230,17 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig"
+        "pointer": "/$defs/EntityConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation",
-        "key_path": "datasets[].applicable_legislation",
+        "pointer": "/$defs/DatasetConfig/properties/id",
+        "key_path": "datasets[].id",
         "path_kind": "property"
       },
-      "purpose": "DCAT-AP `dcatap:applicableLegislation` IRIs. This is evidence\npublished for standard consumers, not an application-specific\nauthorization or source-of-truth verdict.",
+      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -84143,16 +87248,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84198,18 +87303,26 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation/items",
-        "key_path": "datasets[].applicable_legislation[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DatasetConfig/properties/owner",
+        "key_path": "datasets[].owner",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -84223,11 +87336,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84282,12 +87395,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/conforms_to",
-        "key_path": "datasets[].conforms_to",
+        "pointer": "/$defs/DatasetConfig/properties/public_services",
+        "key_path": "datasets[].public_services",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "CPSV public services that produce this dataset. Registry Relay emits\nthem as standard `cpsv:PublicService` nodes; consumers decide how to\ninterpret that evidence.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -84302,8 +87415,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84358,8 +87471,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/conforms_to/items",
-        "key_path": "datasets[].conforms_to[]",
+        "pointer": "/$defs/DatasetConfig/properties/public_services/items",
+        "key_path": "datasets[].public_services[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -84370,13 +87483,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/PublicServiceConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
@@ -84424,20 +87538,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "title"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/PublicServiceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/defaults",
-        "key_path": "datasets[].defaults",
+        "pointer": "/$defs/DatasetConfig/properties/sensitivity",
+        "key_path": "datasets[].sensitivity",
         "path_kind": "property"
       },
-      "purpose": "Optional table defaults for reducing repetition within one dataset.",
+      "purpose": "Sensitivity classification. Operator-defined values cover common\npersonal and public dataset classifications in V1.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -84445,17 +87569,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DatasetDefaultsConfig",
+        "local_reference": "#/$defs/Sensitivity",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84501,40 +87624,52 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "public",
+            "internal",
+            "personal",
+            "confidential",
+            "secret"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetDefaultsConfig"
+        "pointer": "/$defs/Sensitivity"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/description",
-        "key_path": "datasets[].description",
+        "pointer": "/$defs/DatasetConfig/properties/spatial_coverage",
+        "key_path": "datasets[].spatial_coverage",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "BRegDCAT-AP: `dct:spatial` IRI for this dataset. Overrides the\ncatalog-level `default_spatial_coverage` when set.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84582,35 +87717,39 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/entities",
-        "key_path": "datasets[].entities",
+        "pointer": "/$defs/DatasetConfig/properties/status",
+        "key_path": "datasets[].status",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Publishes the dataset lifecycle status; when omitted, Relay emits its weakest lifecycle claim instead of inferring a stronger status.",
+      "purpose_source": "reviewed_override",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84656,18 +87795,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "under_development",
+            "completed",
+            "deprecated",
+            "withdrawn"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/entities/items",
-        "key_path": "datasets[].entities[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DatasetConfig/properties/tables",
+        "key_path": "datasets[].tables",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -84677,16 +87828,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/EntityConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84732,33 +87883,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "table",
-            "access",
-            "api"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/id",
-        "key_path": "datasets[].id",
-        "path_kind": "property"
+        "pointer": "/$defs/DatasetConfig/properties/tables/items",
+        "key_path": "datasets[].tables[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
+      "purpose": "One private storage table under a dataset.\n\nThe public API should not expose these ids. Entity config maps one\nresource into one domain resource, with optional field renaming and\nrelationship declarations.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -84766,16 +87904,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/DatasetId",
+        "local_reference": "#/$defs/ResourceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84822,24 +87960,28 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
+          "keyword": "required",
+          "value": [
+            "id",
+            "source",
+            "schema"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetId"
+        "pointer": "/$defs/ResourceConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/owner",
-        "key_path": "datasets[].owner",
+        "pointer": "/$defs/DatasetConfig/properties/title",
+        "key_path": "datasets[].title",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -84906,111 +88048,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/public_services",
-        "key_path": "datasets[].public_services",
-        "path_kind": "property"
-      },
-      "purpose": "CPSV public services that produce this dataset. Registry Relay emits\nthem as standard `cpsv:PublicService` nodes; consumers decide how to\ninterpret that evidence.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/public_services/items",
-        "key_path": "datasets[].public_services[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DatasetConfig/properties/update_frequency",
+        "key_path": "datasets[].update_frequency",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Update cadence; mirrors DCAT-AP `dcterms:accrualPeriodicity`. The\nV1 set is the codes used by the example plus the common alternates.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/PublicServiceConfig",
+        "local_reference": "#/$defs/UpdateFrequency",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85057,29 +88123,38 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "title"
+            "continuous",
+            "daily",
+            "weekly",
+            "termly",
+            "monthly",
+            "quarterly",
+            "annual",
+            "irregular",
+            "as_needed",
+            "unknown"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig"
+        "pointer": "/$defs/UpdateFrequency"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/sensitivity",
-        "key_path": "datasets[].sensitivity",
+        "pointer": "/$defs/DatasetDefaultsConfig/properties/materialization",
+        "key_path": "datasets[].defaults.materialization",
         "path_kind": "property"
       },
-      "purpose": "Sensitivity classification. Operator-defined values cover common\npersonal and public dataset classifications in V1.",
+      "purpose": "How a configured private table is registered for query planning.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -85087,16 +88162,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/Sensitivity",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85145,32 +88221,27 @@
         {
           "keyword": "enum",
           "value": [
-            "public",
-            "internal",
-            "personal",
-            "confidential",
-            "secret"
+            "snapshot"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "string"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Sensitivity"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/spatial_coverage",
-        "key_path": "datasets[].spatial_coverage",
+        "pointer": "/$defs/DatasetDefaultsConfig/properties/refresh",
+        "key_path": "datasets[].defaults.refresh",
         "path_kind": "property"
       },
-      "purpose": "BRegDCAT-AP: `dct:spatial` IRI for this dataset. Overrides the\ncatalog-level `default_spatial_coverage` when set.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -85178,16 +88249,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85233,11 +88304,23 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "mode",
+              "interval"
+            ],
+            [
+              "mode"
+            ]
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -85245,13 +88328,94 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/status",
-        "key_path": "datasets[].status",
+        "pointer": "/$defs/DeploymentConfig/properties/evidence",
+        "key_path": "deployment.evidence",
         "path_kind": "property"
       },
-      "purpose": "Publishes the dataset lifecycle status; when omitted, Relay emits its weakest lifecycle claim instead of inferring a stronger status.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/DeploymentEvidenceConfig",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig"
+      }
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentConfig/properties/profile",
+        "key_path": "deployment.profile",
+        "path_kind": "property"
+      },
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -85316,10 +88480,10 @@
         {
           "keyword": "enum",
           "value": [
-            "under_development",
-            "completed",
-            "deprecated",
-            "withdrawn"
+            "local",
+            "hosted_lab",
+            "production",
+            "evidence_grade"
           ]
         },
         {
@@ -85334,13 +88498,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/tables",
-        "key_path": "datasets[].tables",
+        "pointer": "/$defs/DeploymentConfig/properties/waivers",
+        "key_path": "deployment.waivers",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Per-deployment waivers. Each names one finding id, a required operator\nreference, an optional summary, and a mandatory expiry date. Expired\nwaivers stop suppressing their finding and raise\n`deployment.waiver_expired`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -85410,13 +88574,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/tables/items",
-        "key_path": "datasets[].tables[]",
+        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
+        "key_path": "deployment.waivers[]",
         "path_kind": "array_item"
       },
-      "purpose": "One private storage table under a dataset.\n\nThe public API should not expose these ids. Entity config maps one\nresource into one domain resource, with optional field renaming and\nrelationship declarations.",
+      "purpose": "One declared waiver. `expires` is an ISO 8601 `YYYY-MM-DD` date; format is\nvalidated at load time. The reference and optional summary are validated by\nthe shared operations contract before either can reach posture or logs.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -85424,7 +88588,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ResourceConfig",
+        "local_reference": "#/$defs/DeploymentWaiverConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -85480,9 +88644,9 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "source",
-            "schema"
+            "finding",
+            "reference",
+            "expires"
           ]
         },
         {
@@ -85492,36 +88656,37 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig"
+        "pointer": "/$defs/DeploymentWaiverConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/title",
-        "key_path": "datasets[].title",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/api_key_rotation",
+        "key_path": "deployment.evidence.api_key_rotation",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Operator asserts an API-key rotation process is in place.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -85556,48 +88721,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/update_frequency",
-        "key_path": "datasets[].update_frequency",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
+        "key_path": "deployment.evidence.audit_ack_cursor_path",
         "path_kind": "property"
       },
-      "purpose": "Update cadence; mirrors DCAT-AP `dcterms:accrualPeriodicity`. The\nV1 set is the codes used by the example plus the common alternates.",
+      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. When set, the runtime reads it to\nobserve shipping freshness and surfaces it as posture shipping health;\nabsent, shipping health stays `unverified` and only the declared\nshipping target is reported.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_deployment_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/UpdateFrequency",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -85632,65 +88800,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "continuous",
-            "daily",
-            "weekly",
-            "termly",
-            "monthly",
-            "quarterly",
-            "annual",
-            "irregular",
-            "as_needed",
-            "unknown"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/UpdateFrequency"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetDefaultsConfig/properties/materialization",
-        "key_path": "datasets[].defaults.materialization",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
+        "key_path": "deployment.evidence.audit_ack_max_age_secs",
         "path_kind": "property"
       },
-      "purpose": "How a configured private table is registered for query planning.",
+      "purpose": "Optional freshness window in seconds for the ack cursor's `acked_at`\ntimestamp. Defaults to `DEFAULT_AUDIT_ACK_MAX_AGE` (900) when unset. A\nwindow without `audit_ack_cursor_path` is rejected at load, since a\nfreshness window is meaningless without a cursor to observe.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer",
+          "null"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85737,16 +88891,22 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "snapshot"
-          ]
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "string"
+            "integer",
+            "null"
           ]
         }
       ]
@@ -85754,29 +88914,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetDefaultsConfig/properties/refresh",
-        "key_path": "datasets[].defaults.refresh",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
+        "key_path": "deployment.evidence.audit_offhost_shipping",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Operator asserts audit records are shipped off-host (for example to a\nlog collector or SIEM) rather than relying solely on local retention.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "boolean"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85822,53 +88981,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "mode",
-              "interval"
-            ],
-            [
-              "mode"
-            ]
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/evidence",
-        "key_path": "deployment.evidence",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/ingress_rate_limit",
+        "key_path": "deployment.evidence.ingress_rate_limit",
         "path_kind": "property"
       },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Operator asserts ingress rate limiting is enforced (for example by a\ngateway or reverse proxy in front of the relay).",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/DeploymentEvidenceConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85916,19 +89059,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/profile",
-        "key_path": "deployment.profile",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
+        "key_path": "deployment.waivers[].expires",
         "path_kind": "property"
       },
       "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
@@ -85939,17 +89078,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85995,49 +89132,36 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "local",
-            "hosted_lab",
-            "production",
-            "evidence_grade"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers",
-        "key_path": "deployment.waivers",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
+        "key_path": "deployment.waivers[].finding",
         "path_kind": "property"
       },
-      "purpose": "Per-deployment waivers. Each names one finding id, a required operator\nreference, an optional summary, and a mandatory expiry date. Expired\nwaivers stop suppressing their finding and raise\n`deployment.waiver_expired`.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86085,35 +89209,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
-        "key_path": "deployment.waivers[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
+        "key_path": "deployment.waivers[].reference",
+        "path_kind": "property"
       },
-      "purpose": "One declared waiver. `expires` is an ISO 8601 `YYYY-MM-DD` date; format is\nvalidated at load time. The reference and optional summary are validated by\nthe shared operations contract before either can reach posture or logs.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverConfig",
+        "local_reference": "#/$defs/DeploymentWaiverReference",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86160,51 +89284,56 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "finding",
-            "reference",
-            "expires"
-          ]
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig"
+        "pointer": "/$defs/DeploymentWaiverReference"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/api_key_rotation",
-        "key_path": "deployment.evidence.api_key_rotation",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
+        "key_path": "deployment.waivers[].summary",
         "path_kind": "property"
       },
-      "purpose": "Operator asserts an API-key rotation process is in place.",
+      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_sensitive",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/DeploymentWaiverSummary",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -86239,51 +89368,60 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverSummary"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
-        "key_path": "deployment.evidence.audit_ack_cursor_path",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method",
+        "key_path": "datasets[].aggregates[].disclosure_control.method",
         "path_kind": "property"
       },
-      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. When set, the runtime reads it to\nobserve shipping freshness and surfaces it as posture shipping health;\nabsent, shipping health stays `unverified` and only the declared\nshipping target is reported.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_sensitive",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -86318,47 +89456,41 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
-        "key_path": "deployment.evidence.audit_ack_max_age_secs",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method",
         "path_kind": "property"
       },
-      "purpose": "Optional freshness window in seconds for the ack cursor's `acked_at`\ntimestamp. Defaults to `DEFAULT_AUDIT_ACK_MAX_AGE` (900) when unset. A\nwindow without `audit_ack_cursor_path` is rejected at load, since a\nfreshness window is meaningless without a cursor to observe.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -86408,43 +89540,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
-        "key_path": "deployment.evidence.audit_offhost_shipping",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method",
         "path_kind": "property"
       },
-      "purpose": "Operator asserts audit records are shipped off-host (for example to a\nlog collector or SIEM) rather than relying solely on local retention.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
@@ -86501,35 +89618,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/ingress_rate_limit",
-        "key_path": "deployment.evidence.ingress_rate_limit",
-        "path_kind": "property"
+        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
+        "key_path": "datasets[].aggregates[].disclosure_control.method[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Operator asserts ingress rate limiting is enforced (for example by a\ngateway or reverse proxy in front of the relay).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86577,20 +89693,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
-        "key_path": "deployment.waivers[].expires",
-        "path_kind": "property"
+        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -86600,11 +89716,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86659,13 +89775,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
-        "key_path": "deployment.waivers[].finding",
-        "path_kind": "property"
+        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -86675,11 +89791,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86734,28 +89850,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
-        "key_path": "deployment.waivers[].reference",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
+        "key_path": "datasets[].aggregates[].disclosure_control.min_cell_size",
         "path_kind": "property"
       },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverReference",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86802,53 +89918,48 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
+          "keyword": "format",
+          "value": "uint32"
         },
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "maximum",
+          "value": 4294967295
         },
         {
-          "keyword": "pattern",
-          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverReference"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
-        "key_path": "deployment.waivers[].summary",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_cell_size",
         "path_kind": "property"
       },
-      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverSummary",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86895,28 +90006,28 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
+          "keyword": "format",
+          "value": "uint32"
         },
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverSummary"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method",
-        "key_path": "datasets[].aggregates[].disclosure_control.method",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_cell_size",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -86927,7 +90038,7 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -86982,33 +90093,46 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
+        "key_path": "datasets[].aggregates[].disclosure_control.min_group_size",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
+      "purpose_source": "reviewed_override",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -87058,33 +90182,49 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_group_size",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
+      "purpose_source": "reviewed_override",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -87135,110 +90275,52 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
-        "key_path": "datasets[].aggregates[].disclosure_control.method[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_group_size",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
+      "purpose_source": "reviewed_override",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -87284,18 +90366,33 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
+        "key_path": "datasets[].aggregates[].disclosure_control.report_suppressed_rows",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -87305,15 +90402,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -87361,15 +90459,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
-        "key_path": "datasets[].aggregates[].disclosure_control.min_cell_size",
+        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.report_suppressed_rows",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -87380,7 +90478,7 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -87435,29 +90533,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_cell_size",
+        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.report_suppressed_rows",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -87468,7 +90554,7 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -87523,29 +90609,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_cell_size",
+        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
+        "key_path": "datasets[].aggregates[].disclosure_control.suppression",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -87556,16 +90630,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -87612,49 +90687,49 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "const",
+          "value": [
+            "mask",
+            "null",
+            "omit"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/Suppression"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
-        "key_path": "datasets[].aggregates[].disclosure_control.min_group_size",
+        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.suppression",
         "path_kind": "property"
       },
-      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
+        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -87701,52 +90776,49 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "const",
+          "value": [
+            "mask",
+            "null",
+            "omit"
+          ]
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/Suppression"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_group_size",
+        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.suppression",
         "path_kind": "property"
       },
-      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
+        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -87793,52 +90865,47 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "const",
+          "value": [
+            "mask",
+            "null",
+            "omit"
+          ]
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/Suppression"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_group_size",
+        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/id",
+        "key_path": "metadata.ecosystem_binding.id",
         "path_kind": "property"
       },
-      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_metadata_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -87880,53 +90947,38 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
-        "key_path": "datasets[].aggregates[].disclosure_control.report_suppressed_rows",
+        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/version",
+        "key_path": "metadata.ecosystem_binding.version",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_metadata_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -87971,21 +91023,23 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.report_suppressed_rows",
+        "pointer": "/$defs/EntityAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].entities[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -87996,16 +91050,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88053,15 +91106,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.report_suppressed_rows",
+        "pointer": "/$defs/EntityAccessConfig/properties/evidence_verification_scope",
+        "key_path": "datasets[].entities[].access.evidence_verification_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88072,13 +91125,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -88129,15 +91182,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
-        "key_path": "datasets[].aggregates[].disclosure_control.suppression",
+        "pointer": "/$defs/EntityAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].entities[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88150,15 +91203,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88204,29 +91255,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "mask",
-            "null",
-            "omit"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Suppression"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.suppression",
+        "pointer": "/$defs/EntityAccessConfig/properties/read_scope",
+        "key_path": "datasets[].entities[].access.read_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88239,15 +91278,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88293,29 +91330,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "mask",
-            "null",
-            "omit"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Suppression"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.suppression",
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions",
+        "key_path": "datasets[].entities[].api.allowed_expansions",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88326,17 +91351,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88382,34 +91406,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "mask",
-            "null",
-            "omit"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Suppression"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/id",
-        "key_path": "metadata.ecosystem_binding.id",
-        "path_kind": "property"
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions/items",
+        "key_path": "datasets[].entities[].api.allowed_expansions[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -88419,11 +91431,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88465,7 +91477,8 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -88477,87 +91490,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/version",
-        "key_path": "metadata.ecosystem_binding.version",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].entities[].access.aggregate_scope",
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters",
+        "key_path": "datasets[].entities[].api.allowed_filters",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88568,15 +91502,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88624,35 +91559,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/evidence_verification_scope",
-        "key_path": "datasets[].entities[].access.evidence_verification_scope",
-        "path_kind": "property"
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].entities[].api.allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88698,17 +91633,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].entities[].access.metadata_scope",
+        "pointer": "/$defs/EntityApiConfig/properties/default_limit",
+        "key_path": "datasets[].entities[].api.default_limit",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88719,13 +91665,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -88773,17 +91719,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/read_scope",
-        "key_path": "datasets[].entities[].access.read_scope",
+        "pointer": "/$defs/EntityApiConfig/properties/governed_policy",
+        "key_path": "datasets[].entities[].api.governed_policy",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88794,15 +91752,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88850,15 +91810,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions",
-        "key_path": "datasets[].entities[].api.allowed_expansions",
+        "pointer": "/$defs/EntityApiConfig/properties/max_limit",
+        "key_path": "datasets[].entities[].api.max_limit",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88869,16 +91832,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88924,18 +91886,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions/items",
-        "key_path": "datasets[].entities[].api.allowed_expansions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EntityApiConfig/properties/require_purpose_header",
+        "key_path": "datasets[].entities[].api.require_purpose_header",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -88945,15 +91919,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89001,19 +91976,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters",
-        "key_path": "datasets[].entities[].api.allowed_filters",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].entities[].api.required_filter_bindings",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the query.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -89084,12 +92059,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].entities[].api.allowed_filters[]",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].entities[].api.required_filter_bindings[]",
         "path_kind": "array_item"
       },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -89098,7 +92073,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AllowedFilter",
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -89154,8 +92129,7 @@
         {
           "keyword": "required",
           "value": [
-            "field",
-            "ops"
+            "field"
           ]
         },
         {
@@ -89165,33 +92139,34 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
+        "pointer": "/$defs/RequiredFilterBindingConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/default_limit",
-        "key_path": "datasets[].entities[].api.default_limit",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filters",
+        "key_path": "datasets[].entities[].api.required_filters",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Alternative fields that can satisfy the row-scope gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89237,30 +92212,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/governed_policy",
-        "key_path": "datasets[].entities[].api.governed_policy",
-        "path_kind": "property"
+        "pointer": "/$defs/EntityApiConfig/properties/required_filters/items",
+        "key_path": "datasets[].entities[].api.required_filters[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -89270,17 +92233,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89328,18 +92289,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/max_limit",
-        "key_path": "datasets[].entities[].api.max_limit",
+        "pointer": "/$defs/EntityConfig/properties/access",
+        "key_path": "datasets[].entities[].access",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -89350,8 +92308,9 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/EntityAccessConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -89405,28 +92364,28 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "metadata_scope",
+            "aggregate_scope",
+            "read_scope"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/EntityAccessConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/require_purpose_header",
-        "key_path": "datasets[].entities[].api.require_purpose_header",
+        "pointer": "/$defs/EntityConfig/properties/aggregates",
+        "key_path": "datasets[].entities[].aggregates",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -89437,7 +92396,7 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
@@ -89445,8 +92404,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89494,18 +92453,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].entities[].api.required_filter_bindings",
-        "path_kind": "property"
+        "pointer": "/$defs/EntityConfig/properties/aggregates/items",
+        "key_path": "datasets[].entities[].aggregates[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the query.",
+      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -89513,16 +92472,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89568,18 +92527,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "description",
+            "disclosure_control"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].entities[].api.required_filter_bindings[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EntityConfig/properties/api",
+        "key_path": "datasets[].entities[].api",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -89591,14 +92562,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
+        "local_reference": "#/$defs/EntityApiConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89647,7 +92618,8 @@
         {
           "keyword": "required",
           "value": [
-            "field"
+            "default_limit",
+            "max_limit"
           ]
         },
         {
@@ -89657,17 +92629,17 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
+        "pointer": "/$defs/EntityApiConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filters",
-        "key_path": "datasets[].entities[].api.required_filters",
+        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles",
+        "key_path": "datasets[].entities[].attribute_release_profiles",
         "path_kind": "property"
       },
-      "purpose": "Alternative fields that can satisfy the row-scope gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose": "Governed identity attribute-release profiles attached to this entity.\nEach profile resolves exactly one subject and returns only the\nconfigured, minimised claims. Empty by default (feature opt-in).",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -89683,8 +92655,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89739,10 +92711,101 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filters/items",
-        "key_path": "datasets[].entities[].api.required_filters[]",
+        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles/items",
+        "key_path": "datasets[].entities[].attribute_release_profiles[]",
         "path_kind": "array_item"
       },
+      "purpose": "A governed identity attribute-release profile. A profile is a\nprojection-limited, exactly-one-subject lookup that maps a configured set of\nsource fields (or CEL-computed expressions) into a minimised\nOIDC/UserInfo-style claim bundle. Every profile is purpose-bound and requires\na matching `data-purpose` at resolve time. Identified globally by the\n`(id, version)` pair; both are required path segments at resolve time.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/AttributeReleaseProfile",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "version",
+            "purpose",
+            "release_scope",
+            "subject",
+            "claims"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile"
+      }
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/concept_uri",
+        "key_path": "datasets[].entities[].concept_uri",
+        "path_kind": "property"
+      },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
@@ -89751,15 +92814,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89807,15 +92872,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/access",
-        "key_path": "datasets[].entities[].access",
+        "pointer": "/$defs/EntityConfig/properties/description",
+        "key_path": "datasets[].entities[].description",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -89826,16 +92894,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/EntityAccessConfig",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89882,28 +92951,19 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "metadata_scope",
-            "aggregate_scope",
-            "read_scope"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/aggregates",
-        "key_path": "datasets[].entities[].aggregates",
+        "pointer": "/$defs/EntityConfig/properties/fields",
+        "key_path": "datasets[].entities[].fields",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -89978,12 +93038,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/aggregates/items",
-        "key_path": "datasets[].entities[].aggregates[]",
+        "pointer": "/$defs/EntityConfig/properties/fields/items",
+        "key_path": "datasets[].entities[].fields[]",
         "path_kind": "array_item"
       },
-      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -89992,7 +93052,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateConfig",
+        "local_reference": "#/$defs/EntityFieldConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -90048,9 +93108,7 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "description",
-            "disclosure_control"
+            "name"
           ]
         },
         {
@@ -90060,14 +93118,14 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig"
+        "pointer": "/$defs/EntityFieldConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/api",
-        "key_path": "datasets[].entities[].api",
+        "pointer": "/$defs/EntityConfig/properties/name",
+        "key_path": "datasets[].entities[].name",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -90078,14 +93136,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/EntityApiConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -90133,32 +93190,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "default_limit",
-            "max_limit"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles",
-        "key_path": "datasets[].entities[].attribute_release_profiles",
+        "pointer": "/$defs/EntityConfig/properties/relationships",
+        "key_path": "datasets[].entities[].relationships",
         "path_kind": "property"
       },
-      "purpose": "Governed identity attribute-release profiles attached to this entity.\nEach profile resolves exactly one subject and returns only the\nconfigured, minimised claims. Empty by default (feature opt-in).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -90229,12 +93275,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles/items",
-        "key_path": "datasets[].entities[].attribute_release_profiles[]",
+        "pointer": "/$defs/EntityConfig/properties/relationships/items",
+        "key_path": "datasets[].entities[].relationships[]",
         "path_kind": "array_item"
       },
-      "purpose": "A governed identity attribute-release profile. A profile is a\nprojection-limited, exactly-one-subject lookup that maps a configured set of\nsource fields (or CEL-computed expressions) into a minimised\nOIDC/UserInfo-style claim bundle. Every profile is purpose-bound and requires\na matching `data-purpose` at resolve time. Identified globally by the\n`(id, version)` pair; both are required path segments at resolve time.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -90243,7 +93289,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AttributeReleaseProfile",
+        "local_reference": "#/$defs/EntityRelationshipConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -90299,12 +93345,10 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "version",
-            "purpose",
-            "release_scope",
-            "subject",
-            "claims"
+            "name",
+            "kind",
+            "target",
+            "foreign_key"
           ]
         },
         {
@@ -90314,14 +93358,14 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile"
+        "pointer": "/$defs/EntityRelationshipConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/concept_uri",
-        "key_path": "datasets[].entities[].concept_uri",
+        "pointer": "/$defs/EntityConfig/properties/spatial",
+        "key_path": "datasets[].entities[].spatial",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -90333,16 +93377,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90389,90 +93433,16 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "geometry"
           ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/description",
-        "key_path": "datasets[].entities[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -90480,28 +93450,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/fields",
-        "key_path": "datasets[].entities[].fields",
+        "pointer": "/$defs/EntityConfig/properties/table",
+        "key_path": "datasets[].entities[].table",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Resource identifier within a dataset.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/ResourceId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90547,18 +93517,26 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/fields/items",
-        "key_path": "datasets[].entities[].fields[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EntityConfig/properties/title",
+        "key_path": "datasets[].entities[].title",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -90568,16 +93546,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/EntityFieldConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90624,26 +93603,19 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "name"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/name",
-        "key_path": "datasets[].entities[].name",
+        "pointer": "/$defs/EntityFieldConfig/properties/codelist",
+        "key_path": "datasets[].entities[].fields[].codelist",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -90654,15 +93626,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90710,15 +93684,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/relationships",
-        "key_path": "datasets[].entities[].relationships",
+        "pointer": "/$defs/EntityFieldConfig/properties/concept_uri",
+        "key_path": "datasets[].entities[].fields[].concept_uri",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -90729,16 +93706,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90786,16 +93764,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/relationships/items",
-        "key_path": "datasets[].entities[].relationships[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EntityFieldConfig/properties/from",
+        "key_path": "datasets[].entities[].fields[].from",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -90805,16 +93786,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/EntityRelationshipConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90861,29 +93843,19 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "name",
-            "kind",
-            "target",
-            "foreign_key"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/spatial",
-        "key_path": "datasets[].entities[].spatial",
+        "pointer": "/$defs/EntityFieldConfig/properties/language",
+        "key_path": "datasets[].entities[].fields[].language",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -90895,16 +93867,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90950,17 +93922,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "geometry"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -90968,12 +93934,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/table",
-        "key_path": "datasets[].entities[].table",
+        "pointer": "/$defs/EntityFieldConfig/properties/name",
+        "key_path": "datasets[].entities[].fields[].name",
         "path_kind": "property"
       },
-      "purpose": "Resource identifier within a dataset.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -90982,12 +93948,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ResourceId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -91035,25 +94000,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/title",
-        "key_path": "datasets[].entities[].title",
+        "pointer": "/$defs/EntityFieldConfig/properties/sensitive",
+        "key_path": "datasets[].entities[].fields[].sensitive",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91064,14 +94021,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -91122,18 +94078,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/codelist",
-        "key_path": "datasets[].entities[].fields[].codelist",
+        "pointer": "/$defs/EntityFieldConfig/properties/unit",
+        "key_path": "datasets[].entities[].fields[].unit",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91212,8 +94165,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/concept_uri",
-        "key_path": "datasets[].entities[].fields[].concept_uri",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/concept_uri",
+        "key_path": "datasets[].entities[].relationships[].concept_uri",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91292,32 +94245,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/from",
-        "key_path": "datasets[].entities[].fields[].from",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/foreign_key",
+        "key_path": "datasets[].entities[].relationships[].foreign_key",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -91352,28 +94303,27 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/language",
-        "key_path": "datasets[].entities[].fields[].language",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/kind",
+        "key_path": "datasets[].entities[].relationships[].kind",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91384,17 +94334,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/RelationshipKind",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -91441,19 +94390,28 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "belongs_to",
+            "has_many",
+            "has_one"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RelationshipKind"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/name",
-        "key_path": "datasets[].entities[].fields[].name",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/name",
+        "key_path": "datasets[].entities[].relationships[].name",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91527,8 +94485,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/sensitive",
-        "key_path": "datasets[].entities[].fields[].sensitive",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/target",
+        "key_path": "datasets[].entities[].relationships[].target",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91539,16 +94497,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -91596,15 +94553,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/unit",
-        "key_path": "datasets[].entities[].fields[].unit",
+        "pointer": "/$defs/EntitySpatialConfig/properties/bbox_fields",
+        "key_path": "datasets[].entities[].spatial.bbox_fields",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91616,16 +94573,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -91671,11 +94628,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -91683,8 +94649,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/concept_uri",
-        "key_path": "datasets[].entities[].relationships[].concept_uri",
+        "pointer": "/$defs/EntitySpatialConfig/properties/collection_id",
+        "key_path": "datasets[].entities[].spatial.collection_id",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91763,30 +94729,32 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/foreign_key",
-        "key_path": "datasets[].entities[].relationships[].foreign_key",
+        "pointer": "/$defs/EntitySpatialConfig/properties/datetime_field",
+        "key_path": "datasets[].entities[].spatial.datetime_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -91821,27 +94789,28 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/kind",
-        "key_path": "datasets[].entities[].relationships[].kind",
+        "pointer": "/$defs/EntitySpatialConfig/properties/description",
+        "key_path": "datasets[].entities[].spatial.description",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91852,16 +94821,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/RelationshipKind",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -91908,28 +94878,19 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "belongs_to",
-            "has_many",
-            "has_one"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RelationshipKind"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/name",
-        "key_path": "datasets[].entities[].relationships[].name",
+        "pointer": "/$defs/EntitySpatialConfig/properties/geometry",
+        "key_path": "datasets[].entities[].spatial.geometry",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91940,13 +94901,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/SpatialGeometryConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -91994,17 +94956,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "kind",
+              "field",
+              "crs"
+            ],
+            [
+              "kind",
+              "longitude_field",
+              "latitude_field",
+              "crs"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/target",
-        "key_path": "datasets[].entities[].relationships[].target",
+        "pointer": "/$defs/EntitySpatialConfig/properties/max_bbox_degrees",
+        "key_path": "datasets[].entities[].spatial.max_bbox_degrees",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92015,15 +94997,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "number"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -92069,17 +95052,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "double"
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "number"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/bbox_fields",
-        "key_path": "datasets[].entities[].spatial.bbox_fields",
+        "pointer": "/$defs/EntitySpatialConfig/properties/max_geometry_vertices",
+        "key_path": "datasets[].entities[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92090,17 +95077,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "integer"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -92147,28 +95133,28 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/collection_id",
-        "key_path": "datasets[].entities[].spatial.collection_id",
+        "pointer": "/$defs/EntitySpatialConfig/properties/title",
+        "key_path": "datasets[].entities[].spatial.title",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92247,8 +95233,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/datetime_field",
-        "key_path": "datasets[].entities[].spatial.datetime_field",
+        "pointer": "/$defs/FieldConfig/properties/codelist",
+        "key_path": "datasets[].tables[].schema.fields[].codelist",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92327,8 +95313,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/description",
-        "key_path": "datasets[].entities[].spatial.description",
+        "pointer": "/$defs/FieldConfig/properties/concept_uri",
+        "key_path": "datasets[].tables[].schema.fields[].concept_uri",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92407,8 +95393,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/geometry",
-        "key_path": "datasets[].entities[].spatial.geometry",
+        "pointer": "/$defs/FieldConfig/properties/language",
+        "key_path": "datasets[].tables[].schema.fields[].language",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92419,16 +95405,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/SpatialGeometryConfig",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -92475,36 +95462,19 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            [
-              "kind",
-              "field",
-              "crs"
-            ],
-            [
-              "kind",
-              "longitude_field",
-              "latitude_field",
-              "crs"
-            ]
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/max_bbox_degrees",
-        "key_path": "datasets[].entities[].spatial.max_bbox_degrees",
+        "pointer": "/$defs/FieldConfig/properties/name",
+        "key_path": "datasets[].tables[].schema.fields[].name",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92515,16 +95485,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "number"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -92570,21 +95539,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "double"
-        },
         {
           "keyword": "type",
-          "value": "number"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/max_geometry_vertices",
-        "key_path": "datasets[].entities[].spatial.max_geometry_vertices",
+        "pointer": "/$defs/FieldConfig/properties/nullable",
+        "key_path": "datasets[].tables[].schema.fields[].nullable",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92595,7 +95560,7 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -92650,29 +95615,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/title",
-        "key_path": "datasets[].entities[].spatial.title",
+        "pointer": "/$defs/FieldConfig/properties/sensitive",
+        "key_path": "datasets[].tables[].schema.fields[].sensitive",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92683,14 +95636,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -92741,39 +95693,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/codelist",
-        "key_path": "datasets[].tables[].schema.fields[].codelist",
+        "pointer": "/$defs/FieldConfig/properties/type",
+        "key_path": "datasets[].tables[].schema.fields[].type",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Physical type of a column. The set is fixed in V1; semantic types\nare carried via `concept_uri`.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/FieldType",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -92820,19 +95768,31 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
             "string",
-            "null"
+            "number",
+            "integer",
+            "boolean",
+            "date",
+            "timestamp"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FieldType"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/concept_uri",
-        "key_path": "datasets[].tables[].schema.fields[].concept_uri",
+        "pointer": "/$defs/FieldConfig/properties/unit",
+        "key_path": "datasets[].tables[].schema.fields[].unit",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92911,8 +95871,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/language",
-        "key_path": "datasets[].tables[].schema.fields[].language",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance",
+        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92923,14 +95883,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -92981,19 +95940,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/name",
-        "key_path": "datasets[].tables[].schema.fields[].name",
-        "path_kind": "property"
+        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance/items",
+        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -93007,11 +95963,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -93066,8 +96022,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/nullable",
-        "key_path": "datasets[].tables[].schema.fields[].nullable",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/max_source_age_seconds",
+        "key_path": "datasets[].entities[].api.governed_policy.max_source_age_seconds",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93078,12 +96034,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -93133,17 +96090,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/sensitive",
-        "key_path": "datasets[].tables[].schema.fields[].sensitive",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/minimum_assurance",
+        "key_path": "datasets[].entities[].api.governed_policy.minimum_assurance",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93154,13 +96126,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -93211,35 +96184,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/type",
-        "key_path": "datasets[].tables[].schema.fields[].type",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions",
         "path_kind": "property"
       },
-      "purpose": "Physical type of a column. The set is fixed in V1; semantic types\nare carried via `concept_uri`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/FieldType",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -93285,33 +96261,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "number",
-            "integer",
-            "boolean",
-            "date",
-            "timestamp"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldType"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/unit",
-        "key_path": "datasets[].tables[].schema.fields[].unit",
-        "path_kind": "property"
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions/items",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -93321,17 +96282,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -93379,18 +96338,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance",
-        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93465,8 +96421,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance/items",
-        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance[]",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes/items",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93540,8 +96496,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/max_source_age_seconds",
-        "key_path": "datasets[].entities[].api.governed_policy.max_source_age_seconds",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields",
+        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93552,13 +96508,12 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -93608,33 +96563,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/minimum_assurance",
-        "key_path": "datasets[].entities[].api.governed_policy.minimum_assurance",
-        "path_kind": "property"
+        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields/items",
+        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -93644,17 +96584,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -93702,18 +96640,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/require_consent",
+        "key_path": "datasets[].entities[].api.governed_policy.require_consent",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93724,7 +96659,7 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -93781,16 +96716,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions/items",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/GovernedPolicyConfig/properties/require_legal_basis",
+        "key_path": "datasets[].entities[].api.governed_policy.require_legal_basis",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -93800,15 +96735,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -93856,15 +96792,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/trusted_context",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93875,16 +96811,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/GovernedTrustedContextConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -93932,16 +96869,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes/items",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/asserted_assurance",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.asserted_assurance",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -93951,15 +96892,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -94007,15 +96950,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields",
-        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/consent_ref",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.consent_ref",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -94026,13 +96972,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -94083,16 +97030,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields/items",
-        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/jurisdiction",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.jurisdiction",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -94102,15 +97052,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -94158,15 +97110,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/require_consent",
-        "key_path": "datasets[].entities[].api.governed_policy.require_consent",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/legal_basis_ref",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.legal_basis_ref",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -94177,13 +97132,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -94234,15 +97190,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/require_legal_basis",
-        "key_path": "datasets[].entities[].api.governed_policy.require_legal_basis",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/source_observed_age_seconds",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.source_observed_age_seconds",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -94253,12 +97212,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -94308,41 +97268,56 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/trusted_context",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context",
+        "pointer": "/$defs/InstanceConfig/properties/environment",
+        "key_path": "instance.environment",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_instance_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/GovernedTrustedContextConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -94360,12 +97335,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -94377,37 +97352,112 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig"
-      }
+        "pointer": "/$defs/InstanceConfig/properties/id",
+        "key_path": "instance.id",
+        "path_kind": "property"
+      },
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_instance_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/asserted_assurance",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.asserted_assurance",
+        "pointer": "/$defs/InstanceConfig/properties/jurisdiction",
+        "key_path": "instance.jurisdiction",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_instance_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "null",
@@ -94423,7 +97473,7 @@
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -94441,12 +97491,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -94458,12 +97508,12 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -94478,16 +97528,16 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/consent_ref",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.consent_ref",
+        "pointer": "/$defs/InstanceConfig/properties/owner",
+        "key_path": "instance.owner",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_instance_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "null",
@@ -94503,7 +97553,7 @@
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -94521,12 +97571,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -94538,12 +97588,12 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -94558,29 +97608,29 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/jurisdiction",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.jurisdiction",
+        "pointer": "/$defs/MetadataConfig/properties/ecosystem_binding",
+        "key_path": "metadata.ecosystem_binding",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_metadata_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -94622,15 +97672,20 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -94638,29 +97693,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/legal_basis_ref",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.legal_basis_ref",
+        "pointer": "/$defs/MetadataConfig/properties/source",
+        "key_path": "metadata.source",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_metadata_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/MetadataSourceConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -94702,42 +97756,48 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "path"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/MetadataSourceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/source_observed_age_seconds",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.source_observed_age_seconds",
+        "pointer": "/$defs/MetadataSourceConfig/properties/digest",
+        "key_path": "metadata.source.digest",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_metadata_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -94782,26 +97842,13 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
           "value": [
-            "integer",
+            "string",
             "null"
           ]
         }
@@ -94810,32 +97857,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/environment",
-        "key_path": "instance.environment",
+        "pointer": "/$defs/MetadataSourceConfig/properties/path",
+        "key_path": "metadata.source.path",
         "path_kind": "property"
       },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
+      "intent_profile": "relay_metadata_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -94853,12 +97898,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -94870,51 +97915,50 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/id",
-        "key_path": "instance.id",
+        "pointer": "/$defs/OidcConfig/properties/allow_dev_insecure_fetch_urls",
+        "key_path": "auth.oidc.allow_dev_insecure_fetch_urls",
         "path_kind": "property"
       },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
+      "purpose": "Development-only escape hatch that permits loopback HTTP issuer,\ndiscovery, and JWKS URLs. Private non-loopback networks and cloud\nmetadata endpoints remain denied by the platform fetch policy.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -94932,12 +97976,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -94949,49 +97993,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/jurisdiction",
-        "key_path": "instance.jurisdiction",
+        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms",
+        "key_path": "auth.oidc.allowed_algorithms",
         "path_kind": "property"
       },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
+      "purpose": "Signature algorithms accepted by the verifier. Defaults to\nRS256, ES256, EdDSA. HS\\* and `none` are intentionally absent\nfrom [`OidcAlgorithm`].",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -95009,12 +98055,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -95026,52 +98072,48 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/owner",
-        "key_path": "instance.owner",
-        "path_kind": "property"
+        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms/items",
+        "key_path": "auth.oidc.allowed_algorithms[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
+      "purpose": "JWS signature algorithms accepted by the OIDC verifier. Symmetric\nalgorithms (`HS*`) and `none` are intentionally absent: shared-secret\nJWTs are unsafe between a resource server and an IdP, and `none`\ndisables verification entirely.\n\nYAML values are the canonical JWA `alg` strings (`RS256`, `ES256`,\n`EdDSA`), case-sensitive.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/OidcAlgorithm",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -95089,12 +98131,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -95106,49 +98148,57 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "RS256",
+            "ES256",
+            "EdDSA"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/OidcAlgorithm"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/MetadataConfig/properties/ecosystem_binding",
-        "key_path": "metadata.ecosystem_binding",
+        "pointer": "/$defs/OidcConfig/properties/allowed_clients",
+        "key_path": "auth.oidc.allowed_clients",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
+      "purpose": "Optional allowlist of client identifiers, matched against the\ntoken's `azp` (preferred) or `client_id` claim. Empty list\nmeans any client is accepted.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -95190,49 +98240,40 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/MetadataConfig/properties/source",
-        "key_path": "metadata.source",
-        "path_kind": "property"
+        "pointer": "/$defs/OidcConfig/properties/allowed_clients/items",
+        "key_path": "auth.oidc.allowed_clients[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/MetadataSourceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -95274,54 +98315,44 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "path"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/MetadataSourceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/MetadataSourceConfig/properties/digest",
-        "key_path": "metadata.source.digest",
+        "pointer": "/$defs/OidcConfig/properties/allowed_token_types",
+        "key_path": "auth.oidc.allowed_token_types",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
+      "purpose": "Accepted `typ` JOSE header values. Defaults to `JWT` and\n`at+jwt` (RFC 9068). ID tokens (`id+jwt`) are not access tokens\nand are rejected by default. Tokens without `typ` are rejected by\nthe shared verifier.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -95356,32 +98387,33 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/MetadataSourceConfig/properties/path",
-        "key_path": "metadata.source.path",
-        "path_kind": "property"
+        "pointer": "/$defs/OidcConfig/properties/allowed_token_types/items",
+        "key_path": "auth.oidc.allowed_token_types[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_sensitive",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -95391,11 +98423,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -95440,7 +98472,8 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -95452,11 +98485,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allow_dev_insecure_fetch_urls",
-        "key_path": "auth.oidc.allow_dev_insecure_fetch_urls",
+        "pointer": "/$defs/OidcConfig/properties/audiences",
+        "key_path": "auth.oidc.audiences",
         "path_kind": "property"
       },
-      "purpose": "Development-only escape hatch that permits loopback HTTP issuer,\ndiscovery, and JWKS URLs. Private non-loopback networks and cloud\nmetadata endpoints remain denied by the platform fetch policy.",
+      "purpose": "One or more accepted `aud` values. Tokens with no `aud`, or\nwhose `aud` does not intersect this list, are rejected.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
@@ -95464,16 +98497,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -95521,82 +98553,6 @@
         "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms",
-        "key_path": "auth.oidc.allowed_algorithms",
-        "path_kind": "property"
-      },
-      "purpose": "Signature algorithms accepted by the verifier. Defaults to\nRS256, ES256, EdDSA. HS\\* and `none` are intentionally absent\nfrom [`OidcAlgorithm`].",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
       "constraints": [
         {
           "keyword": "type",
@@ -95607,13 +98563,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms/items",
-        "key_path": "auth.oidc.allowed_algorithms[]",
+        "pointer": "/$defs/OidcConfig/properties/audiences/items",
+        "key_path": "auth.oidc.audiences[]",
         "path_kind": "array_item"
       },
-      "purpose": "JWS signature algorithms accepted by the OIDC verifier. Symmetric\nalgorithms (`HS*`) and `none` are intentionally absent: shared-secret\nJWTs are unsafe between a resource server and an IdP, and `none`\ndisables verification entirely.\n\nYAML values are the canonical JWA `alg` strings (`RS256`, `ES256`,\n`EdDSA`), case-sensitive.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -95621,17 +98577,16 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/OidcAlgorithm",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -95666,60 +98621,52 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "RS256",
-            "ES256",
-            "EdDSA"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcAlgorithm"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_clients",
-        "key_path": "auth.oidc.allowed_clients",
+        "pointer": "/$defs/OidcConfig/properties/discovery_url",
+        "key_path": "auth.oidc.discovery_url",
         "path_kind": "property"
       },
-      "purpose": "Optional allowlist of client identifiers, matched against the\ntoken's `azp` (preferred) or `client_id` claim. Empty list\nmeans any client is accepted.",
+      "purpose": "OIDC discovery document URL\n(`.well-known/openid-configuration`). The JWKS URL is resolved\nfrom `jwks_uri` in the discovered document.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -95754,30 +98701,36 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_clients/items",
-        "key_path": "auth.oidc.allowed_clients[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/OidcConfig/properties/issuer",
+        "key_path": "auth.oidc.issuer",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Issuer URL. Compared verbatim against the JWT `iss` claim.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -95787,14 +98740,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -95829,11 +98782,14 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -95846,31 +98802,32 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_token_types",
-        "key_path": "auth.oidc.allowed_token_types",
+        "pointer": "/$defs/OidcConfig/properties/jwks_cache_ttl",
+        "key_path": "auth.oidc.jwks_cache_ttl",
         "path_kind": "property"
       },
-      "purpose": "Accepted `typ` JOSE header values. Defaults to `JWT` and\n`at+jwt` (RFC 9068). ID tokens (`id+jwt`) are not access tokens\nand are rejected by default. Tokens without `typ` are rejected by\nthe shared verifier.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -95905,47 +98862,58 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_token_types/items",
-        "key_path": "auth.oidc.allowed_token_types[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/OidcConfig/properties/jwks_url",
+        "key_path": "auth.oidc.jwks_url",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "JWKS endpoint. Either this or `discovery_url` must be set.\n`discovery_url` takes precedence: when both are configured the\nvalidator rejects the document.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -95996,37 +98964,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/audiences",
-        "key_path": "auth.oidc.audiences",
+        "pointer": "/$defs/OidcConfig/properties/leeway",
+        "key_path": "auth.oidc.leeway",
         "path_kind": "property"
       },
-      "purpose": "One or more accepted `aud` values. Tokens with no `aud`, or\nwhose `aud` does not intersect this list, are rejected.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -96061,33 +99034,42 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/audiences/items",
-        "key_path": "auth.oidc.audiences[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/OidcConfig/properties/scope_claim",
+        "key_path": "auth.oidc.scope_claim",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
+      "purpose": "JWT claim whose value carries scopes. Defaults to `scope`, the\nRFC 8693 / RFC 9068 space-separated form. Some IdPs use `scp`\nor `permissions`; the value may be a string, an array of strings,\nor an object keyed by scope name.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -96097,14 +99079,15 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -96139,14 +99122,11 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -96159,32 +99139,31 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/discovery_url",
-        "key_path": "auth.oidc.discovery_url",
+        "pointer": "/$defs/OidcConfig/properties/scope_map",
+        "key_path": "auth.oidc.scope_map",
         "path_kind": "property"
       },
-      "purpose": "OIDC discovery document URL\n(`.well-known/openid-configuration`). The JWKS URL is resolved\nfrom `jwks_uri` in the discovered document.",
+      "purpose": "Optional rename map: `external_scope -> internal_scope`. Applied\nafter parsing the scope claim, before scope-based access checks\nrun. Useful for adapting IdP role names (`role:foo`) to the\nrelay's `<dataset_id>:<level>` shape.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -96219,36 +99198,30 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/issuer",
-        "key_path": "auth.oidc.issuer",
-        "path_kind": "property"
+        "pointer": "/$defs/OidcConfig/properties/scope_map/additionalProperties",
+        "key_path": "auth.oidc.scope_map.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Issuer URL. Compared verbatim against the JWT `iss` claim.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
+      "purpose": "Each reviewed key is an external token scope and each value is the bounded Relay scope mapping granted for that exact token scope.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_oidc_scope_map_open_map",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -96258,14 +99231,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "relay",
@@ -96300,15 +99273,12 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -96320,32 +99290,31 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/jwks_cache_ttl",
-        "key_path": "auth.oidc.jwks_cache_ttl",
+        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys",
+        "key_path": "auth.oidc.scope_object_required_keys",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Keys that must be present inside object-valued role claim values\nbefore the role key is treated as an active scope. Object-valued\nclaims grant no scopes when this list is empty.\nThis is useful for IdPs such as Zitadel where role values are\nkeyed by organization id.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -96380,58 +99349,47 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/jwks_url",
-        "key_path": "auth.oidc.jwks_url",
-        "path_kind": "property"
+        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys/items",
+        "key_path": "auth.oidc.scope_object_required_keys[]",
+        "path_kind": "array_item"
       },
-      "purpose": "JWKS endpoint. Either this or `discovery_url` must be set.\n`discovery_url` takes precedence: when both are configured the\nvalidator rejects the document.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -96482,23 +99440,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/leeway",
-        "key_path": "auth.oidc.leeway",
+        "pointer": "/$defs/PostgresTableConfig/properties/name",
+        "key_path": "datasets[].tables[].source.table.name",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -96506,15 +99461,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -96560,45 +99513,109 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+        "pointer": "/$defs/PostgresTableConfig/properties/schema",
+        "key_path": "datasets[].tables[].source.table.schema",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_claim",
-        "key_path": "auth.oidc.scope_claim",
+        "pointer": "/$defs/PublicServiceConfig/properties/description",
+        "key_path": "datasets[].public_services[].description",
         "path_kind": "property"
       },
-      "purpose": "JWT claim whose value carries scopes. Defaults to `scope`, the\nRFC 8693 / RFC 9068 space-separated form. Some IdPs use `scp`\nor `permissions`; the value may be a string, an array of strings,\nor an object keyed by scope name.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
@@ -96650,32 +99667,36 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_map",
-        "key_path": "auth.oidc.scope_map",
+        "pointer": "/$defs/PublicServiceConfig/properties/id",
+        "key_path": "datasets[].public_services[].id",
         "path_kind": "property"
       },
-      "purpose": "Optional rename map: `external_scope -> internal_scope`. Applied\nafter parsing the scope claim, before scope-based access checks\nrun. Useful for adapting IdP role names (`role:foo`) to the\nrelay's `<dataset_id>:<level>` shape.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -96726,20 +99747,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_map/additionalProperties",
-        "key_path": "auth.oidc.scope_map.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/PublicServiceConfig/properties/title",
+        "key_path": "datasets[].public_services[].title",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key is an external token scope and each value is the bounded Relay scope mapping granted for that exact token scope.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_oidc_scope_map_open_map",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -96749,14 +99773,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -96796,7 +99820,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -96808,31 +99832,32 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys",
-        "key_path": "auth.oidc.scope_object_required_keys",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
+        "key_path": "datasets[].defaults.refresh.interval",
         "path_kind": "property"
       },
-      "purpose": "Keys that must be present inside object-valued role claim values\nbefore the role key is treated as an active scope. Object-valued\nclaims grant no scopes when this list is empty.\nThis is useful for IdPs such as Zitadel where role values are\nkeyed by organization id.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "conditional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -96867,33 +99892,42 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys/items",
-        "key_path": "auth.oidc.scope_object_required_keys[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
+        "key_path": "datasets[].tables[].refresh.interval",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -96901,16 +99935,18 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "conditional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -96945,28 +99981,37 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/PostgresTableConfig/properties/name",
-        "key_path": "datasets[].tables[].source.table.name",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].defaults.refresh.mode",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -96983,7 +100028,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -97031,6 +100076,14 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "interval",
+            "manual",
+            "mtime"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -97040,8 +100093,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/PostgresTableConfig/properties/schema",
-        "key_path": "datasets[].tables[].source.table.schema",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].tables[].refresh.mode",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -97058,7 +100111,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -97106,6 +100159,14 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "interval",
+            "manual",
+            "mtime"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -97115,8 +100176,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig/properties/description",
-        "key_path": "datasets[].public_services[].description",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/expression",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -97128,16 +100189,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97183,11 +100244,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "cel"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -97195,12 +100262,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig/properties/id",
-        "key_path": "datasets[].public_services[].id",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/format",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].format",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Optional value format hint.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -97275,8 +100342,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig/properties/title",
-        "key_path": "datasets[].public_services[].title",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/locale",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].locale",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -97287,15 +100354,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97343,18 +100412,21 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
-        "key_path": "datasets[].defaults.refresh.interval",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/name",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].name",
         "path_kind": "property"
       },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose": "Released claim name (lower-snake).",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -97364,15 +100436,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "conditional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97418,32 +100488,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
-        "key_path": "datasets[].tables[].refresh.interval",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/required",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].required",
         "path_kind": "property"
       },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose": "Whether the claim must be present; a missing required claim denies.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -97451,14 +100509,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "conditional",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -97507,29 +100564,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].defaults.refresh.mode",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/sensitivity",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].sensitivity",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -97540,15 +100585,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97595,43 +100642,49 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
+          "keyword": "enum",
           "value": [
-            "interval",
-            "manual",
-            "mtime"
+            "direct_identifier",
+            "personal",
+            "public",
+            "pseudonymous"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].tables[].refresh.mode",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/source_field",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].source_field",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Source field projected into the claim. XOR with `expression`.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97678,45 +100731,39 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
+          "keyword": "type",
           "value": [
-            "interval",
-            "manual",
-            "mtime"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/expression",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression",
+        "pointer": "/$defs/ReleaseConditionsConfig/properties/expression",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "A single CEL expression evaluated over the subject's source projection.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/ReleaseExpressionConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97770,98 +100817,19 @@
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/format",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].format",
-        "path_kind": "property"
-      },
-      "purpose": "Optional value format hint.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
       ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseExpressionConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/locale",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].locale",
+        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression.cel",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -97872,17 +100840,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97930,22 +100896,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/name",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].name",
+        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression.cel",
         "path_kind": "property"
       },
-      "purpose": "Released claim name (lower-snake).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -98015,11 +100978,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/required",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].required",
+        "pointer": "/$defs/ReleaseResponseConfig/properties/include_source_metadata",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].response.include_source_metadata",
         "path_kind": "property"
       },
-      "purpose": "Whether the claim must be present; a missing required claim denies.",
+      "purpose": "Whether to include profile-sourced metadata in the response body.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -98091,32 +101054,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/sensitivity",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].sensitivity",
+        "pointer": "/$defs/ReleaseSubjectConfig/properties/id_type",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.id_type",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Accepted identifier type label.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -98151,61 +101112,49 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "direct_identifier",
-            "personal",
-            "public",
-            "pseudonymous"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/source_field",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].source_field",
+        "pointer": "/$defs/ReleaseSubjectConfig/properties/source_field",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.source_field",
         "path_kind": "property"
       },
-      "purpose": "Source field projected into the claim. XOR with `expression`.",
+      "purpose": "Source field used to match the subject. Must be an exposed entity field.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -98240,46 +101189,44 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseConditionsConfig/properties/expression",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].aggregates[].required_filter_bindings[].field",
         "path_kind": "property"
       },
-      "purpose": "A single CEL expression evaluated over the subject's source projection.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ReleaseExpressionConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -98327,27 +101274,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "cel"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseExpressionConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression.cel",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -98421,8 +101358,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression.cel",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].entities[].api.required_filter_bindings[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -98496,28 +101433,27 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseResponseConfig/properties/include_source_metadata",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].response.include_source_metadata",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].field",
         "path_kind": "property"
       },
-      "purpose": "Whether to include profile-sourced metadata in the response body.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -98565,20 +101501,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseSubjectConfig/properties/id_type",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.id_type",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].aggregates[].required_filter_bindings[].source",
         "path_kind": "property"
       },
-      "purpose": "Accepted identifier type label.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_sensitive",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -98586,16 +101522,18 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -98630,32 +101568,40 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "principal_id"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseSubjectConfig/properties/source_field",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.source_field",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].source",
         "path_kind": "property"
       },
-      "purpose": "Source field used to match the subject. Must be an exposed entity field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_sensitive",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -98663,16 +101609,18 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -98707,27 +101655,35 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "principal_id"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].aggregates[].required_filter_bindings[].field",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].entities[].api.required_filter_bindings[].source",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -98740,13 +101696,15 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -98792,17 +101750,27 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "principal_id"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].field",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].source",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -98815,13 +101783,15 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -98867,17 +101837,27 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "principal_id"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].entities[].api.required_filter_bindings[].field",
+        "pointer": "/$defs/ResourceAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].tables[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -98951,8 +101931,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].field",
+        "pointer": "/$defs/ResourceAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].tables[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -99026,8 +102006,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].aggregates[].required_filter_bindings[].source",
+        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters",
+        "key_path": "datasets[].tables[].api.allowed_filters",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -99038,17 +102018,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99095,26 +102074,103 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].tables[].api.allowed_filters[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/AllowedFilter",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
           "value": [
-            "principal_id"
+            "field",
+            "ops"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
+        "pointer": "/$defs/AllowedFilter"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].source",
+        "pointer": "/$defs/ResourceApiConfig/properties/default_limit",
+        "key_path": "datasets[].tables[].api.default_limit",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -99125,17 +102181,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99182,26 +102236,28 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].entities[].api.required_filter_bindings[].source",
+        "pointer": "/$defs/ResourceApiConfig/properties/max_limit",
+        "key_path": "datasets[].tables[].api.max_limit",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -99212,17 +102268,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99269,26 +102323,28 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].source",
+        "pointer": "/$defs/ResourceApiConfig/properties/require_purpose_header",
+        "key_path": "datasets[].tables[].api.require_purpose_header",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -99299,17 +102355,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99355,46 +102410,38 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].tables[].access.aggregate_scope",
+        "pointer": "/$defs/ResourceConfig/properties/access",
+        "key_path": "datasets[].tables[].access",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Resource-level scope assignments. Private tables are not exposed as row\nresources in beta; row access is configured on public entities.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ResourceAccessConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99440,17 +102487,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "metadata_scope",
+            "aggregate_scope"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceAccessConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].tables[].access.metadata_scope",
+        "pointer": "/$defs/ResourceConfig/properties/aggregates",
+        "key_path": "datasets[].tables[].aggregates",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -99461,15 +102519,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99517,35 +102576,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters",
-        "key_path": "datasets[].tables[].api.allowed_filters",
-        "path_kind": "property"
+        "pointer": "/$defs/ResourceConfig/properties/aggregates/items",
+        "key_path": "datasets[].tables[].aggregates[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99591,20 +102650,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "description",
+            "disclosure_control"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].tables[].api.allowed_filters[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ResourceConfig/properties/api",
+        "key_path": "datasets[].tables[].api",
+        "path_kind": "property"
       },
-      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose": "Resource-level API knobs: per-field filter allowlist, limit caps,\nand the `Data-Purpose` requirement.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -99614,14 +102685,15 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AllowedFilter",
+        "local_reference": "#/$defs/ResourceApiConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99670,8 +102742,8 @@
         {
           "keyword": "required",
           "value": [
-            "field",
-            "ops"
+            "default_limit",
+            "max_limit"
           ]
         },
         {
@@ -99681,31 +102753,32 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
+        "pointer": "/$defs/ResourceApiConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/default_limit",
-        "key_path": "datasets[].tables[].api.default_limit",
+        "pointer": "/$defs/ResourceConfig/properties/id",
+        "key_path": "datasets[].tables[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Resource identifier within a dataset.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/ResourceId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -99754,47 +102827,45 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/max_limit",
-        "key_path": "datasets[].tables[].api.max_limit",
+        "pointer": "/$defs/ResourceConfig/properties/materialization",
+        "key_path": "datasets[].tables[].materialization",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "How a configured private table is registered for query planning.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99841,51 +102912,49 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "enum",
+          "value": [
+            "snapshot"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/require_purpose_header",
-        "key_path": "datasets[].tables[].api.require_purpose_header",
+        "pointer": "/$defs/ResourceConfig/properties/primary_key",
+        "key_path": "datasets[].tables[].primary_key",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -99920,46 +102989,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/access",
-        "key_path": "datasets[].tables[].access",
+        "pointer": "/$defs/ResourceConfig/properties/refresh",
+        "key_path": "datasets[].tables[].refresh",
         "path_kind": "property"
       },
-      "purpose": "Resource-level scope assignments. Private tables are not exposed as row\nresources in beta; row access is configured on public entities.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/ResourceAccessConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100008,45 +103082,49 @@
         {
           "keyword": "required",
           "value": [
-            "metadata_scope",
-            "aggregate_scope"
+            [
+              "mode",
+              "interval"
+            ],
+            [
+              "mode"
+            ]
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceAccessConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/aggregates",
-        "key_path": "datasets[].tables[].aggregates",
+        "pointer": "/$defs/ResourceConfig/properties/schema",
+        "key_path": "datasets[].tables[].schema",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Declared resource schema. `strict` is the spec's `strict_schema`\nflag; on mismatch ingestion refuses to register the resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/SchemaConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100092,20 +103170,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "fields"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SchemaConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/aggregates/items",
-        "key_path": "datasets[].tables[].aggregates[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ResourceConfig/properties/source",
+        "key_path": "datasets[].tables[].source",
+        "path_kind": "property"
       },
-      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
+      "purpose": "Source plugin selection. Tagged on `type:` so HTTP, S3, or additional\ndatabase variants can land additively later.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -100115,14 +103203,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateConfig",
+        "local_reference": "#/$defs/SourceConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100171,9 +103259,14 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "description",
-            "disclosure_control"
+            [
+              "type",
+              "connection_env"
+            ],
+            [
+              "type",
+              "path"
+            ]
           ]
         },
         {
@@ -100183,35 +103276,35 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig"
+        "pointer": "/$defs/SourceConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/api",
-        "key_path": "datasets[].tables[].api",
+        "pointer": "/$defs/ResourceFormatConfig/properties/csv",
+        "key_path": "datasets[].tables[].source.format.csv",
         "path_kind": "property"
       },
-      "purpose": "Resource-level API knobs: per-field filter allowlist, limit caps,\nand the `Data-Purpose` requirement.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/ResourceApiConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100258,47 +103351,40 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "default_limit",
-            "max_limit"
+            "null",
+            "object"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/id",
-        "key_path": "datasets[].tables[].id",
+        "pointer": "/$defs/ResourceFormatConfig/properties/parquet",
+        "key_path": "datasets[].tables[].source.format.parquet",
         "path_kind": "property"
       },
-      "purpose": "Resource identifier within a dataset.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "local_reference": "#/$defs/ResourceId",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100344,29 +103430,24 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/materialization",
-        "key_path": "datasets[].tables[].materialization",
+        "pointer": "/$defs/ResourceFormatConfig/properties/xlsx",
+        "key_path": "datasets[].tables[].source.format.xlsx",
         "path_kind": "property"
       },
-      "purpose": "How a configured private table is registered for query planning.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -100374,13 +103455,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
         "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -100429,17 +103510,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "snapshot"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
             "null",
-            "string"
+            "object"
           ]
         }
       ]
@@ -100447,32 +103522,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/primary_key",
-        "key_path": "datasets[].tables[].primary_key",
+        "pointer": "/$defs/RotateConfig/properties/max_files",
+        "key_path": "audit.rotate.max_files",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -100507,51 +103580,55 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/refresh",
-        "key_path": "datasets[].tables[].refresh",
+        "pointer": "/$defs/RotateConfig/properties/max_size_mb",
+        "key_path": "audit.rotate.max_size_mb",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "integer"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100593,49 +103670,44 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            [
-              "mode",
-              "interval"
-            ],
-            [
-              "mode"
-            ]
-          ]
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/schema",
-        "key_path": "datasets[].tables[].schema",
+        "pointer": "/$defs/SchemaConfig/properties/fields",
+        "key_path": "datasets[].tables[].schema.fields",
         "path_kind": "property"
       },
-      "purpose": "Declared resource schema. `strict` is the spec's `strict_schema`\nflag; on mismatch ingestion refuses to register the resource.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/SchemaConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -100688,30 +103760,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "fields"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SchemaConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/source",
-        "key_path": "datasets[].tables[].source",
-        "path_kind": "property"
+        "pointer": "/$defs/SchemaConfig/properties/fields/items",
+        "key_path": "datasets[].tables[].schema.fields[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Source plugin selection. Tagged on `type:` so HTTP, S3, or additional\ndatabase variants can land additively later.",
+      "purpose": "One column in a resource schema. Physical type and optional\nsemantic annotations used by catalog and schema metadata.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -100721,14 +103783,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/SourceConfig",
+        "local_reference": "#/$defs/FieldConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100777,14 +103839,8 @@
         {
           "keyword": "required",
           "value": [
-            [
-              "type",
-              "connection_env"
-            ],
-            [
-              "type",
-              "path"
-            ]
+            "name",
+            "type"
           ]
         },
         {
@@ -100794,14 +103850,14 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig"
+        "pointer": "/$defs/FieldConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceFormatConfig/properties/csv",
-        "key_path": "datasets[].tables[].source.format.csv",
+        "pointer": "/$defs/SchemaConfig/properties/strict",
+        "key_path": "datasets[].tables[].schema.strict",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -100812,17 +103868,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "boolean"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100870,42 +103925,39 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceFormatConfig/properties/parquet",
-        "key_path": "datasets[].tables[].source.format.parquet",
+        "pointer": "/$defs/ServerConfig/properties/admin_bind",
+        "key_path": "server.admin_bind",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
         "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -100940,19 +103992,29 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": [
+            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
+            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
             "null",
-            "object"
+            "string"
           ]
         }
       ]
@@ -100960,29 +104022,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceFormatConfig/properties/xlsx",
-        "key_path": "datasets[].tables[].source.format.xlsx",
+        "pointer": "/$defs/ServerConfig/properties/bind",
+        "key_path": "server.bind",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/SocketAddr",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -101024,43 +104085,51 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "pattern",
           "value": [
-            "null",
-            "object"
+            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
+            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SocketAddr"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RotateConfig/properties/max_files",
-        "key_path": "audit.rotate.max_files",
+        "pointer": "/$defs/ServerConfig/properties/cache_dir",
+        "key_path": "server.cache_dir",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -101105,48 +104174,38 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RotateConfig/properties/max_size_mb",
-        "key_path": "audit.rotate.max_size_mb",
+        "pointer": "/$defs/ServerConfig/properties/cors",
+        "key_path": "server.cors",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
+      "purpose": "CORS allowlist; default-deny per Section 17 item 7.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/CorsConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -101191,48 +104250,42 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/CorsConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SchemaConfig/properties/fields",
-        "key_path": "datasets[].tables[].schema.fields",
+        "pointer": "/$defs/ServerConfig/properties/http1_header_read_timeout",
+        "key_path": "server.http1_header_read_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -101274,41 +104327,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SchemaConfig/properties/fields/items",
-        "key_path": "datasets[].tables[].schema.fields[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ServerConfig/properties/max_connections",
+        "key_path": "server.max_connections",
+        "path_kind": "property"
       },
-      "purpose": "One column in a resource schema. Physical type and optional\nsemantic annotations used by catalog and schema metadata.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/FieldConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -101350,43 +104414,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "name",
-            "type"
-          ]
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SchemaConfig/properties/strict",
-        "key_path": "datasets[].tables[].schema.strict",
+        "pointer": "/$defs/ServerConfig/properties/max_source_file_bytes",
+        "key_path": "server.max_source_file_bytes",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
@@ -101437,45 +104501,55 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/admin_bind",
-        "key_path": "server.admin_bind",
+        "pointer": "/$defs/ServerConfig/properties/openapi_requires_auth",
+        "key_path": "server.openapi_requires_auth",
         "path_kind": "property"
       },
-      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_sensitive",
+      "purpose": "Keeps the configured OpenAPI document behind Relay authentication unless an operator explicitly accepts unauthenticated contract discovery.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -101510,41 +104584,27 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": [
-            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
-            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/bind",
-        "key_path": "server.bind",
+        "pointer": "/$defs/ServerConfig/properties/request_body_timeout",
+        "key_path": "server.request_body_timeout",
         "path_kind": "property"
       },
-      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
       "purpose_source": "schema_description",
       "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
@@ -101554,14 +104614,15 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/SocketAddr",
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -101606,12 +104667,13 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
         {
           "keyword": "pattern",
-          "value": [
-            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
-            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
-          ]
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
         },
         {
           "keyword": "type",
@@ -101620,18 +104682,18 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/SocketAddr"
+        "pointer": "/$defs/HumantimeDuration"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/cache_dir",
-        "key_path": "server.cache_dir",
+        "pointer": "/$defs/ServerConfig/properties/request_timeout",
+        "key_path": "server.request_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -101640,11 +104702,12 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -101692,20 +104755,32 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/cors",
-        "key_path": "server.cors",
+        "pointer": "/$defs/ServerConfig/properties/trust_proxy",
+        "key_path": "server.trust_proxy",
         "path_kind": "property"
       },
-      "purpose": "CORS allowlist; default-deny per Section 17 item 7.",
+      "purpose": "`X-Forwarded-For` policy. Until the `ipnet` crate lands in deps we\nkeep CIDR specs as strings and validate format in\n[`validate::run`].",
       "purpose_source": "schema_description",
       "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
@@ -101715,7 +104790,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/CorsConfig",
+        "local_reference": "#/$defs/TrustProxyConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -101775,102 +104850,14 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/CorsConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/http1_header_read_timeout",
-        "key_path": "server.http1_header_read_timeout",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
+        "pointer": "/$defs/TrustProxyConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/max_connections",
-        "key_path": "server.max_connections",
+        "pointer": "/$defs/ServerConfig/properties/xlsx_max_file_bytes",
+        "key_path": "server.xlsx_max_file_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
@@ -101937,7 +104924,7 @@
       "constraints": [
         {
           "keyword": "format",
-          "value": "uint"
+          "value": "uint64"
         },
         {
           "keyword": "maximum",
@@ -101956,28 +104943,29 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/max_source_file_bytes",
-        "key_path": "server.max_source_file_bytes",
+        "pointer": "/$defs/SourceConfig/oneOf/0/properties/format",
+        "key_path": "datasets[].tables[].source.format",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
+      "purpose": "Storage table format override. If omitted, ingest infers the format\nfrom the source file extension.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -102019,55 +105007,46 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/openapi_requires_auth",
-        "key_path": "server.openapi_requires_auth",
+        "pointer": "/$defs/SourceConfig/oneOf/0/properties/path",
+        "key_path": "datasets[].tables[].source.path",
         "path_kind": "property"
       },
-      "purpose": "Keeps the configured OpenAPI document behind Relay authentication unless an operator explicitly accepts unauthenticated contract discovery.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_server_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -102102,29 +105081,32 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/request_body_timeout",
-        "key_path": "server.request_body_timeout",
+        "pointer": "/$defs/SourceConfig/oneOf/0/properties/type",
+        "key_path": "datasets[].tables[].source.type",
         "path_kind": "property"
       },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -102132,15 +105114,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -102182,56 +105162,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+          "keyword": "const",
+          "value": [
+            "file",
+            "postgres"
+          ]
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/request_timeout",
-        "key_path": "server.request_timeout",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/change_token_sql",
+        "key_path": "datasets[].tables[].source.change_token_sql",
         "path_kind": "property"
       },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -102266,57 +105242,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/trust_proxy",
-        "key_path": "server.trust_proxy",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connect_timeout",
+        "key_path": "datasets[].tables[].source.connect_timeout",
         "path_kind": "property"
       },
-      "purpose": "`X-Forwarded-For` policy. Until the `ipnet` crate lands in deps we\nkeep CIDR specs as strings and validate format in\n[`validate::run`].",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/TrustProxyConfig",
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -102358,47 +105328,56 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig"
+        "pointer": "/$defs/HumantimeDuration"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/xlsx_max_file_bytes",
-        "key_path": "server.xlsx_max_file_bytes",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connection_env",
+        "key_path": "datasets[].tables[].source.connection_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
+      "intent_profile": "relay_datasets_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/PostgresEnvironmentNameSchema",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -102433,40 +105412,39 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]*$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/PostgresEnvironmentNameSchema"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/0/properties/format",
-        "key_path": "datasets[].tables[].source.format",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query",
+        "key_path": "datasets[].tables[].source.query",
         "path_kind": "property"
       },
-      "purpose": "Storage table format override. If omitted, ingest infers the format\nfrom the source file extension.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -102474,16 +105452,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -102532,8 +105510,8 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -102541,13 +105519,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/0/properties/path",
-        "key_path": "datasets[].tables[].source.path",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query_timeout",
+        "key_path": "datasets[].tables[].source.query_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -102555,16 +105533,18 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -102599,46 +105579,58 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/0/properties/type",
-        "key_path": "datasets[].tables[].source.type",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/table",
+        "key_path": "datasets[].tables[].source.table",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Structured database table reference. Keeping schema/name separate\navoids parsing dotted identifiers and leaves quoting to connectors.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -102685,47 +105677,48 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
+          "keyword": "required",
           "value": [
-            "file",
-            "postgres"
+            "schema",
+            "name"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/change_token_sql",
-        "key_path": "datasets[].tables[].source.change_token_sql",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -102760,34 +105753,29 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connect_timeout",
-        "key_path": "datasets[].tables[].source.connect_timeout",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_x",
         "path_kind": "property"
       },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -102796,15 +105784,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -102850,34 +105836,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connection_env",
-        "key_path": "datasets[].tables[].source.connection_env",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.max_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_secret_reference",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -102885,17 +105859,16 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/PostgresEnvironmentNameSchema",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -102930,35 +105903,25 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/PostgresEnvironmentNameSchema"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query",
-        "key_path": "datasets[].tables[].source.query",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -102969,17 +105932,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -103027,22 +105988,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query_timeout",
-        "key_path": "datasets[].tables[].source.query_timeout",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -103051,15 +106009,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -103105,50 +106061,36 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/table",
-        "key_path": "datasets[].tables[].source.table",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
-      "purpose": "Structured database table reference. Keeping schema/name separate\navoids parsing dotted identifiers and leaves quoting to connectors.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -103195,26 +106137,91 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "schema",
-            "name"
-          ]
-        },
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.max_y",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_x",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103288,8 +106295,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_x",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103363,8 +106370,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.max_x",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103438,8 +106445,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_x",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103513,8 +106520,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_y",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103588,8 +106595,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_y",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_y",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103663,8 +106670,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.max_y",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_y",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103738,8 +106745,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_y",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.min_y",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103813,8 +106820,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_y",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103888,8 +106895,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/crs",
+        "key_path": "datasets[].entities[].spatial.geometry.crs",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103963,8 +106970,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/kind",
+        "key_path": "datasets[].entities[].spatial.geometry.kind",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103981,7 +106988,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -104029,6 +107036,15 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "geojson",
+            "point",
+            "wkb",
+            "wkt"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -104038,8 +107054,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/latitude_field",
+        "key_path": "datasets[].entities[].spatial.geometry.latitude_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -104113,8 +107129,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/longitude_field",
+        "key_path": "datasets[].entities[].spatial.geometry.longitude_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -104188,8 +107204,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/1/properties/field",
+        "key_path": "datasets[].entities[].spatial.geometry.field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -104263,13 +107279,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/dataset",
+        "key_path": "standards.spdci.disability_registry.dataset",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -104277,11 +107293,12 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -104329,36 +107346,45 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values",
+        "key_path": "standards.spdci.disability_registry.disabled_positive_values",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Case-insensitive values interpreted as disabled.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -104406,20 +107432,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/crs",
-        "key_path": "datasets[].entities[].spatial.geometry.crs",
-        "path_kind": "property"
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values/items",
+        "key_path": "standards.spdci.disability_registry.disabled_positive_values[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -104429,11 +107455,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -104488,13 +107514,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/kind",
-        "key_path": "datasets[].entities[].spatial.geometry.kind",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_status_field",
+        "key_path": "standards.spdci.disability_registry.disabled_status_field",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Entity field whose value determines the SP DCI disabled response.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -104504,11 +107530,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -104554,15 +107581,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "geojson",
-            "point",
-            "wkb",
-            "wkt"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -104572,13 +107590,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/latitude_field",
-        "key_path": "datasets[].entities[].spatial.geometry.latitude_field",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/entity",
+        "key_path": "standards.spdci.disability_registry.entity",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -104647,13 +107665,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/longitude_field",
-        "key_path": "datasets[].entities[].spatial.geometry.longitude_field",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_field",
+        "key_path": "standards.spdci.disability_registry.query_field",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Entity field filtered when the SP DCI query key is present.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -104663,11 +107681,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -104722,13 +107741,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/1/properties/field",
-        "key_path": "datasets[].entities[].spatial.geometry.field",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_key",
+        "key_path": "standards.spdci.disability_registry.query_key",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Query key accepted from SP DCI `disabled_criteria.query`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -104738,14 +107757,15 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -104780,12 +107800,14 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -104797,8 +107819,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/dataset",
-        "key_path": "standards.spdci.disability_registry.dataset",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/dataset",
+        "key_path": "standards.spdci.registries.*.dataset",
         "path_kind": "property"
       },
       "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
@@ -104881,19 +107903,19 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values",
-        "key_path": "standards.spdci.disability_registry.disabled_positive_values",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/default_limit",
+        "key_path": "standards.spdci.registries.*.default_limit",
         "path_kind": "property"
       },
-      "purpose": "Case-insensitive values interpreted as disabled.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -104948,18 +107970,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values/items",
-        "key_path": "standards.spdci.disability_registry.disabled_positive_values[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/SpdciRegistryConfig/properties/entity",
+        "key_path": "standards.spdci.registries.*.entity",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
@@ -104973,11 +108007,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -105032,11 +108066,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_status_field",
-        "key_path": "standards.spdci.disability_registry.disabled_status_field",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields",
+        "key_path": "standards.spdci.registries.*.expression_fields",
         "path_kind": "property"
       },
-      "purpose": "Entity field whose value determines the SP DCI disabled response.",
+      "purpose": "DCI expression or predicate attribute to entity field mappings.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
@@ -105044,13 +108078,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -105101,20 +108135,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/entity",
-        "key_path": "standards.spdci.disability_registry.entity",
-        "path_kind": "property"
+        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields/additionalProperties",
+        "key_path": "standards.spdci.registries.*.expression_fields.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Each reviewed key names an expression-visible field and each value defines the bounded source expression exposed under that name.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_standards_spdci_registries_expression_fields_open_map",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -105124,14 +108158,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "relay",
@@ -105171,7 +108205,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -105183,11 +108217,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_field",
-        "key_path": "standards.spdci.disability_registry.query_field",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers",
+        "key_path": "standards.spdci.registries.*.identifiers",
         "path_kind": "property"
       },
-      "purpose": "Entity field filtered when the SP DCI query key is present.",
+      "purpose": "DCI identifier type to entity field mappings for `idtype-value`.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
@@ -105195,13 +108229,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -105252,20 +108286,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_key",
-        "key_path": "standards.spdci.disability_registry.query_key",
-        "path_kind": "property"
+        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers/additionalProperties",
+        "key_path": "standards.spdci.registries.*.identifiers.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Query key accepted from SP DCI `disabled_criteria.query`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_sensitive",
+      "purpose": "Each reviewed key names an identifier role and each value defines the exact request identifier binding for that role.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_standards_spdci_registries_identifiers_open_map",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -105275,15 +108309,14 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "relay",
@@ -105318,14 +108351,12 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -105337,92 +108368,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/dataset",
-        "key_path": "standards.spdci.registries.*.dataset",
-        "path_kind": "property"
-      },
-      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/DatasetId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/default_limit",
-        "key_path": "standards.spdci.registries.*.default_limit",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/record_type",
+        "key_path": "standards.spdci.registries.*.record_type",
         "path_kind": "property"
       },
       "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
@@ -105433,13 +108380,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -105488,29 +108435,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/entity",
-        "key_path": "standards.spdci.registries.*.entity",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/registry_type",
+        "key_path": "standards.spdci.registries.*.registry_type",
         "path_kind": "property"
       },
       "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
@@ -105525,11 +108460,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -105584,11 +108520,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields",
-        "key_path": "standards.spdci.registries.*.expression_fields",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields",
+        "key_path": "standards.spdci.registries.*.response_fields",
         "path_kind": "property"
       },
-      "purpose": "DCI expression or predicate attribute to entity field mappings.",
+      "purpose": "SP DCI output path to entity field mappings for direct response\nprojection. A CEL mapping takes precedence when both are set.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
@@ -105660,13 +108596,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields/additionalProperties",
-        "key_path": "standards.spdci.registries.*.expression_fields.*",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields/additionalProperties",
+        "key_path": "standards.spdci.registries.*.response_fields.*",
         "path_kind": "map_value"
       },
-      "purpose": "Each reviewed key names an expression-visible field and each value defines the bounded source expression exposed under that name.",
+      "purpose": "Each reviewed key names a response field and each value defines the exact bounded response projection for that field.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_spdci_registries_expression_fields_open_map",
+      "intent_profile": "relay_standards_spdci_registries_response_fields_open_map",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -105735,31 +108671,32 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers",
-        "key_path": "standards.spdci.registries.*.identifiers",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_mapping_path",
+        "key_path": "standards.spdci.registries.*.response_mapping_path",
         "path_kind": "property"
       },
-      "purpose": "DCI identifier type to entity field mappings for `idtype-value`.",
+      "purpose": "Optional local CEL mapping document used to shape response records.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_standards_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -105794,47 +108731,54 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers/additionalProperties",
-        "key_path": "standards.spdci.registries.*.identifiers.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_schema_path",
+        "key_path": "standards.spdci.registries.*.response_schema_path",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names an identifier role and each value defines the exact request identifier binding for that role.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_spdci_registries_identifiers_open_map",
+      "purpose": "Optional local JSON Schema used to validate shaped response records.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -105869,45 +108813,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/record_type",
-        "key_path": "standards.spdci.registries.*.record_type",
+        "pointer": "/$defs/SpdciStandardsConfig/properties/disability_registry",
+        "key_path": "standards.spdci.disability_registry",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Runtime binding from SP DCI Disability Registry sync APIs to one\nconfigured Registry Relay entity.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -105953,17 +108903,27 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "dataset",
+            "entity"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/registry_type",
-        "key_path": "standards.spdci.registries.*.registry_type",
+        "pointer": "/$defs/SpdciStandardsConfig/properties/registries",
+        "key_path": "standards.spdci.registries",
         "path_kind": "property"
       },
       "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
@@ -105974,16 +108934,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -106031,20 +108991,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields",
-        "key_path": "standards.spdci.registries.*.response_fields",
-        "path_kind": "property"
+        "pointer": "/$defs/SpdciStandardsConfig/properties/registries/additionalProperties",
+        "key_path": "standards.spdci.registries.*",
+        "path_kind": "map_value"
       },
-      "purpose": "SP DCI output path to entity field mappings for direct response\nprojection. A CEL mapping takes precedence when both are set.",
+      "purpose": "Runtime binding from a DCI registry sync search API to one configured\nRegistry Relay entity.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_standards_spdci_registries_open_map",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -106052,17 +109012,17 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/SpdciRegistryConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "relay",
@@ -106102,42 +109062,55 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "dataset",
+            "entity"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields/additionalProperties",
-        "key_path": "standards.spdci.registries.*.response_fields.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/StandardsConfig/properties/spdci",
+        "key_path": "standards.spdci",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a response field and each value defines the exact bounded response projection for that field.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_spdci_registries_response_fields_open_map",
+      "purpose": "Social Protection Digital Convergence Initiative (SP DCI) adapter\nconfiguration.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -106177,44 +109150,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_mapping_path",
-        "key_path": "standards.spdci.registries.*.response_mapping_path",
+        "pointer": "/$defs/TrustProxyConfig/properties/enabled",
+        "key_path": "server.trust_proxy.enabled",
         "path_kind": "property"
       },
-      "purpose": "Optional local CEL mapping document used to shape response records.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_sensitive",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -106249,48 +109224,41 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_schema_path",
-        "key_path": "standards.spdci.registries.*.response_schema_path",
+        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies",
+        "key_path": "server.trust_proxy.trusted_proxies",
         "path_kind": "property"
       },
-      "purpose": "Optional local JSON Schema used to validate shaped response records.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_sensitive",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_server_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -106338,47 +109306,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciStandardsConfig/properties/disability_registry",
-        "key_path": "standards.spdci.disability_registry",
-        "path_kind": "property"
+        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies/items",
+        "key_path": "server.trust_proxy.trusted_proxies[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Runtime binding from SP DCI Disability Registry sync APIs to one\nconfigured Registry Relay entity.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_server_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -106413,55 +109377,49 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "dataset",
-            "entity"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciStandardsConfig/properties/registries",
-        "key_path": "standards.spdci.registries",
+        "pointer": "/$defs/XlsxFormatConfig/properties/data_range",
+        "key_path": "datasets[].tables[].source.format.xlsx.data_range",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -106509,38 +109467,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciStandardsConfig/properties/registries/additionalProperties",
-        "key_path": "standards.spdci.registries.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/XlsxFormatConfig/properties/header_row",
+        "key_path": "datasets[].tables[].source.format.xlsx.header_row",
+        "path_kind": "property"
       },
-      "purpose": "Runtime binding from a DCI registry sync search API to one configured\nRegistry Relay entity.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_spdci_registries_open_map",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer",
+          "null"
         ],
-        "local_reference": "#/$defs/SpdciRegistryConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -106580,52 +109542,56 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "dataset",
-            "entity"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/StandardsConfig/properties/spdci",
-        "key_path": "standards.spdci",
+        "pointer": "/$defs/XlsxFormatConfig/properties/sheet",
+        "key_path": "datasets[].tables[].source.format.xlsx.sheet",
         "path_kind": "property"
       },
-      "purpose": "Social Protection Digital Convergence Initiative (SP DCI) adapter\nconfiguration.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -106674,8 +109640,8 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -106683,28 +109649,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig/properties/enabled",
-        "key_path": "server.trust_proxy.enabled",
+        "pointer": "/properties/audit",
+        "key_path": "audit",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
+      "purpose": "Audit configuration. Sink choice gates further fields via the\ntagged `AuditSinkConfig` enum. The enum is flattened onto the\ncontaining struct so that the YAML `sink:` key acts as the\ndiscriminator, matching the public example configuration.\n\n`deny_unknown_fields` is deliberately omitted here: `serde` does\nnot support combining it with `#[serde(flatten)]` on an internally\ntagged enum (unknown keys in `audit` are caught by the enum's own\n`deny_unknown_fields`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
+        "local_reference": "#/$defs/AuditConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -106749,40 +109715,60 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "sink",
+              "path"
+            ],
+            [
+              "sink"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
+        },
+        {
+          "keyword": "unevaluatedProperties",
+          "value": false
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies",
-        "key_path": "server.trust_proxy.trusted_proxies",
+        "pointer": "/properties/auth",
+        "key_path": "auth",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
+      "purpose": "Authentication configuration. Exactly one of `api_keys` and `oidc`\nis consumed at startup, gated by `mode`; cross-field validation in\n[`validate`] enforces that only the active block is populated.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AuthConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -106817,50 +109803,58 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies/items",
-        "key_path": "server.trust_proxy.trusted_proxies[]",
-        "path_kind": "array_item"
+        "pointer": "/properties/catalog",
+        "key_path": "catalog",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
+      "purpose": "Catalog-level metadata surfaced by `/metadata/*` and DCAT outputs.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_catalog_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/CatalogConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -106895,49 +109889,57 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "title",
+            "base_url",
+            "publisher"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/XlsxFormatConfig/properties/data_range",
-        "key_path": "datasets[].tables[].source.format.xlsx.data_range",
+        "pointer": "/properties/config_trust",
+        "key_path": "config_trust",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Optional signed configuration bundle trust state.\n\nSimple local deployments omit this block. Bundle-aware deployments pin the\nlocal trust anchor, bundle, and anti-rollback state paths explicitly.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_config_trust_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -106979,15 +109981,22 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "trust_anchor_path",
+            "bundle_path",
+            "antirollback_state_path"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -106995,29 +110004,29 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/XlsxFormatConfig/properties/header_row",
-        "key_path": "datasets[].tables[].source.format.xlsx.header_row",
+        "pointer": "/properties/consultation",
+        "key_path": "consultation",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107064,22 +110073,18 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "authorized_workload",
+            "state_plane",
+            "audit_pseudonym_materials"
+          ]
         },
         {
           "keyword": "type",
           "value": [
-            "integer",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -107087,8 +110092,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/XlsxFormatConfig/properties/sheet",
-        "key_path": "datasets[].tables[].source.format.xlsx.sheet",
+        "pointer": "/properties/datasets",
+        "key_path": "datasets",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -107099,17 +110104,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107157,23 +110160,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/audit",
-        "key_path": "audit",
-        "path_kind": "property"
+        "pointer": "/properties/datasets/items",
+        "key_path": "datasets[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Audit configuration. Sink choice gates further fields via the\ntagged `AuditSinkConfig` enum. The enum is flattened onto the\ncontaining struct so that the YAML `sink:` key acts as the\ndiscriminator, matching the public example configuration.\n\n`deny_unknown_fields` is deliberately omitted here: `serde` does\nnot support combining it with `#[serde(flatten)]` on an internally\ntagged enum (unknown keys in `audit` are caught by the enum's own\n`deny_unknown_fields`).",
+      "purpose": "A single dataset declaration.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -107181,14 +110181,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AuditConfig",
+        "local_reference": "#/$defs/DatasetConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107230,45 +110230,42 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            [
-              "sink",
-              "path"
-            ],
-            [
-              "sink"
-            ]
+            "id",
+            "title",
+            "description",
+            "owner",
+            "sensitivity",
+            "access_rights",
+            "update_frequency"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
-        },
-        {
-          "keyword": "unevaluatedProperties",
-          "value": false
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig"
+        "pointer": "/$defs/DatasetConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/auth",
-        "key_path": "auth",
+        "pointer": "/properties/deployment",
+        "key_path": "deployment",
         "path_kind": "property"
       },
-      "purpose": "Authentication configuration. Exactly one of `api_keys` and `oidc`\nis consumed at startup, gated by `mode`; cross-field validation in\n[`validate`] enforces that only the active block is populated.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -107276,14 +110273,15 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AuthConfig",
+        "local_reference": "#/$defs/DeploymentConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107329,12 +110327,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -107342,19 +110334,19 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AuthConfig"
+        "pointer": "/$defs/DeploymentConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/catalog",
-        "key_path": "catalog",
+        "pointer": "/properties/instance",
+        "key_path": "instance",
         "path_kind": "property"
       },
-      "purpose": "Catalog-level metadata surfaced by `/metadata/*` and DCAT outputs.",
+      "purpose": "Stable deployment identity surfaced in redacted operations posture.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_internal",
+      "intent_profile": "relay_instance_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -107362,14 +110354,15 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/CatalogConfig",
+        "local_reference": "#/$defs/InstanceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107414,14 +110407,6 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "title",
-            "base_url",
-            "publisher"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -107429,19 +110414,19 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig"
+        "pointer": "/$defs/InstanceConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/config_trust",
-        "key_path": "config_trust",
+        "pointer": "/properties/metadata",
+        "key_path": "metadata",
         "path_kind": "property"
       },
-      "purpose": "Optional signed configuration bundle trust state.\n\nSimple local deployments omit this block. Bundle-aware deployments pin the\nlocal trust anchor, bundle, and anti-rollback state paths explicitly.",
+      "purpose": "Optional split metadata manifest loaded alongside the runtime config.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_config_trust_internal",
+      "intent_profile": "relay_metadata_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -107505,9 +110490,7 @@
         {
           "keyword": "required",
           "value": [
-            "trust_anchor_path",
-            "bundle_path",
-            "antirollback_state_path"
+            "source"
           ]
         },
         {
@@ -107522,29 +110505,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/consultation",
-        "key_path": "consultation",
+        "pointer": "/properties/server",
+        "key_path": "server",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "HTTP listener and adjacent server-wide knobs.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/ServerConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107586,51 +110568,51 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "authorized_workload",
-            "state_plane",
-            "audit_pseudonym_materials"
+            "bind"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/datasets",
-        "key_path": "datasets",
+        "pointer": "/properties/standards",
+        "key_path": "standards",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/StandardsConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107678,20 +110660,24 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/StandardsConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/datasets/items",
-        "key_path": "datasets[]",
-        "path_kind": "array_item"
+        "pointer": "/properties/vocabularies",
+        "key_path": "vocabularies",
+        "path_kind": "property"
       },
-      "purpose": "A single dataset declaration.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Controls the reviewed vocabulary bindings Relay uses to interpret namespaced terms.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_vocabularies_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -107699,14 +110685,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/DatasetConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107748,61 +110734,42 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "title",
-            "description",
-            "owner",
-            "sensitivity",
-            "access_rights",
-            "update_frequency"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/deployment",
-        "key_path": "deployment",
-        "path_kind": "property"
+        "pointer": "/properties/vocabularies/additionalProperties",
+        "key_path": "vocabularies.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Each reviewed key is a vocabulary prefix and each value binds that prefix to its operator-approved vocabulary identifier.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
+      "intent_profile": "relay_vocabularies_open_map",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DeploymentConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "relay",
@@ -107842,51 +110809,45 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/properties/instance",
-        "key_path": "instance",
-        "path_kind": "property"
+        "schema": "notary",
+        "pointer": "",
+        "key_path": "",
+        "path_kind": "root"
       },
-      "purpose": "Stable deployment identity surfaced in redacted operations posture.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_instance_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Defines the complete Notary runtime configuration boundary consumed when a Notary instance starts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_root_structural",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/InstanceConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
-        "relay",
+        "notary",
         "docs"
       ],
       "availability": "published",
@@ -107896,7 +110857,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -107906,18 +110867,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
       "consumers": [
-        "registry_relay",
+        "registry_notary",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "relay_config",
+        "notary_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "relay",
+        "notary",
         "documentation"
       ],
       "semantic_rules": [
@@ -107925,48 +110886,50 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "evidence",
+            "auth"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/InstanceConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/properties/metadata",
-        "key_path": "metadata",
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/access_token_ttl_seconds",
+        "key_path": "auth.access_token_signing.access_token_ttl_seconds",
         "path_kind": "property"
       },
-      "purpose": "Optional split metadata manifest loaded alongside the runtime config.",
+      "purpose": "Access-token lifetime in seconds.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "integer"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "relay",
+        "notary",
         "docs"
       ],
       "availability": "published",
@@ -107976,7 +110939,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -107986,71 +110949,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
       "consumers": [
-        "registry_relay",
+        "registry_notary",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "relay_config",
+        "notary_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "relay",
+        "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "source"
-          ]
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/properties/server",
-        "key_path": "server",
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms",
+        "key_path": "auth.access_token_signing.allowed_algorithms",
         "path_kind": "property"
       },
-      "purpose": "HTTP listener and adjacent server-wide knobs.",
+      "purpose": "Allowed signing algorithms. Only EdDSA is supported.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/ServerConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "relay",
+        "notary",
         "docs"
       ],
       "availability": "published",
@@ -108060,7 +111026,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -108070,73 +111036,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
       "consumers": [
-        "registry_relay",
+        "registry_notary",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "relay_config",
+        "notary_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "relay",
+        "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "bind"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/properties/standards",
-        "key_path": "standards",
-        "path_kind": "property"
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms/items",
+        "key_path": "auth.access_token_signing.allowed_algorithms[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/StandardsConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "relay",
+        "notary",
         "docs"
       ],
       "availability": "published",
@@ -108146,7 +111104,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -108156,52 +111114,51 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
       "consumers": [
-        "registry_relay",
+        "registry_notary",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "relay_config",
+        "notary_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "relay",
+        "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/StandardsConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/properties/vocabularies",
-        "key_path": "vocabularies",
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences",
+        "key_path": "auth.access_token_signing.audiences",
         "path_kind": "property"
       },
-      "purpose": "Controls the reviewed vocabulary bindings Relay uses to interpret namespaced terms.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_vocabularies_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Audiences (`aud`) accepted for Notary-minted access tokens.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -108212,11 +111169,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "relay",
+        "notary",
         "docs"
       ],
       "availability": "published",
@@ -108226,7 +111183,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -108236,44 +111193,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
       "consumers": [
-        "registry_relay",
+        "registry_notary",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "relay_config",
+        "notary_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "relay",
+        "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/properties/vocabularies/additionalProperties",
-        "key_path": "vocabularies.*",
-        "path_kind": "map_value"
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences/items",
+        "key_path": "auth.access_token_signing.audiences[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Each reviewed key is a vocabulary prefix and each value binds that prefix to its operator-approved vocabulary identifier.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_vocabularies_open_map",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -108286,11 +111247,11 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "relay",
+        "notary",
         "docs"
       ],
       "availability": "published",
@@ -108300,7 +111261,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -108310,24 +111271,27 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
       "consumers": [
-        "registry_relay",
+        "registry_notary",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "relay_config",
+        "notary_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "relay",
+        "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -108339,30 +111303,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "",
-        "key_path": "",
-        "path_kind": "root"
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/enabled",
+        "key_path": "auth.access_token_signing.enabled",
+        "path_kind": "property"
       },
-      "purpose": "Defines the complete Notary runtime configuration boundary consumed when a Notary instance starts.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_root_structural",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -108397,34 +111362,31 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "evidence",
-            "auth"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/access_token_ttl_seconds",
-        "key_path": "auth.access_token_signing.access_token_ttl_seconds",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/issuer",
+        "key_path": "auth.access_token_signing.issuer",
         "path_kind": "property"
       },
-      "purpose": "Access-token lifetime in seconds.",
+      "purpose": "Issuer (`iss`) the Notary stamps into its own access tokens.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
@@ -108432,13 +111394,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -108490,28 +111452,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms",
-        "key_path": "auth.access_token_signing.allowed_algorithms",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/signing_key_id",
+        "key_path": "auth.access_token_signing.signing_key_id",
         "path_kind": "property"
       },
-      "purpose": "Allowed signing algorithms. Only EdDSA is supported.",
+      "purpose": "`evidence.signing_keys` entry used to sign access tokens. Must be a\ndedicated key, never a credential-signing key.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
@@ -108519,13 +111473,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -108579,19 +111533,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms/items",
-        "key_path": "auth.access_token_signing.allowed_algorithms[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/token_typ",
+        "key_path": "auth.access_token_signing.token_typ",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Header `typ` stamped into Notary access tokens, distinct from the\ncredential `typ` so a token cannot be replayed as another class.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
@@ -108602,11 +111556,12 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -108664,11 +111619,11 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences",
-        "key_path": "auth.access_token_signing.audiences",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids",
+        "key_path": "auth.access_token_signing.verification_key_ids",
         "path_kind": "property"
       },
-      "purpose": "Audiences (`aud`) accepted for Notary-minted access tokens.",
+      "purpose": "Additional publish-only `evidence.signing_keys` entries accepted for\nverifying previously minted Notary access tokens and pre-authorized\ncodes during a governed key rotation.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
@@ -108684,8 +111639,86 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "security",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids/items",
+        "key_path": "auth.access_token_signing.verification_key_ids[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -108736,37 +111769,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences/items",
-        "key_path": "auth.access_token_signing.audiences[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/BatchOperationConfig/properties/enabled",
+        "key_path": "evidence.claims[].operations.batch_evaluate.enabled",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -108801,39 +111835,36 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/enabled",
-        "key_path": "auth.access_token_signing.enabled",
+        "pointer": "/$defs/BatchOperationConfig/properties/max_subjects",
+        "key_path": "evidence.claims[].operations.batch_evaluate.max_subjects",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
@@ -108891,40 +111922,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "maximum",
+          "value": 100
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/issuer",
-        "key_path": "auth.access_token_signing.issuer",
+        "pointer": "/$defs/CccevConfig/properties/evidence_type",
+        "key_path": "evidence.claims[].cccev.evidence_type",
         "path_kind": "property"
       },
-      "purpose": "Issuer (`iss`) the Notary stamps into its own access tokens.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -108959,51 +112003,52 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/signing_key_id",
-        "key_path": "auth.access_token_signing.signing_key_id",
+        "pointer": "/$defs/CccevConfig/properties/evidence_type_iri",
+        "key_path": "evidence.claims[].cccev.evidence_type_iri",
         "path_kind": "property"
       },
-      "purpose": "`evidence.signing_keys` entry used to sign access tokens. Must be a\ndedicated key, never a credential-signing key.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -109038,51 +112083,52 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/token_typ",
-        "key_path": "auth.access_token_signing.token_typ",
+        "pointer": "/$defs/CccevConfig/properties/requirement_type",
+        "key_path": "evidence.claims[].cccev.requirement_type",
         "path_kind": "property"
       },
-      "purpose": "Header `typ` stamped into Notary access tokens, distinct from the\ncredential `typ` so a token cannot be replayed as another class.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -109117,39 +112163,39 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids",
-        "key_path": "auth.access_token_signing.verification_key_ids",
+        "pointer": "/$defs/CelBindingsConfig/properties/claims",
+        "key_path": "evidence.claims[].rule.bindings.claims",
         "path_kind": "property"
       },
-      "purpose": "Additional publish-only `evidence.signing_keys` entries accepted for\nverifying previously minted Notary access tokens and pre-authorized\ncodes during a governed key rotation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
         "composed": false
       },
@@ -109157,11 +112203,11 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -109196,50 +112242,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids/items",
-        "key_path": "auth.access_token_signing.verification_key_ids[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/CelBindingsConfig/properties/claims/additionalProperties",
+        "key_path": "evidence.claims[].rule.bindings.claims.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Each reviewed key names a CEL claim binding and each value selects the approved evidence claim exposed to that binding.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_claims_rule_bindings_claims_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ClaimBindingConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "notary",
@@ -109274,28 +112318,35 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "claim"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimBindingConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/BatchOperationConfig/properties/enabled",
-        "key_path": "evidence.claims[].operations.batch_evaluate.enabled",
+        "pointer": "/$defs/CelBindingsConfig/properties/vars",
+        "key_path": "evidence.claims[].rule.bindings.vars",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -109306,7 +112357,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
         "composed": false
       },
@@ -109363,38 +112414,39 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/BatchOperationConfig/properties/max_subjects",
-        "key_path": "evidence.claims[].operations.batch_evaluate.max_subjects",
+        "pointer": "/$defs/ClaimBindingConfig/properties/binding_type",
+        "key_path": "evidence.claims[].rule.bindings.claims.*.binding_type",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -109429,40 +112481,28 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "maximum",
-          "value": 100
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CccevConfig/properties/evidence_type",
-        "key_path": "evidence.claims[].cccev.evidence_type",
+        "pointer": "/$defs/ClaimBindingConfig/properties/claim",
+        "key_path": "evidence.claims[].rule.bindings.claims.*.claim",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -109473,17 +112513,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109531,18 +112569,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CccevConfig/properties/evidence_type_iri",
-        "key_path": "evidence.claims[].cccev.evidence_type_iri",
+        "pointer": "/$defs/ClaimDefinition/properties/cccev",
+        "key_path": "evidence.claims[].cccev",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -109554,16 +112589,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109612,8 +112647,8 @@
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -109621,32 +112656,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CccevConfig/properties/requirement_type",
-        "key_path": "evidence.claims[].cccev.requirement_type",
+        "pointer": "/$defs/ClaimDefinition/properties/credential_profiles",
+        "key_path": "evidence.claims[].credential_profiles",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -109681,51 +112715,50 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CelBindingsConfig/properties/claims",
-        "key_path": "evidence.claims[].rule.bindings.claims",
-        "path_kind": "property"
+        "pointer": "/$defs/ClaimDefinition/properties/credential_profiles/items",
+        "key_path": "evidence.claims[].credential_profiles[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -109760,48 +112793,51 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CelBindingsConfig/properties/claims/additionalProperties",
-        "key_path": "evidence.claims[].rule.bindings.claims.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/ClaimDefinition/properties/depends_on",
+        "key_path": "evidence.claims[].depends_on",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a CEL claim binding and each value selects the approved evidence claim exposed to that binding.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_claims_rule_bindings_claims_open_map",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/ClaimBindingConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -109841,31 +112877,21 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "claim"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimBindingConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CelBindingsConfig/properties/vars",
-        "key_path": "evidence.claims[].rule.bindings.vars",
-        "path_kind": "property"
+        "pointer": "/$defs/ClaimDefinition/properties/depends_on/items",
+        "key_path": "evidence.claims[].depends_on[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -109875,16 +112901,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109932,15 +112957,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimBindingConfig/properties/binding_type",
-        "key_path": "evidence.claims[].rule.bindings.claims.*.binding_type",
+        "pointer": "/$defs/ClaimDefinition/properties/disclosure",
+        "key_path": "evidence.claims[].disclosure",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -109951,14 +112976,14 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/DisclosureConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -110009,18 +113034,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/DisclosureConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimBindingConfig/properties/claim",
-        "key_path": "evidence.claims[].rule.bindings.claims.*.claim",
+        "pointer": "/$defs/ClaimDefinition/properties/evidence_mode",
+        "key_path": "evidence.claims[].evidence_mode",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110031,13 +113057,14 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ClaimEvidenceMode",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -110085,34 +113112,49 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "type",
+              "consultations"
+            ],
+            [
+              "type"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimEvidenceMode"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/cccev",
-        "key_path": "evidence.claims[].cccev",
+        "pointer": "/$defs/ClaimDefinition/properties/formats",
+        "key_path": "evidence.claims[].formats",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Omitting this field keeps existing authored claims renderable using the\ncanonical claim-result representation. An explicitly empty list is\nrejected during configuration validation.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -110164,41 +113206,37 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/credential_profiles",
-        "key_path": "evidence.claims[].credential_profiles",
-        "path_kind": "property"
+        "pointer": "/$defs/ClaimDefinition/properties/formats/items",
+        "key_path": "evidence.claims[].formats[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -110233,33 +113271,30 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/credential_profiles/items",
-        "key_path": "evidence.claims[].credential_profiles[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ClaimDefinition/properties/id",
+        "key_path": "evidence.claims[].id",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -110269,14 +113304,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -110311,14 +113346,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -110331,8 +113363,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/depends_on",
-        "key_path": "evidence.claims[].depends_on",
+        "pointer": "/$defs/ClaimDefinition/properties/inputs",
+        "key_path": "evidence.claims[].inputs",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110407,8 +113439,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/depends_on/items",
-        "key_path": "evidence.claims[].depends_on[]",
+        "pointer": "/$defs/ClaimDefinition/properties/inputs/items",
+        "key_path": "evidence.claims[].inputs[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110419,13 +113451,14 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ClaimInputConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
@@ -110473,17 +113506,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "type"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimInputConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/disclosure",
-        "key_path": "evidence.claims[].disclosure",
+        "pointer": "/$defs/ClaimDefinition/properties/oots",
+        "key_path": "evidence.claims[].oots",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110494,13 +113538,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/DisclosureConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -110552,19 +113596,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/evidence_mode",
-        "key_path": "evidence.claims[].evidence_mode",
+        "pointer": "/$defs/ClaimDefinition/properties/operations",
+        "key_path": "evidence.claims[].operations",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110577,14 +113620,15 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ClaimEvidenceMode",
+        "local_reference": "#/$defs/ClaimOperationsConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110630,18 +113674,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "consultations"
-            ],
-            [
-              "type"
-            ]
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -110649,17 +113681,97 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimEvidenceMode"
+        "pointer": "/$defs/ClaimOperationsConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/formats",
-        "key_path": "evidence.claims[].formats",
+        "pointer": "/$defs/ClaimDefinition/properties/purpose",
+        "key_path": "evidence.claims[].purpose",
         "path_kind": "property"
       },
-      "purpose": "Omitting this field keeps existing authored claims renderable using the\ncanonical claim-result representation. An explicitly empty list is\nrejected during configuration validation.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": [
+            "string",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimDefinition/properties/required_scopes",
+        "key_path": "evidence.claims[].required_scopes",
+        "path_kind": "property"
+      },
+      "purpose": "Caller scopes checked before any registry consultation is dispatched.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
@@ -110731,8 +113843,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/formats/items",
-        "key_path": "evidence.claims[].formats[]",
+        "pointer": "/$defs/ClaimDefinition/properties/required_scopes/items",
+        "key_path": "evidence.claims[].required_scopes[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110806,8 +113918,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/id",
-        "key_path": "evidence.claims[].id",
+        "pointer": "/$defs/ClaimDefinition/properties/rule",
+        "key_path": "evidence.claims[].rule",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110818,13 +113930,14 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RuleConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -110872,17 +113985,39 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "type",
+              "consultation",
+              "output"
+            ],
+            [
+              "type",
+              "consultation"
+            ],
+            [
+              "type",
+              "expression"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RuleConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/inputs",
-        "key_path": "evidence.claims[].inputs",
+        "pointer": "/$defs/ClaimDefinition/properties/semantics",
+        "key_path": "evidence.claims[].semantics",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110893,16 +114028,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110950,38 +114086,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/inputs/items",
-        "key_path": "evidence.claims[].inputs[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ClaimDefinition/properties/subject_type",
+        "key_path": "evidence.claims[].subject_type",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimInputConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -111016,36 +114154,28 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "type"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimInputConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/oots",
-        "key_path": "evidence.claims[].oots",
+        "pointer": "/$defs/ClaimDefinition/properties/title",
+        "key_path": "evidence.claims[].title",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -111056,17 +114186,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111114,18 +114242,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/operations",
-        "key_path": "evidence.claims[].operations",
+        "pointer": "/$defs/ClaimDefinition/properties/value",
+        "key_path": "evidence.claims[].value",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -111138,7 +114263,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ClaimOperationsConfig",
+        "local_reference": "#/$defs/ClaimValueConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -111199,14 +114324,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimOperationsConfig"
+        "pointer": "/$defs/ClaimValueConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/purpose",
-        "key_path": "evidence.claims[].purpose",
+        "pointer": "/$defs/ClaimDefinition/properties/version",
+        "key_path": "evidence.claims[].version",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -111217,17 +114342,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111275,38 +114398,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/required_scopes",
-        "key_path": "evidence.claims[].required_scopes",
+        "pointer": "/$defs/ClaimInputConfig/properties/name",
+        "key_path": "evidence.claims[].inputs[].name",
         "path_kind": "property"
       },
-      "purpose": "Caller scopes checked before any registry consultation is dispatched.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111354,16 +114473,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/required_scopes/items",
-        "key_path": "evidence.claims[].required_scopes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ClaimInputConfig/properties/type",
+        "key_path": "evidence.claims[].inputs[].type",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -111377,11 +114496,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111436,8 +114555,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/rule",
-        "key_path": "evidence.claims[].rule",
+        "pointer": "/$defs/ClaimOperationsConfig/properties/batch_evaluate",
+        "key_path": "evidence.claims[].operations.batch_evaluate",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -111450,14 +114569,15 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RuleConfig",
+        "local_reference": "#/$defs/BatchOperationConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111503,24 +114623,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "consultation",
-              "output"
-            ],
-            [
-              "type",
-              "consultation"
-            ],
-            [
-              "type",
-              "expression"
-            ]
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -111528,14 +114630,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/RuleConfig"
+        "pointer": "/$defs/BatchOperationConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/semantics",
-        "key_path": "evidence.claims[].semantics",
+        "pointer": "/$defs/ClaimOperationsConfig/properties/evaluate",
+        "key_path": "evidence.claims[].operations.evaluate",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -111546,17 +114648,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/OperationConfig",
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111604,23 +114706,24 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/OperationConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/subject_type",
-        "key_path": "evidence.claims[].subject_type",
+        "pointer": "/$defs/ClaimRefObject/properties/id",
+        "key_path": "auth.api_keys[].authorization_details.claims[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -111692,13 +114795,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/title",
-        "key_path": "evidence.claims[].title",
+        "pointer": "/$defs/ClaimRefObject/properties/id",
+        "key_path": "auth.bearer_tokens[].authorization_details.claims[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -111714,8 +114817,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -111750,11 +114853,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -111767,32 +114873,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/value",
-        "key_path": "evidence.claims[].value",
+        "pointer": "/$defs/ClaimRefObject/properties/version",
+        "key_path": "auth.api_keys[].authorization_details.claims[].version",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimValueConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -111827,51 +114933,55 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/version",
-        "key_path": "evidence.claims[].version",
+        "pointer": "/$defs/ClaimRefObject/properties/version",
+        "key_path": "auth.bearer_tokens[].authorization_details.claims[].version",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -111906,25 +115016,31 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimInputConfig/properties/name",
-        "key_path": "evidence.claims[].inputs[].name",
+        "pointer": "/$defs/ClaimSemanticConfig/properties/concept",
+        "key_path": "evidence.claims[].semantics.concept",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -111935,15 +115051,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111991,15 +115109,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimInputConfig/properties/type",
-        "key_path": "evidence.claims[].inputs[].type",
+        "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from",
+        "key_path": "evidence.claims[].semantics.derived_from",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -112010,15 +115131,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112066,16 +115188,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimOperationsConfig/properties/batch_evaluate",
-        "key_path": "evidence.claims[].operations.batch_evaluate",
-        "path_kind": "property"
+        "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from/items",
+        "key_path": "evidence.claims[].semantics.derived_from[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -112085,17 +115207,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/BatchOperationConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112143,19 +115263,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/BatchOperationConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimOperationsConfig/properties/evaluate",
-        "key_path": "evidence.claims[].operations.evaluate",
+        "pointer": "/$defs/ClaimSemanticConfig/properties/predicate",
+        "key_path": "evidence.claims[].semantics.predicate",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -112166,17 +115282,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/OperationConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112224,41 +115340,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/OperationConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/id",
-        "key_path": "auth.api_keys[].authorization_details.claims[].id",
+        "pointer": "/$defs/ClaimSemanticConfig/properties/property",
+        "key_path": "evidence.claims[].semantics.property",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -112293,111 +115410,33 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/id",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/version",
-        "key_path": "auth.api_keys[].authorization_details.claims[].version",
+        "pointer": "/$defs/ClaimSemanticConfig/properties/value_mapping",
+        "key_path": "evidence.claims[].semantics.value_mapping",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -112412,11 +115451,11 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -112451,14 +115490,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -112474,13 +115510,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/version",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims[].version",
+        "pointer": "/$defs/ClaimSemanticConfig/properties/vocabulary",
+        "key_path": "evidence.claims[].semantics.vocabulary",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -112495,11 +115531,11 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -112534,14 +115570,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -112557,8 +115590,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/concept",
-        "key_path": "evidence.claims[].semantics.concept",
+        "pointer": "/$defs/ClaimValueConfig/properties/max_bytes",
+        "key_path": "evidence.claims[].value.max_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -112569,17 +115602,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a per-claim string byte ceiling."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112625,10 +115658,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
+            "integer",
             "null"
           ]
         }
@@ -112637,8 +115682,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from",
-        "key_path": "evidence.claims[].semantics.derived_from",
+        "pointer": "/$defs/ClaimValueConfig/properties/nullable",
+        "key_path": "evidence.claims[].value.nullable",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -112649,7 +115694,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -112658,7 +115703,7 @@
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112706,16 +115751,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from/items",
-        "key_path": "evidence.claims[].semantics.derived_from[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ClaimValueConfig/properties/type",
+        "key_path": "evidence.claims[].value.type",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -112729,11 +115774,12 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112788,8 +115834,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/predicate",
-        "key_path": "evidence.claims[].semantics.predicate",
+        "pointer": "/$defs/ClaimValueConfig/properties/unit",
+        "key_path": "evidence.claims[].value.unit",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -112809,8 +115855,8 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112868,32 +115914,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/property",
-        "key_path": "evidence.claims[].semantics.property",
+        "pointer": "/$defs/ConcurrencyConfig/properties/subjects",
+        "key_path": "evidence.concurrency.subjects",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -112928,52 +115973,58 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/value_mapping",
-        "key_path": "evidence.claims[].semantics.value_mapping",
+        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
+        "key_path": "config_trust.antirollback_state_path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_config_trust_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -113008,33 +116059,32 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/vocabulary",
-        "key_path": "evidence.claims[].semantics.vocabulary",
+        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
+        "key_path": "config_trust.break_glass_override_path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_config_trust_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -113052,8 +116102,8 @@
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -113088,12 +116138,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -113108,32 +116160,30 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/max_bytes",
-        "key_path": "evidence.claims[].value.max_bytes",
+        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
+        "key_path": "config_trust.bundle_path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_config_trust_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a per-claim string byte ceiling."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -113168,63 +116218,49 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/nullable",
-        "key_path": "evidence.claims[].value.nullable",
+        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
+        "key_path": "config_trust.trust_anchor_path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_config_trust_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -113259,48 +116295,50 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/type",
-        "key_path": "evidence.claims[].value.type",
+        "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed",
+        "key_path": "evidence.credential_profiles.*.disclosure.allowed",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -113335,49 +116373,50 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/unit",
-        "key_path": "evidence.claims[].value.unit",
-        "path_kind": "property"
+        "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed/items",
+        "key_path": "evidence.credential_profiles.*.disclosure.allowed[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -113412,51 +116451,52 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ConcurrencyConfig/properties/subjects",
-        "key_path": "evidence.concurrency.subjects",
+        "pointer": "/$defs/CredentialFingerprintRef/properties/name",
+        "key_path": "auth.api_keys[].fingerprint.name",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_auth_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -113498,51 +116538,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
-        "key_path": "config_trust.antirollback_state_path",
+        "pointer": "/$defs/CredentialFingerprintRef/properties/name",
+        "key_path": "auth.bearer_tokens[].fingerprint.name",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
+      "intent_profile": "notary_auth_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -113584,25 +116620,28 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
-        "key_path": "config_trust.break_glass_override_path",
+        "pointer": "/$defs/CredentialFingerprintRef/properties/path",
+        "key_path": "auth.api_keys[].fingerprint.path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
+      "intent_profile": "notary_auth_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -113621,7 +116660,7 @@
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -113663,7 +116702,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
@@ -113678,30 +116717,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
-        "key_path": "config_trust.bundle_path",
+        "pointer": "/$defs/CredentialFingerprintRef/properties/path",
+        "key_path": "auth.bearer_tokens[].fingerprint.path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
+      "intent_profile": "notary_auth_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -113743,25 +116784,28 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
-        "key_path": "config_trust.trust_anchor_path",
+        "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
+        "key_path": "auth.api_keys[].fingerprint.provider",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -113773,7 +116817,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -113820,9 +116864,17 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "env",
+            "file"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -113832,28 +116884,27 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed",
-        "key_path": "evidence.credential_profiles.*.disclosure.allowed",
+        "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
+        "key_path": "auth.bearer_tokens[].fingerprint.provider",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -113902,18 +116953,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "env",
+            "file"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed/items",
-        "key_path": "evidence.credential_profiles.*.disclosure.allowed[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims",
+        "key_path": "evidence.credential_profiles.*.allowed_claims",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -113923,15 +116981,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -113982,39 +117041,37 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/name",
-        "key_path": "auth.api_keys[].fingerprint.name",
-        "path_kind": "property"
+        "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims/items",
+        "key_path": "evidence.credential_profiles.*.allowed_claims[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -114056,47 +117113,45 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/name",
-        "key_path": "auth.bearer_tokens[].fingerprint.name",
+        "pointer": "/$defs/CredentialProfileConfig/properties/disclosure",
+        "key_path": "evidence.credential_profiles.*.disclosure",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/CredentialDisclosureConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -114138,47 +117193,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/CredentialDisclosureConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/path",
-        "key_path": "auth.api_keys[].fingerprint.path",
+        "pointer": "/$defs/CredentialProfileConfig/properties/format",
+        "key_path": "evidence.credential_profiles.*.format",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -114220,47 +117275,45 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/path",
-        "key_path": "auth.bearer_tokens[].fingerprint.path",
+        "pointer": "/$defs/CredentialProfileConfig/properties/holder_binding",
+        "key_path": "evidence.credential_profiles.*.holder_binding",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/HolderBindingConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -114302,28 +117355,30 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/HolderBindingConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
-        "key_path": "auth.api_keys[].fingerprint.provider",
+        "pointer": "/$defs/CredentialProfileConfig/properties/issuer",
+        "key_path": "evidence.credential_profiles.*.issuer",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -114335,7 +117390,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -114386,13 +117441,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "env",
-            "file"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -114402,13 +117450,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
-        "key_path": "auth.bearer_tokens[].fingerprint.provider",
+        "pointer": "/$defs/CredentialProfileConfig/properties/signing_key",
+        "key_path": "evidence.credential_profiles.*.signing_key",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -114420,7 +117468,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -114471,13 +117519,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "env",
-            "file"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -114487,8 +117528,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims",
-        "key_path": "evidence.credential_profiles.*.allowed_claims",
+        "pointer": "/$defs/CredentialProfileConfig/properties/validity_seconds",
+        "key_path": "evidence.credential_profiles.*.validity_seconds",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -114499,7 +117540,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -114557,18 +117598,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int64"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims/items",
-        "key_path": "evidence.credential_profiles.*.allowed_claims[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/CredentialProfileConfig/properties/vct",
+        "key_path": "evidence.credential_profiles.*.vct",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -114582,11 +117627,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -114644,26 +117689,25 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/disclosure",
-        "key_path": "evidence.credential_profiles.*.disclosure",
+        "pointer": "/$defs/CredentialStatusConfig/properties/base_url",
+        "key_path": "credential_status.base_url",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary credential-status publication and retention behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_credential_status_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/CredentialDisclosureConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -114711,44 +117755,40 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialDisclosureConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/format",
-        "key_path": "evidence.credential_profiles.*.format",
+        "pointer": "/$defs/CredentialStatusConfig/properties/enabled",
+        "key_path": "credential_status.enabled",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary credential-status publication and retention behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_credential_status_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -114793,34 +117833,32 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/holder_binding",
-        "key_path": "evidence.credential_profiles.*.holder_binding",
+        "pointer": "/$defs/CredentialStatusConfig/properties/retention_seconds",
+        "key_path": "credential_status.retention_seconds",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary credential-status publication and retention behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_credential_status_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/HolderBindingConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -114873,47 +117911,52 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/issuer",
-        "key_path": "evidence.credential_profiles.*.issuer",
+        "pointer": "/$defs/DeploymentConfig/properties/evidence",
+        "key_path": "deployment.evidence",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/DeploymentEvidenceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -114948,50 +117991,52 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/DeploymentEvidenceConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/signing_key",
-        "key_path": "evidence.credential_profiles.*.signing_key",
+        "pointer": "/$defs/DeploymentConfig/properties/multi_instance",
+        "key_path": "deployment.multi_instance",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -115026,51 +118071,49 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/validity_seconds",
-        "key_path": "evidence.credential_profiles.*.validity_seconds",
+        "pointer": "/$defs/DeploymentConfig/properties/profile",
+        "key_path": "deployment.profile",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "purpose": "The set of deployment profiles an operator can declare.\n\nFrozen at introduction; new profiles may be added but existing ones never\nchange meaning. Deserialization is strict: an unknown profile string fails,\nwhich surfaces as a startup error.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -115105,54 +118148,60 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "int64"
+          "keyword": "enum",
+          "value": [
+            "local",
+            "hosted_lab",
+            "production",
+            "evidence_grade"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/vct",
-        "key_path": "evidence.credential_profiles.*.vct",
+        "pointer": "/$defs/DeploymentConfig/properties/waivers",
+        "key_path": "deployment.waivers",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -115187,51 +118236,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig/properties/base_url",
-        "key_path": "credential_status.base_url",
-        "path_kind": "property"
+        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
+        "key_path": "deployment.waivers[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
+      "purpose": "One operator-configured waiver.\n\nA waiver names exactly one finding id, a required operator reference, an\noptional summary, and a mandatory expiry date (`YYYY-MM-DD`). The shared\noperations contract validates metadata before it can reach posture or logs.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/DeploymentWaiverConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -115266,47 +118312,58 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "finding",
+            "reference",
+            "expires"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/DeploymentWaiverConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig/properties/enabled",
-        "key_path": "credential_status.enabled",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
+        "key_path": "deployment.evidence.audit_ack_cursor_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
+      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. Runtime health requires both a\nfresh timestamp and a watermark equal to the live keyed audit-chain tail.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_deployment_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -115356,38 +118413,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig/properties/retention_seconds",
-        "key_path": "credential_status.retention_seconds",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
+        "key_path": "deployment.evidence.audit_ack_max_age_secs",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
+      "purpose": "Optional freshness window, in seconds, for the off-host ack cursor.\nUnset defaults to [`DEFAULT_AUDIT_ACK_MAX_AGE`] (900s). Meaningless\nwithout `audit_ack_cursor_path`; config load rejects that combination.\n\n[`DEFAULT_AUDIT_ACK_MAX_AGE`]: registry_platform_ops::DEFAULT_AUDIT_ACK_MAX_AGE",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -115422,14 +118483,12 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -115442,28 +118501,30 @@
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/evidence",
-        "key_path": "deployment.evidence",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
+        "key_path": "deployment.evidence.audit_offhost_shipping",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Operator asserts audit log events are shipped off-host (for example to\na log aggregator or SIEM) so a local file sink does not cap retention.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/DeploymentEvidenceConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -115519,23 +118580,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/multi_instance",
-        "key_path": "deployment.multi_instance",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/signer_custody_approved",
+        "key_path": "deployment.evidence.signer_custody_approved",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Operator asserts a production review has approved signer custody for\nthis deployment. Provider kind is not proof of custody: PKCS#11 modules\ncan be backed by either hardware or software tokens.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
@@ -115606,29 +118663,27 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/profile",
-        "key_path": "deployment.profile",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
+        "key_path": "deployment.waivers[].expires",
         "path_kind": "property"
       },
-      "purpose": "The set of deployment profiles an operator can declare.\n\nFrozen at introduction; new profiles may be added but existing ones never\nchange meaning. Deserialization is strict: an unknown profile string fails,\nwhich surfaces as a startup error.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -115674,29 +118729,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "local",
-            "hosted_lab",
-            "production",
-            "evidence_grade"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers",
-        "key_path": "deployment.waivers",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
+        "key_path": "deployment.waivers[].finding",
         "path_kind": "property"
       },
       "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
@@ -115707,16 +118750,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -115764,35 +118806,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
-        "key_path": "deployment.waivers[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
+        "key_path": "deployment.waivers[].reference",
+        "path_kind": "property"
       },
-      "purpose": "One operator-configured waiver.\n\nA waiver names exactly one finding id, a required operator reference, an\noptional summary, and a mandatory expiry date (`YYYY-MM-DD`). The shared\noperations contract validates metadata before it can reach posture or logs.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverConfig",
+        "local_reference": "#/$defs/DeploymentWaiverReference",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -115839,52 +118881,56 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "finding",
-            "reference",
-            "expires"
-          ]
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig"
+        "pointer": "/$defs/DeploymentWaiverReference"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
-        "key_path": "deployment.evidence.audit_ack_cursor_path",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
+        "key_path": "deployment.waivers[].summary",
         "path_kind": "property"
       },
-      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. Runtime health requires both a\nfresh timestamp and a watermark equal to the live keyed audit-chain tail.",
+      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_sensitive",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/DeploymentWaiverSummary",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -115919,51 +118965,57 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/DeploymentWaiverSummary"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
-        "key_path": "deployment.evidence.audit_ack_max_age_secs",
+        "pointer": "/$defs/DisclosureConfig/properties/allowed",
+        "key_path": "evidence.claims[].disclosure.allowed",
         "path_kind": "property"
       },
-      "purpose": "Optional freshness window, in seconds, for the off-host ack cursor.\nUnset defaults to [`DEFAULT_AUDIT_ACK_MAX_AGE`] (900s). Meaningless\nwithout `audit_ack_cursor_path`; config load rejects that combination.\n\n[`DEFAULT_AUDIT_ACK_MAX_AGE`]: registry_platform_ops::DEFAULT_AUDIT_ACK_MAX_AGE",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -116010,44 +119062,108 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/DisclosureConfig/properties/allowed/items",
+        "key_path": "evidence.claims[].disclosure.allowed[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
-        "key_path": "deployment.evidence.audit_offhost_shipping",
+        "pointer": "/$defs/DisclosureConfig/properties/default",
+        "key_path": "evidence.claims[].disclosure.default",
         "path_kind": "property"
       },
-      "purpose": "Operator asserts audit log events are shipped off-host (for example to\na log aggregator or SIEM) so a local file sink does not cap retention.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -116098,32 +119214,32 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/signer_custody_approved",
-        "key_path": "deployment.evidence.signer_custody_approved",
+        "pointer": "/$defs/DisclosureConfig/properties/downgrade",
+        "key_path": "evidence.claims[].disclosure.downgrade",
         "path_kind": "property"
       },
-      "purpose": "Operator asserts a production review has approved signer custody for\nthis deployment. Provider kind is not proof of custody: PKCS#11 modules\ncan be backed by either hardware or software tokens.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -116174,20 +119290,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
-        "key_path": "deployment.waivers[].expires",
+        "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
+        "key_path": "auth.api_keys[].authorization_details.assisted_access_context.channel",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -116203,8 +119319,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -116239,11 +119355,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -116256,13 +119375,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
-        "key_path": "deployment.waivers[].finding",
+        "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
+        "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context.channel",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -116278,8 +119397,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -116314,11 +119433,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -116331,31 +119453,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
-        "key_path": "deployment.waivers[].reference",
+        "pointer": "/$defs/EvidenceAuditConfig/properties/hash_secret_env",
+        "key_path": "audit.hash_secret_env",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
+      "intent_profile": "notary_audit_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverReference",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -116390,62 +119513,138 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
+          "keyword": "type",
+          "value": [
+            "string",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceAuditConfig/properties/max_files",
+        "key_path": "audit.max_files",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_audit_internal",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "integer",
+          "null"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "format",
+          "value": "uint32"
         },
         {
-          "keyword": "pattern",
-          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverReference"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
-        "key_path": "deployment.waivers[].summary",
+        "pointer": "/$defs/EvidenceAuditConfig/properties/max_size_mb",
+        "key_path": "audit.max_size_mb",
         "path_kind": "property"
       },
-      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
+      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_audit_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverSummary",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -116487,56 +119686,55 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
+          "keyword": "format",
+          "value": "uint64"
         },
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverSummary"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/allowed",
-        "key_path": "evidence.claims[].disclosure.allowed",
+        "pointer": "/$defs/EvidenceAuditConfig/properties/path",
+        "key_path": "audit.path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_audit_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -116571,30 +119769,35 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/allowed/items",
-        "key_path": "evidence.claims[].disclosure.allowed[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuditConfig/properties/sink",
+        "key_path": "audit.sink",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_audit_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -116604,11 +119807,12 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -116650,8 +119854,7 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -116663,31 +119866,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/default",
-        "key_path": "evidence.claims[].disclosure.default",
+        "pointer": "/$defs/EvidenceAuditConfig/properties/syslog_socket_path",
+        "key_path": "audit.syslog_socket_path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_audit_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -116722,48 +119926,54 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/downgrade",
-        "key_path": "evidence.claims[].disclosure.downgrade",
+        "pointer": "/$defs/EvidenceAuthConfig/properties/access_token_signing",
+        "key_path": "auth.access_token_signing",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AccessTokenSigningConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -116798,25 +120008,32 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
-        "key_path": "auth.api_keys[].authorization_details.assisted_access_context.channel",
+        "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys",
+        "key_path": "auth.api_keys",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -116827,15 +120044,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -116886,16 +120104,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
-        "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context.channel",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys/items",
+        "key_path": "auth.api_keys[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -116905,15 +120123,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/EvidenceCredentialConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -116962,41 +120181,51 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "fingerprint"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceCredentialConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/hash_secret_env",
-        "key_path": "audit.hash_secret_env",
+        "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens",
+        "key_path": "auth.bearer_tokens",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_secret_reference",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -117038,47 +120267,44 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/max_files",
-        "key_path": "audit.max_files",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens/items",
+        "key_path": "auth.bearer_tokens[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "object"
         ],
+        "local_reference": "#/$defs/EvidenceCredentialConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -117113,49 +120339,53 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "id",
+            "fingerprint"
+          ]
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceCredentialConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/max_size_mb",
-        "key_path": "audit.max_size_mb",
+        "pointer": "/$defs/EvidenceAuthConfig/properties/oidc",
+        "key_path": "auth.oidc",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
@@ -117204,22 +120434,22 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "issuer",
+            "jwks_url"
+          ]
         },
         {
           "keyword": "type",
           "value": [
-            "integer",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -117227,13 +120457,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/path",
-        "key_path": "audit.path",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
+        "key_path": "auth.api_keys[].authorization_details.access_mode",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -117242,14 +120472,14 @@
           "null",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -117294,14 +120524,24 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "unknown",
+            "machine_client",
+            "subject_bound",
+            "delegated_attestation"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "string"
           ]
         }
       ]
@@ -117309,31 +120549,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/sink",
-        "key_path": "audit.sink",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
+        "key_path": "auth.bearer_tokens[].authorization_details.access_mode",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -117368,45 +120609,60 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "unknown",
+            "machine_client",
+            "subject_bound",
+            "delegated_attestation"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/syslog_socket_path",
-        "key_path": "audit.syslog_socket_path",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
+        "key_path": "auth.api_keys[].authorization_details.actions",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -117451,23 +120707,21 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/access_token_signing",
-        "key_path": "auth.access_token_signing",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
+        "key_path": "auth.bearer_tokens[].authorization_details.actions",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -117478,17 +120732,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AccessTokenSigningConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -117539,20 +120792,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys",
-        "key_path": "auth.api_keys",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
+        "key_path": "auth.api_keys[].authorization_details.actions[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -117562,16 +120811,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -117622,15 +120870,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys/items",
-        "key_path": "auth.api_keys[]",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
+        "key_path": "auth.bearer_tokens[].authorization_details.actions[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -117641,14 +120889,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/EvidenceCredentialConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
@@ -117699,28 +120946,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "fingerprint"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens",
-        "key_path": "auth.bearer_tokens",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
+        "key_path": "auth.api_keys[].authorization_details.assisted_access_context",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -117731,16 +120967,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -117789,18 +121026,27 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "channel"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens/items",
-        "key_path": "auth.bearer_tokens[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
+        "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -117810,16 +121056,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/EvidenceCredentialConfig",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -117871,49 +121118,47 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "fingerprint"
+            "channel"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/oidc",
-        "key_path": "auth.oidc",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
+        "key_path": "auth.api_keys[].authorization_details.assurance_level",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -117948,26 +121193,22 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "issuer",
-            "jwks_url"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -117975,8 +121216,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
-        "key_path": "auth.api_keys[].authorization_details.access_mode",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
+        "key_path": "auth.bearer_tokens[].authorization_details.assurance_level",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -117990,11 +121231,11 @@
           "null",
           "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -118046,29 +121287,99 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "unknown",
-            "machine_client",
-            "subject_bound",
-            "delegated_attestation"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": [
+            "string",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
+        "key_path": "auth.api_keys[].authorization_details.claims",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "security",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
-        "key_path": "auth.bearer_tokens[].authorization_details.access_mode",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
+        "key_path": "auth.bearer_tokens[].authorization_details.claims",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118079,17 +121390,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118139,29 +121449,110 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
+        "key_path": "auth.api_keys[].authorization_details.claims[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "object",
+          "string"
+        ],
+        "local_reference": "#/$defs/ClaimRef",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "security",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
           "value": [
-            "unknown",
-            "machine_client",
-            "subject_bound",
-            "delegated_attestation"
+            "id"
           ]
         },
         {
           "keyword": "type",
           "value": [
-            "null",
+            "object",
             "string"
           ]
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimRef"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
-        "key_path": "auth.api_keys[].authorization_details.actions",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
+        "key_path": "auth.bearer_tokens[].authorization_details.claims[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -118171,16 +121562,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object",
+          "string"
         ],
+        "local_reference": "#/$defs/ClaimRef",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118229,17 +121621,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "object",
+            "string"
+          ]
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimRef"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
-        "key_path": "auth.bearer_tokens[].authorization_details.actions",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
+        "key_path": "auth.api_keys[].authorization_details.consent_ref",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118250,16 +121655,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118310,16 +121716,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
-        "key_path": "auth.api_keys[].authorization_details.actions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
+        "key_path": "auth.bearer_tokens[].authorization_details.consent_ref",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -118329,15 +121738,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118388,16 +121799,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
-        "key_path": "auth.bearer_tokens[].authorization_details.actions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
+        "key_path": "auth.api_keys[].authorization_details.disclosure",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -118407,15 +121821,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118466,15 +121882,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
-        "key_path": "auth.api_keys[].authorization_details.assisted_access_context",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
+        "key_path": "auth.bearer_tokens[].authorization_details.disclosure",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118486,13 +121905,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -118544,17 +121963,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "channel"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -118562,8 +121975,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
-        "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
+        "key_path": "auth.api_keys[].authorization_details.format",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118575,13 +121988,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -118633,17 +122046,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "channel"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -118651,8 +122058,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
-        "key_path": "auth.api_keys[].authorization_details.assurance_level",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
+        "key_path": "auth.bearer_tokens[].authorization_details.format",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118734,8 +122141,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
-        "key_path": "auth.bearer_tokens[].authorization_details.assurance_level",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
+        "key_path": "auth.api_keys[].authorization_details.jurisdiction",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118817,8 +122224,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
-        "key_path": "auth.api_keys[].authorization_details.claims",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
+        "key_path": "auth.bearer_tokens[].authorization_details.jurisdiction",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118829,16 +122236,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118889,15 +122297,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
+        "key_path": "auth.api_keys[].authorization_details.legal_basis_ref",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118908,16 +122319,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118968,16 +122380,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
-        "key_path": "auth.api_keys[].authorization_details.claims[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
+        "key_path": "auth.bearer_tokens[].authorization_details.legal_basis_ref",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -118987,17 +122402,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object",
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/ClaimRef",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -119046,31 +122461,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "object",
-            "string"
+            "string",
+            "null"
           ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRef"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
+        "key_path": "auth.api_keys[].authorization_details.locations",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -119080,17 +122485,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object",
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/ClaimRef",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -119139,30 +122543,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "object",
-            "string"
-          ]
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRef"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
-        "key_path": "auth.api_keys[].authorization_details.consent_ref",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
+        "key_path": "auth.bearer_tokens[].authorization_details.locations",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119173,17 +122564,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -119234,19 +122624,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
-        "key_path": "auth.bearer_tokens[].authorization_details.consent_ref",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
+        "key_path": "auth.api_keys[].authorization_details.locations[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -119256,17 +122643,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -119317,18 +122702,93 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
-        "key_path": "auth.api_keys[].authorization_details.disclosure",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
+        "key_path": "auth.bearer_tokens[].authorization_details.locations[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "security",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
+        "key_path": "auth.api_keys[].authorization_details.purpose",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119410,8 +122870,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
-        "key_path": "auth.bearer_tokens[].authorization_details.disclosure",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
+        "key_path": "auth.bearer_tokens[].authorization_details.purpose",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119493,8 +122953,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
-        "key_path": "auth.api_keys[].authorization_details.format",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
+        "key_path": "auth.api_keys[].authorization_details.relationship",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119506,13 +122966,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -119564,11 +123024,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relationship_type",
+            "proof_claim"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -119576,8 +123043,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
-        "key_path": "auth.bearer_tokens[].authorization_details.format",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
+        "key_path": "auth.bearer_tokens[].authorization_details.relationship",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119589,13 +123056,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -119647,11 +123114,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relationship_type",
+            "proof_claim"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -119659,8 +123133,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
-        "key_path": "auth.api_keys[].authorization_details.jurisdiction",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
+        "key_path": "auth.api_keys[].authorization_details.schema_version",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119671,17 +123145,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -119732,18 +123204,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
-        "key_path": "auth.bearer_tokens[].authorization_details.jurisdiction",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
+        "key_path": "auth.bearer_tokens[].authorization_details.schema_version",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119754,17 +123223,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -119815,18 +123282,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
-        "key_path": "auth.api_keys[].authorization_details.legal_basis_ref",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
+        "key_path": "auth.api_keys[].authorization_details.subject",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119838,13 +123302,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -119896,11 +123360,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "binding_claim",
+            "id_type"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -119908,8 +123379,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
-        "key_path": "auth.bearer_tokens[].authorization_details.legal_basis_ref",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
+        "key_path": "auth.bearer_tokens[].authorization_details.subject",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119921,13 +123392,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -119979,11 +123450,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "binding_claim",
+            "id_type"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -119991,8 +123469,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
-        "key_path": "auth.api_keys[].authorization_details.locations",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
+        "key_path": "auth.api_keys[].authorization_details.target",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120003,16 +123481,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120061,17 +123540,27 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id_type",
+            "id"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
-        "key_path": "auth.bearer_tokens[].authorization_details.locations",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
+        "key_path": "auth.bearer_tokens[].authorization_details.target",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120082,16 +123571,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120140,18 +123630,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id_type",
+            "id"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
-        "key_path": "auth.api_keys[].authorization_details.locations[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
+        "key_path": "auth.api_keys[].authorization_details.type",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -120165,11 +123665,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120227,9 +123727,9 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
-        "key_path": "auth.bearer_tokens[].authorization_details.locations[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
+        "key_path": "auth.bearer_tokens[].authorization_details.type",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -120243,11 +123743,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120305,8 +123805,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
-        "key_path": "auth.api_keys[].authorization_details.purpose",
+        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
+        "key_path": "auth.api_keys[].authorization_details.relationship.proof_claim",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120317,17 +123817,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120378,18 +123876,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
-        "key_path": "auth.bearer_tokens[].authorization_details.purpose",
+        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
+        "key_path": "auth.bearer_tokens[].authorization_details.relationship.proof_claim",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120400,100 +123895,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
-        "key_path": "auth.api_keys[].authorization_details.relationship",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120542,27 +123952,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship_type",
-            "proof_claim"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
-        "key_path": "auth.bearer_tokens[].authorization_details.relationship",
+        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
+        "key_path": "auth.api_keys[].authorization_details.relationship.relationship_type",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120573,17 +123973,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120632,27 +124030,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship_type",
-            "proof_claim"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
-        "key_path": "auth.api_keys[].authorization_details.schema_version",
+        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
+        "key_path": "auth.bearer_tokens[].authorization_details.relationship.relationship_type",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120729,8 +124117,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
-        "key_path": "auth.bearer_tokens[].authorization_details.schema_version",
+        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
+        "key_path": "auth.api_keys[].authorization_details.subject.binding_claim",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120807,8 +124195,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
-        "key_path": "auth.api_keys[].authorization_details.subject",
+        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
+        "key_path": "auth.bearer_tokens[].authorization_details.subject.binding_claim",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120819,17 +124207,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120878,27 +124264,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "binding_claim",
-            "id_type"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
-        "key_path": "auth.bearer_tokens[].authorization_details.subject",
+        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
+        "key_path": "auth.api_keys[].authorization_details.subject.id_type",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120909,17 +124285,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120968,27 +124342,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "binding_claim",
-            "id_type"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
-        "key_path": "auth.api_keys[].authorization_details.target",
+        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
+        "key_path": "auth.bearer_tokens[].authorization_details.subject.id_type",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120999,17 +124363,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -121058,27 +124420,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id_type",
-            "id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
-        "key_path": "auth.bearer_tokens[].authorization_details.target",
+        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
+        "key_path": "auth.api_keys[].authorization_details.target.id",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -121089,17 +124441,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -121148,27 +124498,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id_type",
-            "id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
-        "key_path": "auth.api_keys[].authorization_details.type",
+        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
+        "key_path": "auth.bearer_tokens[].authorization_details.target.id",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -121245,8 +124585,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
-        "key_path": "auth.bearer_tokens[].authorization_details.type",
+        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
+        "key_path": "auth.api_keys[].authorization_details.target.id_type",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -121323,8 +124663,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
-        "key_path": "auth.api_keys[].authorization_details.relationship.proof_claim",
+        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
+        "key_path": "auth.bearer_tokens[].authorization_details.target.id_type",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -121401,30 +124741,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
-        "key_path": "auth.bearer_tokens[].authorization_details.relationship.proof_claim",
+        "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes",
+        "key_path": "evidence.allowed_purposes",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -121459,33 +124800,30 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
-        "key_path": "auth.api_keys[].authorization_details.relationship.relationship_type",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes/items",
+        "key_path": "evidence.allowed_purposes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -121495,14 +124833,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -121537,14 +124875,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -121557,13 +124892,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
-        "key_path": "auth.bearer_tokens[].authorization_details.relationship.relationship_type",
+        "pointer": "/$defs/EvidenceConfig/properties/api_base_url",
+        "key_path": "evidence.api_base_url",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -121573,11 +124908,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -121635,13 +124971,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
-        "key_path": "auth.api_keys[].authorization_details.subject.binding_claim",
+        "pointer": "/$defs/EvidenceConfig/properties/api_version",
+        "key_path": "evidence.api_version",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -121651,14 +124987,15 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -121693,14 +125030,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -121713,30 +125047,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
-        "key_path": "auth.bearer_tokens[].authorization_details.subject.binding_claim",
+        "pointer": "/$defs/EvidenceConfig/properties/claims",
+        "key_path": "evidence.claims",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -121771,50 +125106,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
-        "key_path": "auth.api_keys[].authorization_details.subject.id_type",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceConfig/properties/claims/items",
+        "key_path": "evidence.claims[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ClaimDefinition",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -121849,33 +125182,45 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "title",
+            "version",
+            "subject_type",
+            "evidence_mode",
+            "rule"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimDefinition"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
-        "key_path": "auth.bearer_tokens[].authorization_details.subject.id_type",
+        "pointer": "/$defs/EvidenceConfig/properties/claims_url",
+        "key_path": "evidence.claims_url",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -121885,11 +125230,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -121947,30 +125293,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
-        "key_path": "auth.api_keys[].authorization_details.target.id",
+        "pointer": "/$defs/EvidenceConfig/properties/concurrency",
+        "key_path": "evidence.concurrency",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConcurrencyConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -122005,47 +125353,49 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ConcurrencyConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
-        "key_path": "auth.bearer_tokens[].authorization_details.target.id",
+        "pointer": "/$defs/EvidenceConfig/properties/credential_profiles",
+        "key_path": "evidence.credential_profiles",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -122096,34 +125446,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
-        "key_path": "auth.api_keys[].authorization_details.target.id_type",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceConfig/properties/credential_profiles/additionalProperties",
+        "key_path": "evidence.credential_profiles.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Each reviewed key names a credential profile and each value defines its exact claims, format, and issuance contract.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_credential_profiles_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/CredentialProfileConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -122169,42 +125520,56 @@
         "knowledge_only",
         "generated_docs_never_load_country_values",
         "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "format",
+            "issuer",
+            "signing_key",
+            "vct"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/CredentialProfileConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
-        "key_path": "auth.bearer_tokens[].authorization_details.target.id_type",
+        "pointer": "/$defs/EvidenceConfig/properties/enabled",
+        "key_path": "evidence.enabled",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -122239,51 +125604,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes",
-        "key_path": "evidence.allowed_purposes",
+        "pointer": "/$defs/EvidenceConfig/properties/formats_url",
+        "key_path": "evidence.formats_url",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -122318,26 +125680,29 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes/items",
-        "key_path": "evidence.allowed_purposes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceConfig/properties/inline_batch_limit",
+        "key_path": "evidence.inline_batch_limit",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -122347,15 +125712,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -122401,40 +125767,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "maximum",
+          "value": 100
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/api_base_url",
-        "key_path": "evidence.api_base_url",
+        "pointer": "/$defs/EvidenceConfig/properties/machine_quota",
+        "key_path": "evidence.machine_quota",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/MachineQuotaConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -122469,51 +125848,52 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/MachineQuotaConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/api_version",
-        "key_path": "evidence.api_version",
+        "pointer": "/$defs/EvidenceConfig/properties/max_credential_validity_seconds",
+        "key_path": "evidence.max_credential_validity_seconds",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -122548,45 +125928,57 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/claims",
-        "key_path": "evidence.claims",
+        "pointer": "/$defs/EvidenceConfig/properties/relay",
+        "key_path": "evidence.relay",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "The one Registry Relay connection available to registry-backed claims.\nAuthentication remains a reloadable local file reference; core never\nloads the bearer token value.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -122632,18 +126024,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "base_url",
+            "workload_client_id",
+            "token_file"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/claims/items",
-        "key_path": "evidence.claims[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceConfig/properties/service_id",
+        "key_path": "evidence.service_id",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -122653,16 +126056,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimDefinition",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -122708,32 +126111,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "title",
-            "version",
-            "subject_type",
-            "evidence_mode",
-            "rule"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/claims_url",
-        "key_path": "evidence.claims_url",
+        "pointer": "/$defs/EvidenceConfig/properties/signing_keys",
+        "key_path": "evidence.signing_keys",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -122744,13 +126132,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -122804,20 +126192,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/concurrency",
-        "key_path": "evidence.concurrency",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceConfig/properties/signing_keys/additionalProperties",
+        "key_path": "evidence.signing_keys.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Each reviewed key names a signing-key binding and each value references the operator-managed signing material and lifecycle metadata.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_signing_keys_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -122825,18 +126213,17 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ConcurrencyConfig",
+        "local_reference": "#/$defs/SigningKeyConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -122871,14 +126258,26 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "provider",
+            "alg",
+            "kid",
+            "status"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
@@ -122886,19 +126285,19 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/ConcurrencyConfig"
+        "pointer": "/$defs/SigningKeyConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/credential_profiles",
-        "key_path": "evidence.credential_profiles",
+        "pointer": "/$defs/EvidenceConfig/properties/variables",
+        "key_path": "evidence.variables",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "purpose": "Closed union of request variables declared by authored services.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -122915,8 +126314,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -122951,14 +126350,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -122971,13 +126367,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/credential_profiles/additionalProperties",
-        "key_path": "evidence.credential_profiles.*",
+        "pointer": "/$defs/EvidenceConfig/properties/variables/additionalProperties",
+        "key_path": "evidence.variables.*",
         "path_kind": "map_value"
       },
-      "purpose": "Each reviewed key names a credential profile and each value defines its exact claims, format, and issuance contract.",
+      "purpose": "Each reviewed key names a Notary evidence variable and each value defines its bounded source and evaluation contract.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_credential_profiles_open_map",
+      "intent_profile": "notary_evidence_variables_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -122985,7 +126381,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/CredentialProfileConfig",
+        "local_reference": "#/$defs/RequestVariableConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -122994,8 +126390,8 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "notary",
@@ -123030,24 +126426,19 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "format",
-            "issuer",
-            "signing_key",
-            "vct"
+            "from",
+            "type"
           ]
         },
         {
@@ -123057,37 +126448,38 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig"
+        "pointer": "/$defs/RequestVariableConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/enabled",
-        "key_path": "evidence.enabled",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
+        "key_path": "auth.api_keys[].authorization_details",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -123122,45 +126514,59 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "type",
+            "schema_version"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/formats_url",
-        "key_path": "evidence.formats_url",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
+        "key_path": "auth.bearer_tokens[].authorization_details",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -123209,40 +126615,50 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "type",
+            "schema_version"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/inline_batch_limit",
-        "key_path": "evidence.inline_batch_limit",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
+        "key_path": "auth.api_keys[].fingerprint",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/CredentialFingerprintRef",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -123277,42 +126693,43 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "maximum",
-          "value": 100
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "provider"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/CredentialFingerprintRef"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/machine_quota",
-        "key_path": "evidence.machine_quota",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
+        "key_path": "auth.bearer_tokens[].fingerprint",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -123320,18 +126737,17 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/MachineQuotaConfig",
+        "local_reference": "#/$defs/CredentialFingerprintRef",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -123366,14 +126782,23 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "provider"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
@@ -123381,34 +126806,33 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/MachineQuotaConfig"
+        "pointer": "/$defs/CredentialFingerprintRef"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/max_credential_validity_seconds",
-        "key_path": "evidence.max_credential_validity_seconds",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
+        "key_path": "auth.api_keys[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -123457,49 +126881,39 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/relay",
-        "key_path": "evidence.relay",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
+        "key_path": "auth.bearer_tokens[].id",
         "path_kind": "property"
       },
-      "purpose": "The one Registry Relay connection available to registry-backed claims.\nAuthentication remains a reloadable local file reference; core never\nloads the bearer token value.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -123534,59 +126948,51 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "base_url",
-            "workload_client_id",
-            "token_file"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/service_id",
-        "key_path": "evidence.service_id",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
+        "key_path": "auth.api_keys[].scopes",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -123621,36 +127027,39 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/signing_keys",
-        "key_path": "evidence.signing_keys",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
+        "key_path": "auth.bearer_tokens[].scopes",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -123710,33 +127119,32 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/signing_keys/additionalProperties",
-        "key_path": "evidence.signing_keys.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
+        "key_path": "auth.api_keys[].scopes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Each reviewed key names a signing-key binding and each value references the operator-managed signing material and lifecycle metadata.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_signing_keys_open_map",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SigningKeyConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
@@ -123784,56 +127192,42 @@
         "knowledge_only",
         "generated_docs_never_load_country_values",
         "sensitive_operational_metadata",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "provider",
-            "alg",
-            "kid",
-            "status"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/variables",
-        "key_path": "evidence.variables",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
+        "key_path": "auth.bearer_tokens[].scopes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Closed union of request variables declared by authored services.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -123868,48 +127262,51 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/variables/additionalProperties",
-        "key_path": "evidence.variables.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allow_insecure_localhost",
+        "key_path": "auth.oidc.allow_insecure_localhost",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a Notary evidence variable and each value defines its bounded source and evaluation contract.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_variables_open_map",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/RequestVariableConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -123949,55 +127346,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "from",
-            "type"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RequestVariableConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
-        "key_path": "auth.api_keys[].authorization_details",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms",
+        "key_path": "auth.oidc.allowed_algorithms",
         "path_kind": "property"
       },
-      "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -124032,62 +127417,123 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "schema_version"
-          ]
-        },
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms/items",
+        "key_path": "auth.oidc.allowed_algorithms[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_internal",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
-        "key_path": "auth.bearer_tokens[].authorization_details",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients",
+        "key_path": "auth.oidc.allowed_clients",
         "path_kind": "property"
       },
-      "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -124122,61 +127568,47 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type",
-            "schema_version"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
-        "key_path": "auth.api_keys[].fingerprint",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients/items",
+        "key_path": "auth.oidc.allowed_clients[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/CredentialFingerprintRef",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -124211,38 +127643,25 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "provider"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
-        "key_path": "auth.bearer_tokens[].fingerprint",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types",
+        "key_path": "auth.oidc.allowed_token_types",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -124253,16 +127672,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/CredentialFingerprintRef",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -124311,28 +127730,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "provider"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
-        "key_path": "auth.api_keys[].id",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types/items",
+        "key_path": "auth.oidc.allowed_token_types[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -124346,11 +127755,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -124408,8 +127817,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
-        "key_path": "auth.bearer_tokens[].id",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences",
+        "key_path": "auth.oidc.audiences",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -124420,15 +127829,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -124479,16 +127889,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
-        "key_path": "auth.api_keys[].scopes",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences/items",
+        "key_path": "auth.oidc.audiences[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -124498,16 +127908,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -124558,15 +127967,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
-        "key_path": "auth.bearer_tokens[].scopes",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/issuer",
+        "key_path": "auth.oidc.issuer",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -124577,16 +127986,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -124637,16 +128045,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
-        "key_path": "auth.api_keys[].scopes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/jwks_url",
+        "key_path": "auth.oidc.jwks_url",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -124660,11 +128068,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -124722,13 +128130,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
-        "key_path": "auth.bearer_tokens[].scopes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/leeway",
+        "key_path": "auth.oidc.leeway",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -124736,16 +128144,18 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -124780,14 +128190,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -124795,13 +128202,17 @@
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allow_insecure_localhost",
-        "key_path": "auth.oidc.allow_insecure_localhost",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/principal_claim",
+        "key_path": "auth.oidc.principal_claim",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -124812,13 +128223,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -124869,15 +128280,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms",
-        "key_path": "auth.oidc.allowed_algorithms",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_claim",
+        "key_path": "auth.oidc.scope_claim",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -124888,13 +128299,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -124945,16 +128356,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms/items",
-        "key_path": "auth.oidc.allowed_algorithms[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map",
+        "key_path": "auth.oidc.scope_map",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -124964,15 +128375,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -125020,20 +128432,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients",
-        "key_path": "auth.oidc.allowed_clients",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties",
+        "key_path": "auth.oidc.scope_map.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Each reviewed key is an external token scope and each value is the bounded Notary scope mapping granted for that exact token scope.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_auth_oidc_scope_map_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -125043,15 +128455,14 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "notary",
@@ -125091,7 +128502,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -125103,8 +128514,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients/items",
-        "key_path": "auth.oidc.allowed_clients[]",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties/items",
+        "key_path": "auth.oidc.scope_map.*[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -125178,31 +128589,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types",
-        "key_path": "auth.oidc.allowed_token_types",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_separator",
+        "key_path": "auth.oidc.scope_separator",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -125237,29 +128648,26 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types/items",
-        "key_path": "auth.oidc.allowed_token_types[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_endpoint",
+        "key_path": "auth.oidc.userinfo_endpoint",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -125269,15 +128677,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -125328,15 +128738,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences",
-        "key_path": "auth.oidc.audiences",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers",
+        "key_path": "auth.oidc.userinfo_issuers",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -125414,8 +128827,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences/items",
-        "key_path": "auth.oidc.audiences[]",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers/items",
+        "key_path": "auth.oidc.userinfo_issuers[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -125492,108 +128905,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/issuer",
-        "key_path": "auth.oidc.issuer",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/jwks_url",
-        "key_path": "auth.oidc.jwks_url",
+        "pointer": "/$defs/FederationConfig/properties/clock_leeway_seconds",
+        "key_path": "federation.clock_leeway_seconds",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -125628,46 +128964,51 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/leeway",
-        "key_path": "auth.oidc.leeway",
+        "pointer": "/$defs/FederationConfig/properties/emergency_denylist",
+        "key_path": "federation.emergency_denylist",
         "path_kind": "property"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_internal",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
+        "local_reference": "#/$defs/FederationEmergencyDenylistConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -125718,36 +129059,36 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
+        "pointer": "/$defs/FederationEmergencyDenylistConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/principal_claim",
-        "key_path": "auth.oidc.principal_claim",
+        "pointer": "/$defs/FederationConfig/properties/enabled",
+        "key_path": "federation.enabled",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -125798,32 +129139,32 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_claim",
-        "key_path": "auth.oidc.scope_claim",
+        "pointer": "/$defs/FederationConfig/properties/evaluation_profiles",
+        "key_path": "federation.evaluation_profiles",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -125874,20 +129215,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map",
-        "key_path": "auth.oidc.scope_map",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationConfig/properties/evaluation_profiles/items",
+        "key_path": "federation.evaluation_profiles[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -125895,14 +129236,14 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/FederationEvaluationProfileConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -125948,97 +129289,35 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "ruleset",
+            "claim_id",
+            "subject_id_type"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties",
-        "key_path": "auth.oidc.scope_map.*",
-        "path_kind": "map_value"
-      },
-      "purpose": "Each reviewed key is an external token scope and each value is the bounded Notary scope mapping granted for that exact token scope.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_oidc_scope_map_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
       ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/FederationEvaluationProfileConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties/items",
-        "key_path": "auth.oidc.scope_map.*[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationConfig/properties/federation_api",
+        "key_path": "federation.federation_api",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -126048,11 +129327,12 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -126107,25 +129387,25 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_separator",
-        "key_path": "auth.oidc.scope_separator",
+        "pointer": "/$defs/FederationConfig/properties/inbound_body_limit_bytes",
+        "key_path": "federation.inbound_body_limit_bytes",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -126174,34 +129454,41 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_endpoint",
-        "key_path": "auth.oidc.userinfo_endpoint",
+        "pointer": "/$defs/FederationConfig/properties/issuer",
+        "key_path": "federation.issuer",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_federation_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
@@ -126250,47 +129537,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers",
-        "key_path": "auth.oidc.userinfo_issuers",
+        "pointer": "/$defs/FederationConfig/properties/jwks_uri",
+        "key_path": "federation.jwks_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -126325,50 +129608,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers/items",
-        "key_path": "auth.oidc.userinfo_issuers[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationConfig/properties/max_request_lifetime_seconds",
+        "key_path": "federation.max_request_lifetime_seconds",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -126403,28 +129684,33 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/clock_leeway_seconds",
-        "key_path": "federation.clock_leeway_seconds",
+        "pointer": "/$defs/FederationConfig/properties/node_id",
+        "key_path": "federation.node_id",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -126435,13 +129721,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -126490,30 +129776,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/emergency_denylist",
-        "key_path": "federation.emergency_denylist",
+        "pointer": "/$defs/FederationConfig/properties/pairwise_subject_hash",
+        "key_path": "federation.pairwise_subject_hash",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_federation_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -126521,7 +129799,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/FederationEmergencyDenylistConfig",
+        "local_reference": "#/$defs/FederationPairwiseSubjectHashConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -126531,8 +129809,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -126567,12 +129845,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -126582,14 +129862,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig"
+        "pointer": "/$defs/FederationPairwiseSubjectHashConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/enabled",
-        "key_path": "federation.enabled",
+        "pointer": "/$defs/FederationConfig/properties/peers",
+        "key_path": "federation.peers",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -126600,7 +129880,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
@@ -126657,16 +129937,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/evaluation_profiles",
-        "key_path": "federation.evaluation_profiles",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationConfig/properties/peers/items",
+        "key_path": "federation.peers[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -126676,16 +129956,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/FederationPeerConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -126731,18 +130011,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "node_id",
+            "issuer",
+            "jwks_uri"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/FederationPeerConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/evaluation_profiles/items",
-        "key_path": "federation.evaluation_profiles[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationConfig/properties/response_shaping",
+        "key_path": "federation.response_shaping",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -126754,14 +130046,15 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/FederationEvaluationProfileConfig",
+        "local_reference": "#/$defs/FederationResponseShapingConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -126807,15 +130100,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "ruleset",
-            "claim_id",
-            "subject_id_type"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -126823,14 +130107,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig"
+        "pointer": "/$defs/FederationResponseShapingConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/federation_api",
-        "key_path": "federation.federation_api",
+        "pointer": "/$defs/FederationConfig/properties/signing",
+        "key_path": "federation.signing",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -126841,13 +130125,14 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/FederationSigningConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -126896,17 +130181,27 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "signing_key"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/FederationSigningConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/inbound_body_limit_bytes",
-        "key_path": "federation.inbound_body_limit_bytes",
+        "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions",
+        "key_path": "federation.supported_protocol_versions",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -126917,7 +130212,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -126972,30 +130267,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/issuer",
-        "key_path": "federation.issuer",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions/items",
+        "key_path": "federation.supported_protocol_versions[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -127005,15 +130292,14 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -127048,14 +130334,12 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -127067,8 +130351,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/jwks_uri",
-        "key_path": "federation.jwks_uri",
+        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids",
+        "key_path": "federation.emergency_denylist.kids",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127079,13 +130363,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -127136,16 +130420,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/max_request_lifetime_seconds",
-        "key_path": "federation.max_request_lifetime_seconds",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids/items",
+        "key_path": "federation.emergency_denylist.kids[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -127155,16 +130439,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127210,25 +130493,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/node_id",
-        "key_path": "federation.node_id",
+        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids",
+        "key_path": "federation.emergency_denylist.node_ids",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127239,13 +130514,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -127296,39 +130571,37 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/pairwise_subject_hash",
-        "key_path": "federation.pairwise_subject_hash",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids/items",
+        "key_path": "federation.emergency_denylist.node_ids[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/FederationPairwiseSubjectHashConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -127363,31 +130636,25 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPairwiseSubjectHashConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/peers",
-        "key_path": "federation.peers",
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/assurance_level",
+        "key_path": "federation.evaluation_profiles[].assurance_level",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127398,16 +130665,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127455,16 +130723,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/peers/items",
-        "key_path": "federation.peers[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/claim_id",
+        "key_path": "federation.evaluation_profiles[].claim_id",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -127474,16 +130745,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/FederationPeerConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127529,29 +130799,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "node_id",
-            "issuer",
-            "jwks_uri"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/response_shaping",
-        "key_path": "federation.response_shaping",
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/consent_ref",
+        "key_path": "federation.evaluation_profiles[].consent_ref",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127562,17 +130820,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/FederationResponseShapingConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127620,19 +130878,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationResponseShapingConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/signing",
-        "key_path": "federation.signing",
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/disclosure",
+        "key_path": "federation.evaluation_profiles[].disclosure",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127643,17 +130900,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/FederationSigningConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127700,26 +130957,19 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "signing_key"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationSigningConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions",
-        "key_path": "federation.supported_protocol_versions",
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/id",
+        "key_path": "federation.evaluation_profiles[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127730,16 +130980,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127787,16 +131036,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions/items",
-        "key_path": "federation.supported_protocol_versions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/jurisdiction",
+        "key_path": "federation.evaluation_profiles[].jurisdiction",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -127806,15 +131055,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127862,15 +131113,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids",
-        "key_path": "federation.emergency_denylist.kids",
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/legal_basis_ref",
+        "key_path": "federation.evaluation_profiles[].legal_basis_ref",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127881,16 +131135,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127938,16 +131193,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids/items",
-        "key_path": "federation.emergency_denylist.kids[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/max_claim_result_age_seconds",
+        "key_path": "federation.evaluation_profiles[].max_claim_result_age_seconds",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -127957,15 +131215,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128011,17 +131271,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids",
-        "key_path": "federation.emergency_denylist.node_ids",
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/ruleset",
+        "key_path": "federation.evaluation_profiles[].ruleset",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -128032,16 +131303,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128089,20 +131359,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids/items",
-        "key_path": "federation.emergency_denylist.node_ids[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/subject_id_type",
+        "key_path": "federation.evaluation_profiles[].subject_id_type",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_federation_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -128112,14 +131382,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -128154,12 +131424,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -128171,32 +131443,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/assurance_level",
-        "key_path": "federation.evaluation_profiles[].assurance_level",
+        "pointer": "/$defs/FederationPairwiseSubjectHashConfig/properties/secret_env",
+        "key_path": "federation.pairwise_subject_hash.secret_env",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_federation_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -128231,28 +131502,27 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/claim_id",
-        "key_path": "federation.evaluation_profiles[].claim_id",
+        "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_localhost",
+        "key_path": "federation.peers[].allow_insecure_localhost",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -128263,15 +131533,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128319,15 +131590,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/consent_ref",
-        "key_path": "federation.evaluation_profiles[].consent_ref",
+        "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_private_network",
+        "key_path": "federation.peers[].allow_insecure_private_network",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -128338,17 +131609,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128396,18 +131666,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/disclosure",
-        "key_path": "federation.evaluation_profiles[].disclosure",
+        "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles",
+        "key_path": "federation.peers[].allowed_profiles",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -128418,17 +131685,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128476,19 +131742,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/id",
-        "key_path": "federation.evaluation_profiles[].id",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles/items",
+        "key_path": "federation.peers[].allowed_profiles[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -128502,11 +131765,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128561,8 +131824,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/jurisdiction",
-        "key_path": "federation.evaluation_profiles[].jurisdiction",
+        "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions",
+        "key_path": "federation.peers[].allowed_protocol_versions",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -128573,17 +131836,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128631,19 +131893,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/legal_basis_ref",
-        "key_path": "federation.evaluation_profiles[].legal_basis_ref",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions/items",
+        "key_path": "federation.peers[].allowed_protocol_versions[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -128653,17 +131912,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128711,18 +131968,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/max_claim_result_age_seconds",
-        "key_path": "federation.evaluation_profiles[].max_claim_result_age_seconds",
+        "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes",
+        "key_path": "federation.peers[].allowed_purposes",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -128733,17 +131987,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128789,29 +132042,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/ruleset",
-        "key_path": "federation.evaluation_profiles[].ruleset",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes/items",
+        "key_path": "federation.peers[].allowed_purposes[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -128825,11 +132067,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128884,108 +132126,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/subject_id_type",
-        "key_path": "federation.evaluation_profiles[].subject_id_type",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPairwiseSubjectHashConfig/properties/secret_env",
-        "key_path": "federation.pairwise_subject_hash.secret_env",
+        "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes",
+        "key_path": "federation.peers[].evaluation_scopes",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_secret_reference",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -129020,28 +132185,26 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_localhost",
-        "key_path": "federation.peers[].allow_insecure_localhost",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes/items",
+        "key_path": "federation.peers[].evaluation_scopes[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -129051,16 +132214,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -129108,38 +132270,37 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_private_network",
-        "key_path": "federation.peers[].allow_insecure_private_network",
+        "pointer": "/$defs/FederationPeerConfig/properties/issuer",
+        "key_path": "federation.peers[].issuer",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_federation_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -129174,25 +132335,27 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles",
-        "key_path": "federation.peers[].allowed_profiles",
+        "pointer": "/$defs/FederationPeerConfig/properties/jwks_uri",
+        "key_path": "federation.peers[].jwks_uri",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -129203,16 +132366,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -129260,16 +132422,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles/items",
-        "key_path": "federation.peers[].allowed_profiles[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationPeerConfig/properties/node_id",
+        "key_path": "federation.peers[].node_id",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -129283,11 +132445,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -129342,8 +132504,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions",
-        "key_path": "federation.peers[].allowed_protocol_versions",
+        "pointer": "/$defs/FederationResponseShapingConfig/properties/minimum_denial_latency_ms",
+        "key_path": "federation.response_shaping.minimum_denial_latency_ms",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -129354,7 +132516,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -129409,22 +132571,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions/items",
-        "key_path": "federation.peers[].allowed_protocol_versions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationSigningConfig/properties/signing_key",
+        "key_path": "federation.signing.signing_key",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_federation_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -129434,14 +132604,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -129476,12 +132646,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -129493,13 +132665,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes",
-        "key_path": "federation.peers[].allowed_purposes",
+        "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods",
+        "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -129516,8 +132688,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -129552,11 +132724,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -129569,13 +132744,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes/items",
-        "key_path": "federation.peers[].allowed_purposes[]",
+        "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods/items",
+        "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -129591,8 +132766,8 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -129627,11 +132802,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -129644,31 +132822,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes",
-        "key_path": "federation.peers[].evaluation_scopes",
+        "pointer": "/$defs/HolderBindingConfig/properties/mode",
+        "key_path": "evidence.credential_profiles.*.holder_binding.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -129703,44 +132881,131 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes/items",
-        "key_path": "federation.peers[].evaluation_scopes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/HolderBindingConfig/properties/proof_of_possession",
+        "key_path": "evidence.credential_profiles.*.holder_binding.proof_of_possession",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "security",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": [
+            "string",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/MachineQuotaConfig/properties/enabled",
+        "key_path": "evidence.machine_quota.enabled",
+        "path_kind": "property"
+      },
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "boolean"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -129788,34 +133053,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/issuer",
-        "key_path": "federation.peers[].issuer",
+        "pointer": "/$defs/MachineQuotaConfig/properties/subjects_per_minute",
+        "key_path": "evidence.machine_quota.subjects_per_minute",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -129860,25 +133126,34 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/jwks_uri",
-        "key_path": "federation.peers[].jwks_uri",
+        "pointer": "/$defs/NotaryInstanceConfig/properties/environment",
+        "key_path": "instance.environment",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_instance_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -129888,11 +133163,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -129934,8 +133210,7 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -129947,13 +133222,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/node_id",
-        "key_path": "federation.peers[].node_id",
+        "pointer": "/$defs/NotaryInstanceConfig/properties/id",
+        "key_path": "instance.id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_instance_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -129963,11 +133238,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -130009,8 +133285,7 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -130022,28 +133297,29 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationResponseShapingConfig/properties/minimum_denial_latency_ms",
-        "key_path": "federation.response_shaping.minimum_denial_latency_ms",
+        "pointer": "/$defs/NotaryInstanceConfig/properties/jurisdiction",
+        "key_path": "instance.jurisdiction",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_instance_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -130085,51 +133361,47 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationSigningConfig/properties/signing_key",
-        "key_path": "federation.signing.signing_key",
+        "pointer": "/$defs/NotaryInstanceConfig/properties/owner",
+        "key_path": "instance.owner",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
+      "intent_profile": "notary_instance_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -130164,47 +133436,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods",
-        "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods",
+        "pointer": "/$defs/NotaryInstanceConfig/properties/public_base_url",
+        "key_path": "instance.public_base_url",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_instance_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -130249,26 +133522,28 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods/items",
-        "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/Oid4vciAuthorizationConfig/properties/require_pkce_method",
+        "key_path": "oid4vci.authorization.require_pkce_method",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -130278,14 +133553,15 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -130320,14 +133596,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -130340,25 +133613,25 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/mode",
-        "key_path": "evidence.credential_profiles.*.holder_binding.mode",
+        "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences",
+        "key_path": "oid4vci.accepted_token_audiences",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -130412,36 +133685,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/proof_of_possession",
-        "key_path": "evidence.credential_profiles.*.holder_binding.proof_of_possession",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences/items",
+        "key_path": "oid4vci.accepted_token_audiences[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -130492,30 +133763,28 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/MachineQuotaConfig/properties/enabled",
-        "key_path": "evidence.machine_quota.enabled",
+        "pointer": "/$defs/Oid4vciConfig/properties/authorization",
+        "key_path": "oid4vci.authorization",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
+        "local_reference": "#/$defs/Oid4vciAuthorizationConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -130571,26 +133840,30 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciAuthorizationConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/MachineQuotaConfig/properties/subjects_per_minute",
-        "key_path": "evidence.machine_quota.subjects_per_minute",
+        "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers",
+        "key_path": "oid4vci.authorization_servers",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -130601,8 +133874,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -130637,41 +133910,30 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/environment",
-        "key_path": "instance.environment",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers/items",
+        "key_path": "oid4vci.authorization_servers[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -130681,12 +133943,11 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -130728,7 +133989,8 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -130740,31 +134002,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/id",
-        "key_path": "instance.id",
+        "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations",
+        "key_path": "oid4vci.credential_configurations",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -130799,48 +134061,51 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/jurisdiction",
-        "key_path": "instance.jurisdiction",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations/additionalProperties",
+        "key_path": "oid4vci.credential_configurations.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Each reviewed key names an OpenID4VCI credential configuration and each value defines the advertised and issued credential contract.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
+      "intent_profile": "notary_oid4vci_credential_configurations_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/Oid4vciCredentialConfigurationConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -130875,51 +134140,65 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "credential_profile",
+            "format",
+            "scope",
+            "vct",
+            "display_name"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/owner",
-        "key_path": "instance.owner",
+        "pointer": "/$defs/Oid4vciConfig/properties/credential_endpoint",
+        "key_path": "oid4vci.credential_endpoint",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -130954,48 +134233,48 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/public_base_url",
-        "key_path": "instance.public_base_url",
+        "pointer": "/$defs/Oid4vciConfig/properties/credential_issuer",
+        "key_path": "oid4vci.credential_issuer",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_sensitive",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -131040,23 +134319,21 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciAuthorizationConfig/properties/require_pkce_method",
-        "key_path": "oid4vci.authorization.require_pkce_method",
+        "pointer": "/$defs/Oid4vciConfig/properties/display",
+        "key_path": "oid4vci.display",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -131067,13 +134344,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -131124,38 +134401,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences",
-        "key_path": "oid4vci.accepted_token_audiences",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciConfig/properties/display/items",
+        "key_path": "oid4vci.display[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/Oid4vciIssuerDisplayConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -131190,50 +134467,58 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciIssuerDisplayConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences/items",
-        "key_path": "oid4vci.accepted_token_audiences[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/Oid4vciConfig/properties/enabled",
+        "key_path": "oid4vci.enabled",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -131268,28 +134553,25 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/authorization",
-        "key_path": "oid4vci.authorization",
+        "pointer": "/$defs/Oid4vciConfig/properties/nonce",
+        "key_path": "oid4vci.nonce",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -131302,7 +134584,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciAuthorizationConfig",
+        "local_reference": "#/$defs/Oid4vciNonceConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -131363,37 +134645,38 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciAuthorizationConfig"
+        "pointer": "/$defs/Oid4vciNonceConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers",
-        "key_path": "oid4vci.authorization_servers",
+        "pointer": "/$defs/Oid4vciConfig/properties/nonce_endpoint",
+        "key_path": "oid4vci.nonce_endpoint",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -131428,30 +134711,36 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers/items",
-        "key_path": "oid4vci.authorization_servers[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/Oid4vciConfig/properties/offer_endpoint",
+        "key_path": "oid4vci.offer_endpoint",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -131461,14 +134750,15 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -131503,11 +134793,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -131520,13 +134813,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations",
-        "key_path": "oid4vci.credential_configurations",
+        "pointer": "/$defs/Oid4vciConfig/properties/pre_authorized_code",
+        "key_path": "oid4vci.pre_authorized_code",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -131534,6 +134827,7 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/Oid4vciPreAuthorizedCodeConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -131543,8 +134837,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -131579,14 +134873,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -131594,18 +134885,22 @@
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations/additionalProperties",
-        "key_path": "oid4vci.credential_configurations.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/Oid4vciConfig/properties/proof",
+        "key_path": "oid4vci.proof",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names an OpenID4VCI credential configuration and each value defines the advertised and issued credential contract.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_credential_configurations_open_map",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -131613,17 +134908,18 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciCredentialConfigurationConfig",
+        "local_reference": "#/$defs/Oid4vciProofConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -131658,27 +134954,14 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "credential_profile",
-            "format",
-            "scope",
-            "vct",
-            "display_name"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -131686,14 +134969,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig"
+        "pointer": "/$defs/Oid4vciProofConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_endpoint",
-        "key_path": "oid4vci.credential_endpoint",
+        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/display_name",
+        "key_path": "oid4vci.credential_configurations.*.claims[].display_name",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -131708,12 +134991,11 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -131771,8 +135053,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_issuer",
-        "key_path": "oid4vci.credential_issuer",
+        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/id",
+        "key_path": "oid4vci.credential_configurations.*.claims[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -131787,12 +135069,11 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -131850,13 +135131,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/display",
-        "key_path": "oid4vci.display",
+        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path",
+        "key_path": "oid4vci.credential_configurations.*.claims[].output_path",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -131866,15 +135147,14 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -131909,11 +135189,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -131926,117 +135209,30 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/display/items",
-        "key_path": "oid4vci.display[]",
+        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path/items",
+        "key_path": "oid4vci.credential_configurations.*.claims[].output_path[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciIssuerDisplayConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/enabled",
-        "key_path": "oid4vci.enabled",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -132071,49 +135267,50 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/nonce",
-        "key_path": "oid4vci.nonce",
+        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/sd",
+        "key_path": "oid4vci.credential_configurations.*.claims[].sd",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciNonceConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -132148,29 +135345,28 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciNonceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/nonce_endpoint",
-        "key_path": "oid4vci.nonce_endpoint",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claim_id",
+        "key_path": "oid4vci.credential_configurations.*.claim_id",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132190,8 +135386,8 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -132252,8 +135448,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/offer_endpoint",
-        "key_path": "oid4vci.offer_endpoint",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims",
+        "key_path": "oid4vci.credential_configurations.*.claims",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132264,16 +135460,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -132324,20 +135520,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/pre_authorized_code",
-        "key_path": "oid4vci.pre_authorized_code",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims/items",
+        "key_path": "oid4vci.credential_configurations.*.claims[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -132345,18 +135541,17 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciPreAuthorizedCodeConfig",
+        "local_reference": "#/$defs/Oid4vciCredentialClaimConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -132391,95 +135586,26 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/proof",
-        "key_path": "oid4vci.proof",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/Oid4vciProofConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
+          "keyword": "required",
+          "value": [
+            "id",
+            "output_path",
+            "display_name",
+            "sd"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
@@ -132487,14 +135613,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciProofConfig"
+        "pointer": "/$defs/Oid4vciCredentialClaimConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/display_name",
-        "key_path": "oid4vci.credential_configurations.*.claims[].display_name",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/credential_profile",
+        "key_path": "oid4vci.credential_configurations.*.credential_profile",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132571,8 +135697,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/id",
-        "key_path": "oid4vci.credential_configurations.*.claims[].id",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported",
+        "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132583,15 +135709,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -132642,16 +135769,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path",
-        "key_path": "oid4vci.credential_configurations.*.claims[].output_path",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported/items",
+        "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
@@ -132661,15 +135788,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -132720,16 +135847,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path/items",
-        "key_path": "oid4vci.credential_configurations.*.claims[].output_path[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display",
+        "key_path": "oid4vci.credential_configurations.*.display",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
@@ -132739,15 +135866,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/Oid4vciCredentialDisplayConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -132798,15 +135927,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/sd",
-        "key_path": "oid4vci.credential_configurations.*.claims[].sd",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display_name",
+        "key_path": "oid4vci.credential_configurations.*.display_name",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132883,8 +136016,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claim_id",
-        "key_path": "oid4vci.credential_configurations.*.claim_id",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/format",
+        "key_path": "oid4vci.credential_configurations.*.format",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132895,17 +136028,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -132956,18 +136087,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims",
-        "key_path": "oid4vci.credential_configurations.*.claims",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported",
+        "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132986,8 +136114,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133045,8 +136173,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims/items",
-        "key_path": "oid4vci.credential_configurations.*.claims[]",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported/items",
+        "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133057,14 +136185,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciCredentialClaimConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
@@ -133115,30 +136242,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "output_path",
-            "display_name",
-            "sd"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/credential_profile",
-        "key_path": "oid4vci.credential_configurations.*.credential_profile",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/scope",
+        "key_path": "oid4vci.credential_configurations.*.scope",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133215,8 +136329,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported",
-        "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/vct",
+        "key_path": "oid4vci.credential_configurations.*.vct",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133227,16 +136341,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133287,16 +136400,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported/items",
-        "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_color",
+        "key_path": "oid4vci.credential_configurations.*.display.background_color",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
@@ -133306,15 +136419,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133365,15 +136480,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display",
-        "key_path": "oid4vci.credential_configurations.*.display",
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_image",
+        "key_path": "oid4vci.credential_configurations.*.display.background_image",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133384,17 +136502,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciCredentialDisplayConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133445,19 +136563,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display_name",
-        "key_path": "oid4vci.credential_configurations.*.display_name",
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/description",
+        "key_path": "oid4vci.credential_configurations.*.display.description",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133468,15 +136585,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133527,15 +136646,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/format",
-        "key_path": "oid4vci.credential_configurations.*.format",
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/locale",
+        "key_path": "oid4vci.credential_configurations.*.display.locale",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133546,15 +136668,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133605,15 +136729,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported",
-        "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported",
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/logo",
+        "key_path": "oid4vci.credential_configurations.*.display.logo",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133624,16 +136751,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133684,16 +136812,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported/items",
-        "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/secondary_image",
+        "key_path": "oid4vci.credential_configurations.*.display.secondary_image",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
@@ -133703,15 +136834,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133762,15 +136895,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/scope",
-        "key_path": "oid4vci.credential_configurations.*.scope",
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/text_color",
+        "key_path": "oid4vci.credential_configurations.*.display.text_color",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133781,15 +136917,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133840,15 +136978,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/vct",
-        "key_path": "oid4vci.credential_configurations.*.vct",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
+        "key_path": "oid4vci.credential_configurations.*.display.background_image.alt_text",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133859,15 +137000,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133918,15 +137061,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_color",
-        "key_path": "oid4vci.credential_configurations.*.display.background_color",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
+        "key_path": "oid4vci.credential_configurations.*.display.logo.alt_text",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134008,8 +137154,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_image",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
+        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.alt_text",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134021,13 +137167,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -134082,8 +137228,8 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -134091,8 +137237,88 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/description",
-        "key_path": "oid4vci.credential_configurations.*.display.description",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
+        "key_path": "oid4vci.display[].logo.alt_text",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_oid4vci_internal",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": [
+            "string",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
+        "key_path": "oid4vci.credential_configurations.*.display.background_image.uri",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134174,8 +137400,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/locale",
-        "key_path": "oid4vci.credential_configurations.*.display.locale",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
+        "key_path": "oid4vci.credential_configurations.*.display.logo.uri",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134257,8 +137483,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/logo",
-        "key_path": "oid4vci.credential_configurations.*.display.logo",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
+        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.uri",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134270,13 +137496,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -134331,8 +137557,8 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -134340,32 +137566,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/secondary_image",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
+        "key_path": "oid4vci.display[].logo.uri",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -134400,22 +137626,19 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -134423,8 +137646,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/text_color",
-        "key_path": "oid4vci.credential_configurations.*.display.text_color",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
+        "key_path": "oid4vci.credential_configurations.*.display.background_image.url",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134506,8 +137729,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image.alt_text",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
+        "key_path": "oid4vci.credential_configurations.*.display.logo.url",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134589,8 +137812,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.credential_configurations.*.display.logo.alt_text",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
+        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.url",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134672,8 +137895,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.alt_text",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
+        "key_path": "oid4vci.display[].logo.url",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134755,29 +137978,28 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.display[].logo.alt_text",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/allow_insecure_localhost",
+        "key_path": "oid4vci.pre_authorized_code.esignet.allow_insecure_localhost",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Allow `http` loopback URLs for the eSignet endpoints and JWKS transport.\nFor local development and tests only.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -134825,39 +138047,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image.uri",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/authorize_url",
+        "key_path": "oid4vci.pre_authorized_code.esignet.authorize_url",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "eSignet authorize endpoint.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -134908,39 +138126,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.credential_configurations.*.display.logo.uri",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_id",
+        "key_path": "oid4vci.pre_authorized_code.esignet.client_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Confidential client id the Notary presents to eSignet.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -134991,39 +138205,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.uri",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_signing_key_id",
+        "key_path": "oid4vci.pre_authorized_code.esignet.client_signing_key_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "`evidence.signing_keys` entry used to sign the eSignet\n`private_key_jwt` client assertion.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -135074,42 +138284,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.display[].logo.uri",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/issuer",
+        "key_path": "oid4vci.pre_authorized_code.esignet.issuer",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "purpose": "eSignet OIDC issuer, pinned when validating the returned `id_token`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -135144,52 +138350,51 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image.url",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/jwks_uri",
+        "key_path": "oid4vci.pre_authorized_code.esignet.jwks_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "purpose": "eSignet JWKS URI, used to resolve the `id_token` signing key by `kid`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -135224,55 +138429,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.credential_configurations.*.display.logo.url",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/login_state_ttl_seconds",
+        "key_path": "oid4vci.pre_authorized_code.esignet.login_state_ttl_seconds",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "purpose": "Lifetime of the short-lived login state (PKCE verifier + nonce +\nselection) reserved between `offer/start` and `offer/callback`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -135307,55 +138505,56 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.url",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/redirect_uri",
+        "key_path": "oid4vci.pre_authorized_code.esignet.redirect_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "purpose": "Notary callback the citizen browser is redirected back to.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -135390,55 +138589,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.display[].logo.url",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes",
+        "key_path": "oid4vci.pre_authorized_code.esignet.scopes",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "purpose": "OAuth scopes requested at eSignet.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -135473,51 +138665,44 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/allow_insecure_localhost",
-        "key_path": "oid4vci.pre_authorized_code.esignet.allow_insecure_localhost",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes/items",
+        "key_path": "oid4vci.pre_authorized_code.esignet.scopes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Allow `http` loopback URLs for the eSignet endpoints and JWKS transport.\nFor local development and tests only.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -135565,19 +138750,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/authorize_url",
-        "key_path": "oid4vci.pre_authorized_code.esignet.authorize_url",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/token_url",
+        "key_path": "oid4vci.pre_authorized_code.esignet.token_url",
         "path_kind": "property"
       },
-      "purpose": "eSignet authorize endpoint.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
@@ -135651,11 +138836,11 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_id",
-        "key_path": "oid4vci.pre_authorized_code.esignet.client_id",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/userinfo_url",
+        "key_path": "oid4vci.pre_authorized_code.esignet.userinfo_url",
         "path_kind": "property"
       },
-      "purpose": "Confidential client id the Notary presents to eSignet.",
+      "purpose": "eSignet userinfo endpoint. Required when the subject-binding claim is\nsourced from userinfo rather than the `id_token`; the callback fetches\nthe userinfo JWS with the eSignet access token and reads the binding\nclaim from it.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
@@ -135730,31 +138915,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_signing_key_id",
-        "key_path": "oid4vci.pre_authorized_code.esignet.client_signing_key_id",
+        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/locale",
+        "key_path": "oid4vci.display[].locale",
         "path_kind": "property"
       },
-      "purpose": "`evidence.signing_keys` entry used to sign the eSignet\n`private_key_jwt` client assertion.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -135789,51 +138975,52 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/issuer",
-        "key_path": "oid4vci.pre_authorized_code.esignet.issuer",
+        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/logo",
+        "key_path": "oid4vci.display[].logo",
         "path_kind": "property"
       },
-      "purpose": "eSignet OIDC issuer, pinned when validating the returned `id_token`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -135868,32 +139055,32 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/jwks_uri",
-        "key_path": "oid4vci.pre_authorized_code.esignet.jwks_uri",
+        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/name",
+        "key_path": "oid4vci.display[].name",
         "path_kind": "property"
       },
-      "purpose": "eSignet JWKS URI, used to resolve the `id_token` signing key by `kid`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
@@ -135904,12 +139091,11 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -135964,19 +139150,19 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/login_state_ttl_seconds",
-        "key_path": "oid4vci.pre_authorized_code.esignet.login_state_ttl_seconds",
+        "pointer": "/$defs/Oid4vciNonceConfig/properties/enabled",
+        "key_path": "oid4vci.nonce.enabled",
         "path_kind": "property"
       },
-      "purpose": "Lifetime of the short-lived login state (PKCE verifier + nonce +\nselection) reserved between `offer/start` and `offer/callback`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -136031,42 +139217,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/redirect_uri",
-        "key_path": "oid4vci.pre_authorized_code.esignet.redirect_uri",
+        "pointer": "/$defs/Oid4vciNonceConfig/properties/ttl_seconds",
+        "key_path": "oid4vci.nonce.ttl_seconds",
         "path_kind": "property"
       },
-      "purpose": "Notary callback the citizen browser is redirected back to.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -136115,28 +139293,36 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes",
-        "key_path": "oid4vci.pre_authorized_code.esignet.scopes",
+        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/enabled",
+        "key_path": "oid4vci.pre_authorized_code.enabled",
         "path_kind": "property"
       },
-      "purpose": "OAuth scopes requested at eSignet.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -136193,113 +139379,39 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes/items",
-        "key_path": "oid4vci.pre_authorized_code.esignet.scopes[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/token_url",
-        "key_path": "oid4vci.pre_authorized_code.esignet.token_url",
+        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/esignet",
+        "key_path": "oid4vci.pre_authorized_code.esignet",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/Oid4vciEsignetRpConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -136334,51 +139446,52 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/userinfo_url",
-        "key_path": "oid4vci.pre_authorized_code.esignet.userinfo_url",
+        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/pre_authorized_code_ttl_seconds",
+        "key_path": "oid4vci.pre_authorized_code.pre_authorized_code_ttl_seconds",
         "path_kind": "property"
       },
-      "purpose": "eSignet userinfo endpoint. Required when the subject-binding claim is\nsourced from userinfo rather than the `id_token`; the callback fetches\nthe userinfo JWS with the eSignet access token and reads the binding\nclaim from it.",
+      "purpose": "Pre-authorized-code lifetime in seconds.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -136413,49 +139526,54 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/locale",
-        "key_path": "oid4vci.display[].locale",
+        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/tx_code",
+        "key_path": "oid4vci.pre_authorized_code.tx_code",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "`tx_code` (PIN) policy for the pre-authorized-code grant. A `tx_code` is\nrequired by default because a code without a PIN is a bearer credential.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/Oid4vciTxCodeConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -136503,18 +139621,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciTxCodeConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/logo",
-        "key_path": "oid4vci.display[].logo",
+        "pointer": "/$defs/Oid4vciProofConfig/properties/max_age_seconds",
+        "key_path": "oid4vci.proof.max_age_seconds",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -136525,17 +139644,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "integer"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -136581,20 +139699,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/name",
-        "key_path": "oid4vci.display[].name",
+        "pointer": "/$defs/Oid4vciProofConfig/properties/max_clock_skew_seconds",
+        "key_path": "oid4vci.proof.max_clock_skew_seconds",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -136605,15 +139728,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -136659,17 +139783,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciNonceConfig/properties/enabled",
-        "key_path": "oid4vci.nonce.enabled",
+        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/input_mode",
+        "key_path": "oid4vci.pre_authorized_code.tx_code.input_mode",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -136680,13 +139812,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -136737,15 +139869,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciNonceConfig/properties/ttl_seconds",
-        "key_path": "oid4vci.nonce.ttl_seconds",
+        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/length",
+        "key_path": "oid4vci.pre_authorized_code.tx_code.length",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -136828,8 +139960,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/enabled",
-        "key_path": "oid4vci.pre_authorized_code.enabled",
+        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/required",
+        "key_path": "oid4vci.pre_authorized_code.tx_code.required",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -136904,106 +140036,26 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/esignet",
-        "key_path": "oid4vci.pre_authorized_code.esignet",
+        "pointer": "/$defs/OotsConfig/properties/authentication_level_of_assurance",
+        "key_path": "evidence.claims[].oots.authentication_level_of_assurance",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/Oid4vciEsignetRpConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/pre_authorized_code_ttl_seconds",
-        "key_path": "oid4vci.pre_authorized_code.pre_authorized_code_ttl_seconds",
-        "path_kind": "property"
-      },
-      "purpose": "Pre-authorized-code lifetime in seconds.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -137052,38 +140104,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/tx_code",
-        "key_path": "oid4vci.pre_authorized_code.tx_code",
+        "pointer": "/$defs/OotsConfig/properties/enabled",
+        "key_path": "evidence.claims[].oots.enabled",
         "path_kind": "property"
       },
-      "purpose": "`tx_code` (PIN) policy for the pre-authorized-code grant. A `tx_code` is\nrequired by default because a code without a PIN is a bearer credential.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/Oid4vciTxCodeConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -137139,36 +140185,33 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciProofConfig/properties/max_age_seconds",
-        "key_path": "oid4vci.proof.max_age_seconds",
+        "pointer": "/$defs/OotsConfig/properties/evidence_type_classification",
+        "key_path": "evidence.claims[].oots.evidence_type_classification",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -137217,42 +140260,38 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciProofConfig/properties/max_clock_skew_seconds",
-        "key_path": "oid4vci.proof.max_clock_skew_seconds",
+        "pointer": "/$defs/OotsConfig/properties/evidence_type_list",
+        "key_path": "evidence.claims[].oots.evidence_type_list",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -137301,42 +140340,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/input_mode",
-        "key_path": "oid4vci.pre_authorized_code.tx_code.input_mode",
+        "pointer": "/$defs/OotsConfig/properties/languages",
+        "key_path": "evidence.claims[].oots.languages",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -137387,35 +140421,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/length",
-        "key_path": "oid4vci.pre_authorized_code.tx_code.length",
-        "path_kind": "property"
+        "pointer": "/$defs/OotsConfig/properties/languages/items",
+        "key_path": "evidence.claims[].oots.languages[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -137461,42 +140494,35 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/required",
-        "key_path": "oid4vci.pre_authorized_code.tx_code.required",
+        "pointer": "/$defs/OotsConfig/properties/reference_framework",
+        "key_path": "evidence.claims[].oots.reference_framework",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -137547,15 +140573,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/authentication_level_of_assurance",
-        "key_path": "evidence.claims[].oots.authentication_level_of_assurance",
+        "pointer": "/$defs/OotsConfig/properties/requirement",
+        "key_path": "evidence.claims[].oots.requirement",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -137634,8 +140663,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/enabled",
-        "key_path": "evidence.claims[].oots.enabled",
+        "pointer": "/$defs/OperationConfig/properties/enabled",
+        "key_path": "evidence.claims[].operations.evaluate.enabled",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -137710,25 +140739,25 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/evidence_type_classification",
-        "key_path": "evidence.claims[].oots.evidence_type_classification",
+        "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/bind",
+        "key_path": "server.admin_listener.bind",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/SocketAddr",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
@@ -137780,39 +140809,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/SocketAddr"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/evidence_type_list",
-        "key_path": "evidence.claims[].oots.evidence_type_list",
+        "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/mode",
+        "key_path": "server.admin_listener.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/RegistryNotaryAdminListenerMode",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -137859,30 +140889,39 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "shared_with_public",
+            "dedicated",
+            "disabled"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RegistryNotaryAdminListenerMode"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/languages",
-        "key_path": "evidence.claims[].oots.languages",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/allow_regex",
+        "key_path": "cel.allow_regex",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_cel_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -137933,40 +140972,40 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/languages/items",
-        "key_path": "evidence.claims[].oots.languages[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/eval_timeout_ms",
+        "key_path": "cel.eval_timeout_ms",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_cel_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -138008,39 +141047,45 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/reference_framework",
-        "key_path": "evidence.claims[].oots.reference_framework",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_binding_json_bytes",
+        "key_path": "cel.max_binding_json_bytes",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_cel_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -138085,42 +141130,45 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/requirement",
-        "key_path": "evidence.claims[].oots.requirement",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_expression_bytes",
+        "key_path": "cel.max_expression_bytes",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_cel_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -138165,35 +141213,39 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OperationConfig/properties/enabled",
-        "key_path": "evidence.claims[].operations.evaluate.enabled",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_list_items",
+        "key_path": "cel.max_list_items",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_cel_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
@@ -138244,39 +141296,45 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/bind",
-        "key_path": "server.admin_listener.bind",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_depth",
+        "key_path": "cel.max_object_depth",
         "path_kind": "property"
       },
-      "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
+      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_cel_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/SocketAddr",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -138321,114 +141379,28 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SocketAddr"
-      }
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/mode",
-        "key_path": "server.admin_listener.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RegistryNotaryAdminListenerMode",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
+          "keyword": "format",
+          "value": "uint"
+        },
         {
-          "keyword": "enum",
-          "value": [
-            "shared_with_public",
-            "dedicated",
-            "disabled"
-          ]
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerMode"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/allow_regex",
-        "key_path": "cel.allow_regex",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_keys",
+        "key_path": "cel.max_object_keys",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -138439,7 +141411,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
@@ -138493,17 +141465,25 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/eval_timeout_ms",
-        "key_path": "cel.eval_timeout_ms",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_result_json_bytes",
+        "key_path": "cel.max_result_json_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -138570,7 +141550,7 @@
       "constraints": [
         {
           "keyword": "format",
-          "value": "uint64"
+          "value": "uint"
         },
         {
           "keyword": "minimum",
@@ -138585,8 +141565,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_binding_json_bytes",
-        "key_path": "cel.max_binding_json_bytes",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_string_bytes",
+        "key_path": "cel.max_string_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -138668,8 +141648,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_expression_bytes",
-        "key_path": "cel.max_expression_bytes",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/mode",
+        "key_path": "cel.mode",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -138680,13 +141660,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -138734,25 +141714,17 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_list_items",
-        "key_path": "cel.max_list_items",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_count",
+        "key_path": "cel.worker_count",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -138834,8 +141806,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_depth",
-        "key_path": "cel.max_object_depth",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_memory_bytes",
+        "key_path": "cel.worker_memory_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -138902,7 +141874,7 @@
       "constraints": [
         {
           "keyword": "format",
-          "value": "uint"
+          "value": "uint64"
         },
         {
           "keyword": "minimum",
@@ -138917,8 +141889,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_keys",
-        "key_path": "cel.max_object_keys",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_stderr_bytes",
+        "key_path": "cel.worker_stderr_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -139000,19 +141972,19 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_result_json_bytes",
-        "key_path": "cel.max_result_json_bytes",
+        "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins",
+        "key_path": "server.cors.allowed_origins",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
+      "intent_profile": "notary_server_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -139023,8 +141995,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -139059,55 +142031,50 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_string_bytes",
-        "key_path": "cel.max_string_bytes",
-        "path_kind": "property"
+        "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins/items",
+        "key_path": "server.cors.allowed_origins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
+      "intent_profile": "notary_server_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -139142,52 +142109,49 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/mode",
-        "key_path": "cel.mode",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/admin_listener",
+        "key_path": "server.admin_listener",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RegistryNotaryAdminListenerConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -139229,37 +142193,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RegistryNotaryAdminListenerConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_count",
-        "key_path": "cel.worker_count",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/bind",
+        "key_path": "server.bind",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
+      "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/SocketAddr",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -139304,40 +142274,38 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/SocketAddr"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_memory_bytes",
-        "key_path": "cel.worker_memory_bytes",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/cors",
+        "key_path": "server.cors",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/RegistryNotaryCorsConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -139387,45 +142355,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RegistryNotaryCorsConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_stderr_bytes",
-        "key_path": "cel.worker_stderr_bytes",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/http1_header_read_timeout",
+        "key_path": "server.http1_header_read_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
+      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -139470,39 +142436,36 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins",
-        "key_path": "server.cors.allowed_origins",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/max_connections",
+        "key_path": "server.max_connections",
         "path_kind": "property"
       },
       "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_sensitive",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -139513,8 +142476,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -139549,50 +142512,56 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins/items",
-        "key_path": "server.cors.allowed_origins[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/openapi_requires_auth",
+        "key_path": "server.openapi_requires_auth",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_sensitive",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -139627,49 +142596,46 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/admin_listener",
-        "key_path": "server.admin_listener",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_body_timeout",
+        "key_path": "server.request_body_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RegistryNotaryAdminListenerConfig",
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -139717,22 +142683,22 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerConfig"
+        "pointer": "/$defs/HumantimeDuration"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/bind",
-        "key_path": "server.bind",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_timeout",
+        "key_path": "server.request_timeout",
         "path_kind": "property"
       },
-      "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.",
+      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
@@ -139742,7 +142708,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/SocketAddr",
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
@@ -139803,14 +142769,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/SocketAddr"
+        "pointer": "/$defs/HumantimeDuration"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/cors",
-        "key_path": "server.cors",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips",
+        "key_path": "server.trusted_proxy_ips",
         "path_kind": "property"
       },
       "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
@@ -139821,17 +142787,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/RegistryNotaryCorsConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -139879,23 +142844,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCorsConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/http1_header_read_timeout",
-        "key_path": "server.http1_header_read_timeout",
-        "path_kind": "property"
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips/items",
+        "key_path": "server.trusted_proxy_ips[]",
+        "path_kind": "array_item"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
@@ -139904,15 +142865,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -139958,32 +142917,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "ip"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/max_connections",
-        "key_path": "server.max_connections",
+        "pointer": "/$defs/RelayConnectionConfig/properties/allow_insecure_localhost",
+        "key_path": "evidence.relay.allow_insecure_localhost",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -140038,36 +142997,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/openapi_requires_auth",
-        "key_path": "server.openapi_requires_auth",
+        "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs",
+        "key_path": "evidence.relay.allowed_private_cidrs",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
@@ -140075,8 +143026,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -140124,20 +143075,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_body_timeout",
-        "key_path": "server.request_body_timeout",
-        "path_kind": "property"
+        "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs/items",
+        "key_path": "evidence.relay.allowed_private_cidrs[]",
+        "path_kind": "array_item"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
+      "purpose": "An IP network CIDR string. The runtime parser remains authoritative for address and prefix validity.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -140145,15 +143096,14 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
+        "local_reference": "#/$defs/IpNet",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -140206,19 +143156,19 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
+        "pointer": "/$defs/IpNet"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_timeout",
-        "key_path": "server.request_timeout",
+        "pointer": "/$defs/RelayConnectionConfig/properties/base_url",
+        "key_path": "evidence.relay.base_url",
         "path_kind": "property"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -140226,18 +143176,16 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -140272,11 +143220,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -140284,28 +143235,24 @@
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips",
-        "key_path": "server.trusted_proxy_ips",
+        "pointer": "/$defs/RelayConnectionConfig/properties/max_in_flight",
+        "key_path": "evidence.relay.max_in_flight",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -140313,8 +143260,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -140360,22 +143307,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips/items",
-        "key_path": "server.trusted_proxy_ips[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/RelayConnectionConfig/properties/token_file",
+        "key_path": "evidence.relay.token_file",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
+      "intent_profile": "notary_evidence_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -140385,14 +143340,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -140427,18 +143382,94 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "ip"
-        },
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayConnectionConfig/properties/workload_client_id",
+        "key_path": "evidence.relay.workload_client_id",
+        "path_kind": "property"
+      },
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "security",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
           "value": "string"
@@ -140448,8 +143479,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allow_insecure_localhost",
-        "key_path": "evidence.relay.allow_insecure_localhost",
+        "pointer": "/$defs/RelayConsultationConfig/properties/inputs",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -140460,16 +143491,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -140517,38 +143547,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs",
-        "key_path": "evidence.relay.allowed_private_cidrs",
-        "path_kind": "property"
+        "pointer": "/$defs/RelayConsultationConfig/properties/inputs/additionalProperties",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "purpose": "A supported consultation input path. The runtime parser remains authoritative for exact stable-name bounds.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_inputs_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/RelayConsultationInput",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "notary",
@@ -140588,23 +143618,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayConsultationInput"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs/items",
-        "key_path": "evidence.relay.allowed_private_cidrs[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/RelayConsultationConfig/properties/outputs",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs",
+        "path_kind": "property"
       },
-      "purpose": "An IP network CIDR string. The runtime parser remains authoritative for address and prefix validity.",
+      "purpose": "Complete closed public output schema expected from the pinned profile.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
@@ -140612,16 +143650,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/IpNet",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -140669,41 +143707,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/IpNet"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/base_url",
-        "key_path": "evidence.relay.base_url",
-        "path_kind": "property"
+        "pointer": "/$defs/RelayConsultationConfig/properties/outputs/additionalProperties",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Each reviewed key names a consultation output and each value defines its bounded evidence-result interpretation.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_outputs_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RelayOutputContract",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "notary",
@@ -140738,28 +143773,57 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "type",
+              "max_bytes",
+              "fields"
+            ],
+            [
+              "type",
+              "max_bytes",
+              "max_items",
+              "items"
+            ],
+            [
+              "type",
+              "max_bytes"
+            ],
+            [
+              "type",
+              "minimum",
+              "maximum"
+            ],
+            [
+              "type"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayOutputContract"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/max_in_flight",
-        "key_path": "evidence.relay.max_in_flight",
+        "pointer": "/$defs/RelayConsultationConfig/properties/profile",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -140770,16 +143834,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/RelayConsultationProfileRef",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -140826,29 +143890,32 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "id",
+            "contract_hash"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayConsultationProfileRef"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/token_file",
-        "key_path": "evidence.relay.token_file",
+        "pointer": "/$defs/RelayConsultationProfileRef/properties/contract_hash",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.contract_hash",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_secret_reference",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -140865,7 +143932,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -140907,7 +143974,8 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -140919,13 +143987,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/workload_client_id",
-        "key_path": "evidence.relay.workload_client_id",
+        "pointer": "/$defs/RelayConsultationProfileRef/properties/id",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.id",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -140941,8 +144009,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -140977,14 +144045,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -140997,8 +144062,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/inputs",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs",
+        "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/nullable",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.nullable",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141009,15 +144074,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -141065,20 +144131,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/inputs/additionalProperties",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/type",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.type",
+        "path_kind": "property"
       },
-      "purpose": "A supported consultation input path. The runtime parser remains authoritative for exact stable-name bounds.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_inputs_open_map",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -141086,17 +144152,16 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/RelayConsultationInput",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -141136,48 +144201,50 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "const",
+          "value": [
+            "array",
+            "boolean",
+            "date",
+            "integer",
+            "object",
+            "string"
+          ]
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationInput"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/outputs",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs",
+        "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/maximum",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.maximum",
         "path_kind": "property"
       },
-      "purpose": "Complete closed public output schema expected from the pinned profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -141223,40 +144290,43 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int64"
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/outputs/additionalProperties",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/minimum",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.minimum",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a consultation output and each value defines its bounded evidence-result interpretation.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_outputs_open_map",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/RelayOutputContract",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -141296,41 +144366,24 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "max_bytes"
-            ],
-            [
-              "type",
-              "minimum",
-              "maximum"
-            ],
-            [
-              "type"
-            ]
-          ]
+          "keyword": "format",
+          "value": "int64"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/profile",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile",
+        "pointer": "/$defs/RelayOutputContract/oneOf/2/properties/max_bytes",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141341,9 +144394,8 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/RelayConsultationProfileRef",
         "composed": false
       },
       "requiredness": "required",
@@ -141397,105 +144449,24 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "id",
-            "contract_hash"
-          ]
+          "keyword": "format",
+          "value": "uint32"
         },
         {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationProfileRef"
-      }
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationProfileRef/properties/contract_hash",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.contract_hash",
-        "path_kind": "property"
-      },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConsultationProfileRef/properties/id",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.id",
+        "pointer": "/$defs/RelayOutputContract/oneOf/4/properties/fields",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141506,13 +144477,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -141562,38 +144533,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/nullable",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.nullable",
-        "path_kind": "property"
+        "pointer": "/$defs/RelayOutputContract/oneOf/4/properties/fields/additionalProperties",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Each reviewed key names a closed structured output field and each value defines its requiredness and bounded recursive schema.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
+        "local_reference": "#/$defs/RelayOutputObjectFieldContract",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "notary",
@@ -141633,20 +144604,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "required",
+            "schema"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayOutputObjectFieldContract"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/type",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.type",
+        "pointer": "/$defs/RelayOutputContract/oneOf/5/properties/items",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.items",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141657,13 +144639,14 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RelayOutputContract",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -141712,25 +144695,48 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
+          "keyword": "required",
           "value": [
-            "boolean",
-            "date",
-            "integer",
-            "string"
+            [
+              "type",
+              "max_bytes",
+              "fields"
+            ],
+            [
+              "type",
+              "max_bytes",
+              "max_items",
+              "items"
+            ],
+            [
+              "type",
+              "max_bytes"
+            ],
+            [
+              "type",
+              "minimum",
+              "maximum"
+            ],
+            [
+              "type"
+            ]
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayOutputContract"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/maximum",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.maximum",
+        "pointer": "/$defs/RelayOutputContract/oneOf/5/properties/max_items",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_items",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141797,7 +144803,15 @@
       "constraints": [
         {
           "keyword": "format",
-          "value": "int64"
+          "value": "uint16"
+        },
+        {
+          "keyword": "maximum",
+          "value": 65535
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
@@ -141808,8 +144822,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/minimum",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.minimum",
+        "pointer": "/$defs/RelayOutputObjectFieldContract/properties/required",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.required",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141820,7 +144834,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -141874,21 +144888,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/2/properties/max_bytes",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_bytes",
+        "pointer": "/$defs/RelayOutputObjectFieldContract/properties/schema",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.schema",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141899,8 +144909,9 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/RelayOutputContract",
         "composed": false
       },
       "requiredness": "required",
@@ -141954,18 +144965,42 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            [
+              "type",
+              "max_bytes",
+              "fields"
+            ],
+            [
+              "type",
+              "max_bytes",
+              "max_items",
+              "items"
+            ],
+            [
+              "type",
+              "max_bytes"
+            ],
+            [
+              "type",
+              "minimum",
+              "maximum"
+            ],
+            [
+              "type"
+            ]
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayOutputContract"
+      }
     },
     {
       "address": {
diff --git a/docs/site/scripts/authoring-reference-docs.test.mjs b/docs/site/scripts/authoring-reference-docs.test.mjs
index b484ce9cb7..e87f5f3bae 100644
--- a/docs/site/scripts/authoring-reference-docs.test.mjs
+++ b/docs/site/scripts/authoring-reference-docs.test.mjs
@@ -26,12 +26,12 @@ test('committed internal and public reference artifacts are exact and complete',
   validateAuthoringReference(reference, coverage);
   assert.deepEqual(publicReference, reference);
   assert.deepEqual(publicCoverage, coverage);
-  assert.equal(reference.fields.length, 1771);
-  assert.equal(coverage.reviewed_intent_assignment_required_count, 1771);
-  assert.equal(coverage.reviewed_intent_assignment_covered_count, 1771);
-  assert.equal(coverage.distinct_reviewed_intent_count, 596);
-  assert.equal(coverage.distinct_reviewed_intents_reused_count, 82);
-  assert.equal(coverage.reviewed_intent_assignments_using_reused_intent_count, 1257);
+  assert.equal(reference.fields.length, 1803);
+  assert.equal(coverage.reviewed_intent_assignment_required_count, 1803);
+  assert.equal(coverage.reviewed_intent_assignment_covered_count, 1803);
+  assert.equal(coverage.distinct_reviewed_intent_count, 617);
+  assert.equal(coverage.distinct_reviewed_intents_reused_count, 86);
+  assert.equal(coverage.reviewed_intent_assignments_using_reused_intent_count, 1272);
   assert.deepEqual(reference.reference_baseline, {
     generator_lifecycle: 'unreleased',
     published_release: null,
@@ -51,33 +51,33 @@ test('committed internal and public reference artifacts are exact and complete',
   );
   assert.deepEqual(reference.coverage.by_schema, {
     project: 220,
-    environment: 198,
-    integration: 142,
+    environment: 200,
+    integration: 166,
     fixture: 62,
     entity: 35,
     relay: 584,
-    notary: 530,
+    notary: 536,
   });
   assert.deepEqual(reference.coverage.by_path_kind, {
     root: 7,
-    property: 1413,
-    map_key: 25,
-    map_value: 47,
-    array_item: 178,
-    branch: 101,
+    property: 1435,
+    map_key: 26,
+    map_value: 49,
+    array_item: 179,
+    branch: 107,
   });
   assert.equal(
     Object.values(reference.coverage.by_intent_profile).reduce(
       (total, count) => total + count,
       0,
     ),
-    1114,
+    1120,
   );
   assert.equal(reference.fields.filter((field) => field.empty_behavior === 'allowed').length, 523);
-  assert.equal(reference.fields.filter((field) => field.empty_behavior === 'rejected').length, 307);
+  assert.equal(reference.fields.filter((field) => field.empty_behavior === 'rejected').length, 309);
   assert.equal(
     reference.fields.filter((field) => field.empty_behavior === 'not_applicable').length,
-    941,
+    971,
   );
 });
 
diff --git a/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx b/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx
index 67d9343085..dab0d50202 100644
--- a/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx
+++ b/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx
@@ -96,6 +96,39 @@ ambiguity fixtures prove that Relay does not choose a record when the source res
 non-unique. Derived checks reject malformed signatures, unexpected response shapes, excessive
 data, and source work before authorization.
 
+The match fixture also proves the closed `parents` array:
+
+```json
+{
+  "parents": [
+    {
+      "type": "mother",
+      "name": "Mira Example",
+      "identifier": "PARENT-0001"
+    },
+    {
+      "type": "father",
+      "name": "Noah Example",
+      "identifier": "PARENT-0002"
+    }
+  ]
+}
+```
+
+The source observation includes a fictional `source_only_reference` for each parent. The adapter
+constructs each released object from `type`, `name`, and `identifier`, so that source-only member
+cannot cross the Relay boundary.
+
+The output contract limits `parents` to two items and 1,024 canonical serialized bytes. Each item
+is a closed object limited to 384 bytes. Unknown keys, missing required fields, invalid nested
+types, excessive items, and over-bound serialized values fail the fixture or consultation.
+
+When a credential profile includes this direct structured claim, Registry Notary stores and issues
+the exact validated array from the compiler-pinned Relay result. The `parents` claim is one
+top-level Selective Disclosure JSON Web Token (SD-JWT) disclosure. A holder can disclose or
+withhold the complete array. Individual parent objects and their fields are not independently
+disclosable.
+
 ## Adapt the project contract
 
 Review and update these surfaces:
@@ -152,6 +185,8 @@ Before deployment approval, confirm:
 - Notary has a Relay workload binding for registry-backed claims and no direct OpenCRVS connector.
 - The source product and version do not select the script capability.
 - Each fixture proves the canonical source request and a minimized typed result.
+- Structured output schemas are closed, byte-bounded, item-bounded, and identical in the Relay
+  public contract and Notary consultation expectation.
 - The generated review record identifies every semantic and operator-security review required by
   the adapted project.
 
diff --git a/docs/site/src/data/generated/configuration-reference-coverage.json b/docs/site/src/data/generated/configuration-reference-coverage.json
index cf418b0ab1..03e7ce4f51 100644
--- a/docs/site/src/data/generated/configuration-reference-coverage.json
+++ b/docs/site/src/data/generated/configuration-reference-coverage.json
@@ -39,38 +39,38 @@
   },
   "coverage": {
     "schema_count": 7,
-    "path_count": 1771,
-    "reference_count": 485,
+    "path_count": 1803,
+    "reference_count": 500,
     "by_schema": {
       "project": 220,
-      "environment": 198,
-      "integration": 142,
+      "environment": 200,
+      "integration": 166,
       "fixture": 62,
       "entity": 35,
       "relay": 584,
-      "notary": 530
+      "notary": 536
     },
     "by_path_kind": {
       "root": 7,
-      "property": 1413,
-      "map_key": 25,
-      "map_value": 47,
-      "array_item": 178,
-      "branch": 101
+      "property": 1435,
+      "map_key": 26,
+      "map_value": 49,
+      "array_item": 179,
+      "branch": 107
     },
     "by_sensitivity": {
       "public": 16,
-      "internal": 1145,
-      "sensitive": 399,
+      "internal": 1168,
+      "sensitive": 401,
       "secret_reference": 41,
       "redacted_fixture": 50,
-      "structural": 120
+      "structural": 127
     },
     "by_intent_source": {
-      "schema_description": 504,
-      "reviewed_override": 248,
+      "schema_description": 517,
+      "reviewed_override": 261,
       "structural_taxonomy": 127,
-      "reviewed_profile": 892
+      "reviewed_profile": 898
     },
     "by_intent_profile": {
       "notary_audit_internal": 4,
@@ -88,10 +88,11 @@
       "notary_deployment_sensitive": 1,
       "notary_evidence_claims_evidence_mode_consultations_inputs_open_map": 1,
       "notary_evidence_claims_evidence_mode_consultations_open_map": 1,
+      "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map": 1,
       "notary_evidence_claims_evidence_mode_consultations_outputs_open_map": 1,
       "notary_evidence_claims_rule_bindings_claims_open_map": 1,
       "notary_evidence_credential_profiles_open_map": 1,
-      "notary_evidence_internal": 92,
+      "notary_evidence_internal": 97,
       "notary_evidence_secret_reference": 5,
       "notary_evidence_sensitive": 40,
       "notary_evidence_signing_keys_open_map": 1,
@@ -148,10 +149,10 @@
       "relay_vocabularies_open_map": 1
     }
   },
-  "reviewed_intent_assignment_required_count": 1771,
-  "reviewed_intent_assignment_covered_count": 1771,
-  "distinct_reviewed_intent_count": 596,
-  "distinct_reviewed_intents_reused_count": 82,
-  "reviewed_intent_assignments_using_reused_intent_count": 1257,
+  "reviewed_intent_assignment_required_count": 1803,
+  "reviewed_intent_assignment_covered_count": 1803,
+  "distinct_reviewed_intent_count": 617,
+  "distinct_reviewed_intents_reused_count": 86,
+  "reviewed_intent_assignments_using_reused_intent_count": 1272,
   "missing_intent": []
 }
diff --git a/docs/site/src/data/generated/configuration-reference.json b/docs/site/src/data/generated/configuration-reference.json
index 2fbaac6eab..c412120452 100644
--- a/docs/site/src/data/generated/configuration-reference.json
+++ b/docs/site/src/data/generated/configuration-reference.json
@@ -38,38 +38,38 @@
   },
   "coverage": {
     "schema_count": 7,
-    "path_count": 1771,
-    "reference_count": 485,
+    "path_count": 1803,
+    "reference_count": 500,
     "by_schema": {
       "project": 220,
-      "environment": 198,
-      "integration": 142,
+      "environment": 200,
+      "integration": 166,
       "fixture": 62,
       "entity": 35,
       "relay": 584,
-      "notary": 530
+      "notary": 536
     },
     "by_path_kind": {
       "root": 7,
-      "property": 1413,
-      "map_key": 25,
-      "map_value": 47,
-      "array_item": 178,
-      "branch": 101
+      "property": 1435,
+      "map_key": 26,
+      "map_value": 49,
+      "array_item": 179,
+      "branch": 107
     },
     "by_sensitivity": {
       "public": 16,
-      "internal": 1145,
-      "sensitive": 399,
+      "internal": 1168,
+      "sensitive": 401,
       "secret_reference": 41,
       "redacted_fixture": 50,
-      "structural": 120
+      "structural": 127
     },
     "by_intent_source": {
-      "schema_description": 504,
-      "reviewed_override": 248,
+      "schema_description": 517,
+      "reviewed_override": 261,
       "structural_taxonomy": 127,
-      "reviewed_profile": 892
+      "reviewed_profile": 898
     },
     "by_intent_profile": {
       "notary_audit_internal": 4,
@@ -87,10 +87,11 @@
       "notary_deployment_sensitive": 1,
       "notary_evidence_claims_evidence_mode_consultations_inputs_open_map": 1,
       "notary_evidence_claims_evidence_mode_consultations_open_map": 1,
+      "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map": 1,
       "notary_evidence_claims_evidence_mode_consultations_outputs_open_map": 1,
       "notary_evidence_claims_rule_bindings_claims_open_map": 1,
       "notary_evidence_credential_profiles_open_map": 1,
-      "notary_evidence_internal": 92,
+      "notary_evidence_internal": 97,
       "notary_evidence_secret_reference": 5,
       "notary_evidence_sensitive": 40,
       "notary_evidence_signing_keys_open_map": 1,
@@ -26234,29 +26235,29 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/sensitive_state_key",
+        "pointer": "/$defs/oid4vci/properties/registrar_clients",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose": "Closed OIDC machine-client allow-list for registrar-created credential offers. Each client uses this authorization server and the Notary public base URL as its resource audience; citizen client classification remains separate.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/secret",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "schema_value": []
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -26311,124 +26312,28 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxItems",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/secret"
-      }
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/subject",
-        "path_kind": "property"
-      },
-      "purpose": "Verified eSignet userinfo claim bound exactly to the credential subject identifier.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "token_claim",
-            "id_type"
-          ]
+          "value": "array"
         },
         {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/subject/properties/id_type",
-        "path_kind": "property"
+        "pointer": "/$defs/oid4vci/properties/registrar_clients/items",
+        "path_kind": "array_item"
       },
       "purpose": "Bounded visible-ASCII protocol token.",
       "purpose_source": "schema_description",
@@ -26442,14 +26347,14 @@
         "local_reference": "#/$defs/token256",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -26503,7 +26408,9 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -26531,29 +26438,29 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/subject/properties/token_claim",
+        "pointer": "/$defs/oid4vci/properties/sensitive_state_key",
         "path_kind": "property"
       },
-      "purpose": "Bounded visible-ASCII protocol token.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/token256",
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "secret_reference",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -26607,38 +26514,33 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[!-~]+$"
+          "keyword": "required",
+          "value": [
+            "secret"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/token256"
+        "pointer": "/$defs/secret"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/tx_code",
+        "pointer": "/$defs/oid4vci/properties/subject",
         "path_kind": "property"
       },
-      "purpose": "Transaction-code policy. Omit for the secure required-PIN default. Set required=false only for a bounded bearer-offer interoperability profile; the compiler fixes the offer lifetime at 300 seconds.",
+      "purpose": "Verified eSignet userinfo claim bound exactly to the credential subject identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -26649,7 +26551,7 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -26713,6 +26615,13 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "token_claim",
+            "id_type"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
@@ -26722,26 +26631,26 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/oid4vci/properties/tx_code/properties/required",
+        "pointer": "/$defs/oid4vci/properties/subject/properties/id_type",
         "path_kind": "property"
       },
-      "purpose": "States whether OID4VCI authorization requires a transaction code before credential issuance.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded visible-ASCII protocol token.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/token256",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": true
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
@@ -26801,20 +26710,36 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[!-~]+$"
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/token256"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/privateCidrs/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/oid4vci/properties/subject/properties/token_claim",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Bounded visible-ASCII protocol token.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -26822,16 +26747,17 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/token256",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -26885,33 +26811,39 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 64
+          "value": 256
         },
         {
           "keyword": "minLength",
-          "value": 3
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[!-~]+$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/token256"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/oid4vci/properties/tx_code",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Transaction-code policy. Omit for the secure required-PIN default. Set required=false only for a bounded bearer-offer interoperability profile; the compiler fixes the offer lifetime at 300 seconds.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -26921,14 +26853,14 @@
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -26982,17 +26914,9 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type",
-            "path"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -27002,17 +26926,17 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/delimiter",
+        "pointer": "/$defs/oid4vci/properties/tx_code/properties/required",
         "path_kind": "property"
       },
-      "purpose": "Selects the byte used to delimit fields in the bound CSV source.",
+      "purpose": "States whether OID4VCI authorization requires a transaction code before credential issuance.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -27020,7 +26944,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "schema_value": true
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
@@ -27080,45 +27005,37 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/header_row",
-        "path_kind": "property"
+        "pointer": "/$defs/privateCidrs/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Selects the one-based CSV row containing source column headers.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -27172,49 +27089,50 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
+          "keyword": "maxLength",
+          "value": 64
         },
         {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "minLength",
+          "value": 3
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/path",
-        "path_kind": "property"
+        "pointer": "/$defs/provider/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -27269,38 +27187,29 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "required",
+          "value": [
+            "type",
+            "path"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/absolutePath"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/quote",
+        "pointer": "/$defs/provider/oneOf/0/properties/delimiter",
         "path_kind": "property"
       },
-      "purpose": "Selects the byte used to quote fields in the bound CSV source.",
+      "purpose": "Selects the byte used to delimit fields in the bound CSV source.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -27392,19 +27301,21 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/0/properties/type",
+        "pointer": "/$defs/provider/oneOf/0/properties/header_row",
         "path_kind": "property"
       },
-      "purpose": "Selects CSV as the environment-owned materialization provider for an authored entity.",
+      "purpose": "Selects the one-based CSV row containing source column headers.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -27469,116 +27380,27 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "csv"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "deployment_security",
-      "human_owner": "security_maintainers",
-      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "environment_bound",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "operator_preflight",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.environment.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
+          "keyword": "maximum",
+          "value": 4294967295
+        },
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "project_file",
-            "path",
-            "sheet"
-          ]
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/data_range",
+        "pointer": "/$defs/provider/oneOf/0/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Restricts entity materialization to the reviewed range within the selected worksheet.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -27586,16 +27408,17 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -27649,30 +27472,39 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 256
+          "value": 4096
         },
         {
           "keyword": "minLength",
-          "value": 1
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/absolutePath"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/header_row",
+        "pointer": "/$defs/provider/oneOf/0/properties/quote",
         "path_kind": "property"
       },
-      "purpose": "Selects the one-based XLSX row containing source column headers.",
+      "purpose": "Selects the byte used to quote fields in the bound CSV source.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -27749,11 +27581,11 @@
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 4294967295
+          "value": 255
         },
         {
           "keyword": "minimum",
-          "value": 1
+          "value": 0
         },
         {
           "keyword": "type",
@@ -27764,29 +27596,26 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/path",
+        "pointer": "/$defs/provider/oneOf/0/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects CSV as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/absolutePath",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -27840,58 +27669,40 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 2
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "csv"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/absolutePath"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/project_file",
-        "path_kind": "property"
+        "pointer": "/$defs/provider/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Binds a contained project-relative workbook for offline preflight and read-only runtime mounting without emitting the authoring path into Relay configuration.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -27946,38 +27757,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "keyword": "required",
+          "value": [
+            "type",
+            "project_file",
+            "path",
+            "sheet"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/relativePath"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/sheet",
+        "pointer": "/$defs/provider/oneOf/1/properties/data_range",
         "path_kind": "property"
       },
-      "purpose": "Names the worksheet read from the environment-owned XLSX source.",
+      "purpose": "Restricts entity materialization to the reviewed range within the selected worksheet.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -27988,7 +27792,7 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -28069,19 +27873,21 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/1/properties/type",
+        "pointer": "/$defs/provider/oneOf/1/properties/header_row",
         "path_kind": "property"
       },
-      "purpose": "Selects XLSX as the environment-owned materialization provider for an authored entity.",
+      "purpose": "Selects the one-based XLSX row containing source column headers.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -28146,36 +27952,45 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "xlsx"
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/2",
-        "path_kind": "branch"
+        "pointer": "/$defs/provider/oneOf/1/properties/path",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -28230,30 +28045,39 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "path"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/absolutePath"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/2/properties/path",
+        "pointer": "/$defs/provider/oneOf/1/properties/project_file",
         "path_kind": "property"
       },
-      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
-      "purpose_source": "schema_description",
+      "purpose": "Binds a contained project-relative workbook for offline preflight and read-only runtime mounting without emitting the authoring path into Relay configuration.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -28261,7 +28085,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/absolutePath",
+        "local_reference": "#/$defs/relativePath",
         "composed": false
       },
       "requiredness": "required",
@@ -28335,11 +28159,11 @@
         },
         {
           "keyword": "minLength",
-          "value": 2
+          "value": 1
         },
         {
           "keyword": "pattern",
-          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
+          "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
@@ -28348,16 +28172,111 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/absolutePath"
+        "pointer": "/$defs/relativePath"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/2/properties/type",
+        "pointer": "/$defs/provider/oneOf/1/properties/sheet",
         "path_kind": "property"
       },
-      "purpose": "Selects Parquet as the environment-owned materialization provider for an authored entity.",
+      "purpose": "Names the worksheet read from the environment-owned XLSX source.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/$defs/provider/oneOf/1/properties/type",
+        "path_kind": "property"
+      },
+      "purpose": "Selects XLSX as the environment-owned materialization provider for an authored entity.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -28432,14 +28351,14 @@
       "constraints": [
         {
           "keyword": "const",
-          "value": "parquet"
+          "value": "xlsx"
         }
       ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3",
+        "pointer": "/$defs/provider/oneOf/2",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
@@ -28522,9 +28441,7 @@
           "keyword": "required",
           "value": [
             "type",
-            "connection",
-            "schema",
-            "table"
+            "path"
           ]
         },
         {
@@ -28536,29 +28453,29 @@
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/connection",
+        "pointer": "/$defs/provider/oneOf/2/properties/path",
         "path_kind": "property"
       },
-      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
+      "purpose": "Normalized absolute path without dot segments or duplicate separators.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/secret",
+        "local_reference": "#/$defs/absolutePath",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -28613,46 +28530,49 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "secret"
-          ]
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 2
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/secret"
+        "pointer": "/$defs/absolutePath"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/schema",
+        "pointer": "/$defs/provider/oneOf/2/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects Parquet as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/postgresIdentifier",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -28715,45 +28635,134 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,62}$"
+          "keyword": "const",
+          "value": "parquet"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/$defs/provider/oneOf/3",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "type",
+            "connection",
+            "schema",
+            "table"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/postgresIdentifier"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/table",
+        "pointer": "/$defs/provider/oneOf/3/properties/connection",
         "path_kind": "property"
       },
-      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
+      "purpose": "Reference to a process-environment variable; secret values are never authored here.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/postgresIdentifier",
+        "local_reference": "#/$defs/secret",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "secret_reference",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -28807,41 +28816,47 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,62}$"
+          "keyword": "required",
+          "value": [
+            "secret"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/postgresIdentifier"
+        "pointer": "/$defs/secret"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/provider/oneOf/3/properties/type",
+        "pointer": "/$defs/provider/oneOf/3/properties/schema",
         "path_kind": "property"
       },
-      "purpose": "Selects PostgreSQL as the environment-owned materialization provider for an authored entity.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/postgresIdentifier",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -28904,18 +28919,26 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "postgres"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,62}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/postgresIdentifier"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/relayOrigin/anyOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/provider/oneOf/3/properties/table",
+        "path_kind": "property"
       },
-      "purpose": "HTTPS origin without path, query, or fragment.",
+      "purpose": "Portable unquoted PostgreSQL schema or table identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -28924,17 +28947,17 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/origin",
+        "local_reference": "#/$defs/postgresIdentifier",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -28988,17 +29011,12 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uri"
-        },
         {
           "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
+          "value": "^[a-z][a-z0-9_]{0,62}$"
         },
         {
           "keyword": "type",
@@ -29007,35 +29025,120 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/origin"
+        "pointer": "/$defs/postgresIdentifier"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/relayOrigin/anyOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/provider/oneOf/3/properties/type",
+        "path_kind": "property"
       },
-      "purpose": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Selects PostgreSQL as the environment-owned materialization provider for an authored entity.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/localLoopbackOrigin",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "const",
+          "value": "postgres"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/$defs/relayOrigin/anyOf/0",
+        "path_kind": "branch"
+      },
+      "purpose": "HTTPS origin without path, query, or fragment.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/origin",
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -29099,7 +29202,7 @@
         },
         {
           "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$"
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$"
         },
         {
           "keyword": "type",
@@ -29108,16 +29211,16 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/localLoopbackOrigin"
+        "pointer": "/$defs/origin"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/relayResource/anyOf/0",
+        "pointer": "/$defs/relayOrigin/anyOf/1",
         "path_kind": "branch"
       },
-      "purpose": "Exact HTTPS resource without query or fragment.",
+      "purpose": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -29126,7 +29229,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/httpsResource",
+        "local_reference": "#/$defs/localLoopbackOrigin",
         "composed": false
       },
       "requiredness": "conditional",
@@ -29200,7 +29303,7 @@
         },
         {
           "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
+          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$"
         },
         {
           "keyword": "type",
@@ -29209,16 +29312,16 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/httpsResource"
+        "pointer": "/$defs/localLoopbackOrigin"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/relayResource/anyOf/1",
+        "pointer": "/$defs/relayResource/anyOf/0",
         "path_kind": "branch"
       },
-      "purpose": "HTTP IP-loopback resource accepted only with the local deployment profile.",
+      "purpose": "Exact HTTPS resource without query or fragment.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
@@ -29227,7 +29330,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/localLoopbackResource",
+        "local_reference": "#/$defs/httpsResource",
         "composed": false
       },
       "requiredness": "conditional",
@@ -29301,7 +29404,7 @@
         },
         {
           "keyword": "pattern",
-          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/[^?#]+$"
+          "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$"
         },
         {
           "keyword": "type",
@@ -29310,17 +29413,17 @@
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/localLoopbackResource"
+        "pointer": "/$defs/httpsResource"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/secret/properties/secret",
-        "path_kind": "property"
+        "pointer": "/$defs/relayResource/anyOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Names the operator-managed environment secret reference without containing the secret value.",
-      "purpose_source": "reviewed_override",
+      "purpose": "HTTP IP-loopback resource accepted only with the local deployment profile.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -29328,16 +29431,17 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/localLoopbackResource",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "structural",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -29392,27 +29496,35 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uri"
+        },
         {
           "keyword": "pattern",
-          "value": "^[A-Z_][A-Z0-9_]{0,127}$"
+          "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/[^?#]+$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/localLoopbackResource"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/service/properties/service",
+        "pointer": "/$defs/secret/properties/secret",
         "path_kind": "property"
       },
-      "purpose": "Lowercase stable identifier used in project references.",
-      "purpose_source": "schema_description",
+      "purpose": "Names the operator-managed environment secret reference without containing the secret value.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
@@ -29420,7 +29532,6 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
       "requiredness": "required",
@@ -29430,7 +29541,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "secret_reference",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -29484,49 +29595,46 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^[A-Z_][A-Z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "environment",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/source/properties/allowed_private_cidrs",
+        "pointer": "/$defs/service/properties/service",
         "path_kind": "property"
       },
-      "purpose": "Explicit private network ranges this source may resolve to.",
+      "purpose": "Lowercase stable identifier used in project references.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/privateCidrs",
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -29580,44 +29688,39 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/privateCidrs"
+        "pointer": "/$defs/stableId"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/source/properties/ca",
+        "pointer": "/$defs/source/properties/allowed_private_cidrs",
         "path_kind": "property"
       },
-      "purpose": "Pinned certificate-authority file and its rotation generation.",
+      "purpose": "Explicit private network ranges this source may resolve to.",
       "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/ca",
+        "local_reference": "#/$defs/privateCidrs",
         "composed": false
       },
       "requiredness": "optional",
@@ -29627,7 +29730,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "sensitive",
       "state": "environment_bound",
       "products": [
         "registryctl",
@@ -29681,41 +29784,44 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "file",
-            "generation"
-          ]
+          "keyword": "maxItems",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ],
       "local_reference": {
         "schema": "environment",
-        "pointer": "/$defs/ca"
+        "pointer": "/$defs/privateCidrs"
       }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/source/properties/concurrency",
+        "pointer": "/$defs/source/properties/ca",
         "path_kind": "property"
       },
-      "purpose": "Caps the number of requests that may be in flight concurrently for this source.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Pinned certificate-authority file and its rotation generation.",
+      "purpose_source": "schema_description",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/ca",
         "composed": false
       },
       "requiredness": "optional",
@@ -29783,35 +29889,133 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 64
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "file",
+            "generation"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "environment",
+        "pointer": "/$defs/ca"
+      }
     },
     {
       "address": {
         "schema": "environment",
-        "pointer": "/$defs/source/properties/credential",
+        "pointer": "/$defs/source/properties/concurrency",
         "path_kind": "property"
       },
-      "purpose": "One supported source credential shape, containing references rather than values.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the number of requests that may be in flight concurrently for this source.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "deployment_security",
       "human_owner": "security_maintainers",
       "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/credential",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "environment_bound",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "operator_preflight",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.environment.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 64
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "environment",
+        "pointer": "/$defs/source/properties/credential",
+        "path_kind": "property"
+      },
+      "purpose": "One supported source credential shape, containing references rather than values.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "deployment_security",
+      "human_owner": "security_maintainers",
+      "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/credential",
         "composed": false
       },
       "requiredness": "optional",
@@ -47034,26 +47238,29 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/output/properties/format",
-        "path_kind": "property"
+        "pointer": "/$defs/output/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Applies the full-date semantic format to a string-valued integration output.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Type, scalar bounds, and optional source pointer for one normalized scalar integration output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/scalarOutput",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -47109,40 +47316,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "date"
+          "keyword": "required",
+          "value": [
+            "type"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutput"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/output/properties/maxLength",
-        "path_kind": "property"
+        "pointer": "/$defs/output/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Caps the character length produced for a string-valued integration output.",
-      "purpose_source": "reviewed_override",
+      "purpose": "A recursively typed object output with a canonical byte ceiling and an always-closed field map.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/outputObject",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -47198,48 +47417,55 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 16384
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "type",
+            "nullable",
+            "max_bytes",
+            "fields"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputObject"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/output/properties/maximum",
-        "path_kind": "property"
+        "pointer": "/$defs/output/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Sets the inclusive upper bound produced for an integer-valued integration output.",
-      "purpose_source": "reviewed_override",
+      "purpose": "A recursively typed array output with canonical byte and item-count ceilings.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/outputArray",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -47295,41 +47521,47 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
+          "keyword": "required",
+          "value": [
+            "type",
+            "nullable",
+            "max_bytes",
+            "max_items",
+            "items"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputArray"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/output/properties/minimum",
+        "pointer": "/$defs/outputArray/properties/items",
         "path_kind": "property"
       },
-      "purpose": "Sets the inclusive lower bound produced for an integer-valued integration output.",
-      "purpose_source": "reviewed_override",
+      "purpose": "A recursively closed structured output schema without a source pointer.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
+        "local_reference": "#/$defs/outputSchema",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -47394,37 +47626,27 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/output/properties/type",
+        "pointer": "/$defs/outputArray/properties/max_bytes",
         "path_kind": "property"
       },
-      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the canonical serialized size of one structured output array.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
-        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
       "requiredness": "required",
@@ -47492,32 +47714,41 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/scalarType"
-      }
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/output/properties/x-registry-source",
+        "pointer": "/$defs/outputArray/properties/max_items",
         "path_kind": "property"
       },
-      "purpose": "Selects the canonical source-response location from which the HTTP output is extracted.",
+      "purpose": "Caps the number of values released in one structured output array.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -47582,33 +47813,37 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
+          "keyword": "maximum",
+          "value": 256
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci",
+        "pointer": "/$defs/outputArray/properties/nullable",
         "path_kind": "property"
       },
-      "purpose": "Enables the bounded signed DCI search helper and declares its protocol and selector bindings.",
+      "purpose": "Declares whether the complete structured output array may be null.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -47674,33 +47909,19 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "profile",
-            "path",
-            "jwks_profile",
-            "sender",
-            "receiver",
-            "registry_type",
-            "record_type",
-            "locale",
-            "selectors"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/jwks_profile",
+        "pointer": "/$defs/outputArray/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Selects the supported RSA signing-key-set profile used to verify signed DCI responses.",
+      "purpose": "Selects the array form for a structured integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -47777,30 +47998,30 @@
       "constraints": [
         {
           "keyword": "const",
-          "value": "rsa-signing-jwks-v1"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/locale",
+        "pointer": "/$defs/outputObject/properties/fields",
         "path_kind": "property"
       },
-      "purpose": "Declares the language or locale tag carried by signed DCI search requests.",
+      "purpose": "Declares the bounded closed map of fields released in one structured output object.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -47865,40 +48086,45 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$"
+          "keyword": "maxProperties",
+          "value": 32
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/path",
-        "path_kind": "property"
+        "pointer": "/$defs/outputObject/properties/fields/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Declares the exact private source path used for signed DCI search requests.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Requiredness and recursive schema for one named field of a closed structured output object.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/outputObjectField",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -47955,37 +48181,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^/[^?#]*$"
+          "keyword": "required",
+          "value": [
+            "required",
+            "schema"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputObjectField"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/profile",
-        "path_kind": "property"
+        "pointer": "/$defs/outputObject/properties/fields/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Selects the supported DCI search request profile used by the signed protocol helper.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -48046,35 +48282,44 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "dci-search-v1"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/receiver",
+        "pointer": "/$defs/outputObject/properties/max_bytes",
         "path_kind": "property"
       },
-      "purpose": "Declares the signed DCI receiver identifier included in protocol requests.",
+      "purpose": "Caps the canonical serialized size of one structured output object.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -48139,39 +48384,39 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
+          "keyword": "maximum",
+          "value": 65536
         },
         {
-          "keyword": "minLength",
+          "keyword": "minimum",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/record_type",
+        "pointer": "/$defs/outputObject/properties/nullable",
         "path_kind": "property"
       },
-      "purpose": "Declares the record type requested through the signed DCI search profile.",
+      "purpose": "Declares whether the complete structured output object may be null.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -48235,40 +48480,30 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/registry_type",
+        "pointer": "/$defs/outputObject/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Declares the registry type requested through the signed DCI search profile.",
+      "purpose": "Selects the closed object form for a structured integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -48333,33 +48568,25 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors",
+        "pointer": "/$defs/outputObjectField/properties/required",
         "path_kind": "property"
       },
-      "purpose": "Maps every selector input to its signed DCI request field and response location.",
+      "purpose": "Declares whether a named field must be present in every released structured output object.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
@@ -48429,38 +48656,29 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 8
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/outputObjectField/properties/schema",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "A recursively closed structured output schema without a source pointer.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
+        "local_reference": "#/$defs/outputSchema",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -48523,48 +48741,40 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "response_pointer"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputSchema"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/field",
-        "path_kind": "property"
+        "pointer": "/$defs/outputSchema/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Declares the signed DCI identifier field bound to one selector input.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Type and bounds for a scalar nested inside a structured output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/scalarOutputSchema",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -48620,48 +48830,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 160
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "type"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/scalarOutputSchema"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/response_pointer",
-        "path_kind": "property"
+        "pointer": "/$defs/outputSchema/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Selects the canonical signed-record response location used to recover one selector value.",
-      "purpose_source": "reviewed_override",
+      "purpose": "A recursively typed object output with a canonical byte ceiling and an always-closed field map.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/outputObject",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -48717,45 +48931,55 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
+          "keyword": "required",
+          "value": [
+            "type",
+            "nullable",
+            "max_bytes",
+            "fields"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/outputObject"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/outputSchema/oneOf/2",
+        "path_kind": "branch"
       },
-      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose": "A recursively typed array output with canonical byte and item-count ceilings.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/inputName",
+        "local_reference": "#/$defs/outputArray",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -48812,43 +49036,49 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "keyword": "required",
+          "value": [
+            "type",
+            "nullable",
+            "max_bytes",
+            "max_items",
+            "items"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/inputName"
+        "pointer": "/$defs/outputArray"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/protocol/properties/signed_dci/properties/sender",
+        "pointer": "/$defs/protocol/properties/signed_dci",
         "path_kind": "property"
       },
-      "purpose": "Declares the signed DCI sender identifier included in protocol requests.",
+      "purpose": "Enables the bounded signed DCI search helper and declares its protocol and selector bindings.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -48913,27 +49143,33 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "profile",
+            "path",
+            "jwks_profile",
+            "sender",
+            "receiver",
+            "registry_type",
+            "record_type",
+            "locale",
+            "selectors"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/jwks_profile",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Selects the supported RSA signing-key-set profile used to verify signed DCI responses.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -48941,14 +49177,14 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -49004,45 +49240,40 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
+          "keyword": "const",
+          "value": "rsa-signing-jwks-v1"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/locale",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Declares the language or locale tag carried by signed DCI search requests.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -49098,36 +49329,121 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 2
-        },
-        {
-          "keyword": "minItems",
-          "value": 2
+          "keyword": "pattern",
+          "value": "^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$"
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/path",
+        "path_kind": "property"
+      },
+      "purpose": "Declares the exact private source path used for signed DCI search requests.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^/[^?#]*$"
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
-        "path_kind": "array_item"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/profile",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Selects the supported DCI search request profile used by the signed protocol helper.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -49135,7 +49451,7 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -49198,38 +49514,35 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
+          "keyword": "const",
+          "value": "dci-search-v1"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
-        "path_kind": "array_item"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/receiver",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Declares the signed DCI receiver identifier included in protocol requests.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49290,36 +49603,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "null"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/allow",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/record_type",
         "path_kind": "property"
       },
-      "purpose": "Constrains source access to the explicitly reviewed method and path templates in this integration contract.",
+      "purpose": "Declares the record type requested through the signed DCI search profile.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49384,40 +49704,39 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
+          "keyword": "maxLength",
+          "value": 128
         },
         {
-          "keyword": "minItems",
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/allow/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/registry_type",
+        "path_kind": "property"
       },
-      "purpose": "One read-only upstream method and path pattern the adapter may call.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares the registry type requested through the signed DCI search profile.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/allowRule",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49478,34 +49797,30 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "method",
-            "path"
-          ]
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/allowRule"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/auth",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors",
         "path_kind": "property"
       },
-      "purpose": "Declares the credential interface the source contract permits without embedding an environment credential value.",
+      "purpose": "Maps every selector input to its signed DCI request field and response location.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -49514,7 +49829,6 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/credential",
         "composed": false
       },
       "requiredness": "required",
@@ -49582,32 +49896,41 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/credential"
-      }
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 8
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/product",
-        "path_kind": "property"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Names the source product whose version labels are classified by this integration contract.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49668,44 +49991,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "field",
+            "response_pointer"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/protocol",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/field",
         "path_kind": "property"
       },
-      "purpose": "Optional interoperable protocol profiles layered over the source transport.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares the signed DCI identifier field bound to one selector input.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/protocol",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49770,39 +50092,39 @@
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
+          "keyword": "maxLength",
+          "value": 160
+        },
+        {
+          "keyword": "minLength",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/protocol"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/request_headers",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/response_pointer",
         "path_kind": "property"
       },
-      "purpose": "Lists the bounded source request header names available to the integration adapter.",
+      "purpose": "Selects the canonical signed-record response location used to recover one selector value.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -49867,27 +50189,23 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 32
+          "keyword": "pattern",
+          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/request_headers/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -49895,6 +50213,7 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/inputName",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -49961,39 +50280,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/response",
+        "pointer": "/$defs/protocol/properties/signed_dci/properties/sender",
         "path_kind": "property"
       },
-      "purpose": "Defines the reviewed source response representation and optional byte bound.",
+      "purpose": "Declares the signed DCI sender identifier included in protocol requests.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -50057,19 +50380,27 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/response/properties/format",
+        "pointer": "/$defs/scalarOutput/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Selects JSON decoding or text handling for reviewed source responses.",
+      "purpose": "Applies the full-date semantic format to a string-valued integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -50145,39 +50476,33 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "json",
-            "text"
-          ]
+          "keyword": "const",
+          "value": "date"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/response/properties/max_bytes",
+        "pointer": "/$defs/scalarOutput/properties/maxLength",
         "path_kind": "property"
       },
-      "purpose": "Maximum bytes accepted from one source response, defaulting to 512 KiB and capped at 8 MiB. Use a positive byte integer or canonical KiB/MiB value.",
-      "purpose_source": "schema_description",
+      "purpose": "Caps the character length produced for a string-valued integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/integrationResponseByteSize",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "schema_value": "512KiB"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "internal",
@@ -50238,26 +50563,35 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/integrationResponseByteSize"
-      }
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 16384
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/response_headers",
+        "pointer": "/$defs/scalarOutput/properties/maximum",
         "path_kind": "property"
       },
-      "purpose": "Lists the bounded source response header names available to the integration adapter.",
+      "purpose": "Sets the inclusive upper bound produced for an integer-valued integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -50328,39 +50662,39 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 32
+          "keyword": "maximum",
+          "value": 9223372036854775807
         },
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/response_headers/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/scalarOutput/properties/minimum",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Sets the inclusive lower bound produced for an integer-valued integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -50421,39 +50755,42 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/source/properties/versions",
+        "pointer": "/$defs/scalarOutput/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Source versions tested by the project and versions explicitly accepted as unverified.",
+      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/versions",
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50518,25 +50855,20 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
+      "constraints": [],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/versions"
+        "pointer": "/$defs/scalarType"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/versionList/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/scalarOutput/properties/x-registry-source",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Selects the canonical source-response location from which the HTTP output is extracted.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -50546,7 +50878,7 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
@@ -50609,17 +50941,12 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "pattern",
+          "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$"
         },
         {
           "keyword": "type",
@@ -50630,11 +50957,11 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/scalarOutputSchema/properties/format",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Applies the full-date semantic format to a string-valued field inside a structured integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -50642,14 +50969,14 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -50705,34 +51032,33 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "tested"
-          ]
+          "keyword": "const",
+          "value": "date"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/0/properties/tested",
+        "pointer": "/$defs/scalarOutputSchema/properties/maxLength",
         "path_kind": "property"
       },
-      "purpose": "Requires at least one source product version to be classified as tested in this integration contract.",
+      "purpose": "Caps the character length produced for a string-valued field inside a structured integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50799,117 +51125,37 @@
       ],
       "constraints": [
         {
-          "keyword": "minItems",
+          "keyword": "maximum",
+          "value": 16384
+        },
+        {
+          "keyword": "minimum",
           "value": 1
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "integration_contract",
-      "human_owner": "integration_maintainers",
-      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "notary",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "fixture_execution",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.integration.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "registry_notary",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "notary_config",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "security",
-        "privacy",
-        "relay",
-        "notary",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
+        },
         {
-          "keyword": "required",
-          "value": [
-            "unverified"
-          ]
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/versions/anyOf/1/properties/unverified",
+        "pointer": "/$defs/scalarOutputSchema/properties/maximum",
         "path_kind": "property"
       },
-      "purpose": "Requires at least one source product version to be classified as unverified in this integration contract.",
+      "purpose": "Sets the inclusive upper bound produced for an integer-valued field inside a structured integration output.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -50976,27 +51222,34 @@
       ],
       "constraints": [
         {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/versions/properties/tested",
+        "pointer": "/$defs/scalarOutputSchema/properties/minimum",
         "path_kind": "property"
       },
-      "purpose": "Bounded list of source version labels.",
-      "purpose_source": "schema_description",
+      "purpose": "Sets the inclusive lower bound produced for an integer-valued field inside a structured integration output.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
-        "local_reference": "#/$defs/versionList",
         "composed": false
       },
       "requiredness": "optional",
@@ -51066,30 +51319,26 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 32
+          "keyword": "maximum",
+          "value": 9223372036854775807
         },
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/versionList"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/$defs/versions/properties/unverified",
+        "pointer": "/$defs/scalarOutputSchema/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Bounded list of source version labels.",
+      "purpose": "Supported scalar type, optionally paired with null for nullable values.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -51098,10 +51347,10 @@
         "schema_types": [
           "array"
         ],
-        "local_reference": "#/$defs/versionList",
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -51166,51 +51415,35 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 32
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
-        }
-      ],
+      "constraints": [],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/versionList"
+        "pointer": "/$defs/scalarType"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/capability",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Exactly one bounded execution mechanism for the source adaptation.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/capability",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -51266,40 +51499,45 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/capability"
-      }
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/id",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Stable project-local identifier for the integration.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -51355,41 +51593,44 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "maxItems",
+          "value": 2
+        },
+        {
+          "keyword": "minItems",
+          "value": 2
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/input",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
+        "path_kind": "array_item"
       },
-      "purpose": "Typed selector and parameter inputs accepted by this integration.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -51452,39 +51693,33 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/input/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
+        "path_kind": "array_item"
       },
-      "purpose": "Type, validation, and canonicalization rules for one authored input.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/input",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -51551,47 +51786,35 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "role",
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "null"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/input"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/input/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/source/properties/allow",
+        "path_kind": "property"
       },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
+      "purpose": "Constrains source access to the explicitly reviewed method and path templates in this integration contract.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -51652,31 +51875,30 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "keyword": "maxItems",
+          "value": 16
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/limits",
-        "path_kind": "property"
+        "pointer": "/$defs/source/properties/allow/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Optional tighter resource limits for one integration execution.",
+      "purpose": "One read-only upstream method and path pattern the adapter may call.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
@@ -51685,10 +51907,10 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/limits",
+        "local_reference": "#/$defs/allowRule",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -51751,9 +51973,17 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "method",
+            "path"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
@@ -51761,17 +51991,17 @@
       ],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/limits"
+        "pointer": "/$defs/allowRule"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/not_applicable",
+        "pointer": "/$defs/source/properties/auth",
         "path_kind": "property"
       },
-      "purpose": "Explicit rationale and request-fixture evidence for a normally required outcome that the source contract cannot produce.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares the credential interface the source contract permits without embedding an environment credential value.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -51779,10 +52009,10 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/notApplicable",
+        "local_reference": "#/$defs/credential",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -51847,42 +52077,32 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "minProperties",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
+      "constraints": [],
       "local_reference": {
         "schema": "integration",
-        "pointer": "/$defs/notApplicable"
+        "pointer": "/$defs/credential"
       }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs",
+        "pointer": "/$defs/source/properties/product",
         "path_kind": "property"
       },
-      "purpose": "Named typed outputs, or a shorthand list of output names inferred by the authoring compiler.",
-      "purpose_source": "schema_description",
+      "purpose": "Names the source product whose version labels are classified by this integration contract.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "array",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -51945,16 +52165,29 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/protocol",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Optional interoperable protocol profiles layered over the source transport.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -51962,16 +52195,17 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/protocol",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -52027,14 +52261,9 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
         {
           "keyword": "minProperties",
           "value": 1
@@ -52043,27 +52272,30 @@
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/protocol"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/source/properties/request_headers",
+        "path_kind": "property"
       },
-      "purpose": "Type and optional source pointer for one normalized integration output.",
-      "purpose_source": "schema_description",
+      "purpose": "Lists the bounded source request header names available to the integration adapter.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/output",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -52126,44 +52358,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
+          "keyword": "maxItems",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/output"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/source/properties/request_headers/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
-        "composed": true
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -52225,36 +52456,44 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/response",
+        "path_kind": "property"
       },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the reviewed source response representation and optional byte bound.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/inputName",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -52310,32 +52549,23 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/response/properties/format",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Selects JSON decoding or text handling for reviewed source responses.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -52343,14 +52573,14 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -52406,34 +52636,46 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "json",
+            "text"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1/not",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/response/properties/max_bytes",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Maximum bytes accepted from one source response, defaulting to 512 KiB and capped at 8 MiB. Use a positive byte integer or canonical KiB/MiB value.",
+      "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer",
+          "string"
+        ],
+        "local_reference": "#/$defs/integrationResponseByteSize",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "schema_value": "512KiB"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -52489,27 +52731,22 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "matched",
-            "outcome"
-          ]
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/integrationResponseByteSize"
+      }
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/source/properties/response_headers",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lists the bounded source response header names available to the integration adapter.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -52519,14 +52756,14 @@
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -52582,17 +52819,12 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "maxItems",
-          "value": 64
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
+          "value": 32
         },
         {
           "keyword": "type",
@@ -52607,11 +52839,11 @@
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/outputs/oneOf/1/items",
+        "pointer": "/$defs/source/properties/response_headers/items",
         "path_kind": "array_item"
       },
-      "purpose": "Portable lowercase name for an integration input or output.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
@@ -52619,7 +52851,6 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/inputName",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -52691,36 +52922,2287 @@
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "integration",
-        "pointer": "/$defs/inputName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "integration",
-        "pointer": "/properties/revision",
+        "pointer": "/$defs/source/properties/versions",
         "path_kind": "property"
       },
-      "purpose": "Monotonically increasing revision of this integration contract.",
+      "purpose": "Source versions tested by the project and versions explicitly accepted as unverified.",
       "purpose_source": "schema_description",
       "semantic_owner": "integration_contract",
       "human_owner": "integration_maintainers",
       "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/versions",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/versions"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versionList/items",
+        "path_kind": "array_item"
+      },
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versions/anyOf/0",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "tested"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versions/anyOf/0/properties/tested",
+        "path_kind": "property"
+      },
+      "purpose": "Requires at least one source product version to be classified as tested in this integration contract.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "minItems",
+          "value": 1
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versions/anyOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "unverified"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versions/anyOf/1/properties/unverified",
+        "path_kind": "property"
+      },
+      "purpose": "Requires at least one source product version to be classified as unverified in this integration contract.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "minItems",
+          "value": 1
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versions/properties/tested",
+        "path_kind": "property"
+      },
+      "purpose": "Bounded list of source version labels.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "local_reference": "#/$defs/versionList",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxItems",
+          "value": 32
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/versionList"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/$defs/versions/properties/unverified",
+        "path_kind": "property"
+      },
+      "purpose": "Bounded list of source version labels.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "local_reference": "#/$defs/versionList",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxItems",
+          "value": 32
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/versionList"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/capability",
+        "path_kind": "property"
+      },
+      "purpose": "Exactly one bounded execution mechanism for the source adaptation.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/capability",
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/capability"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/id",
+        "path_kind": "property"
+      },
+      "purpose": "Stable project-local identifier for the integration.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/stableId"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/input",
+        "path_kind": "property"
+      },
+      "purpose": "Typed selector and parameter inputs accepted by this integration.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 16
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/input/additionalProperties",
+        "path_kind": "map_value"
+      },
+      "purpose": "Type, validation, and canonicalization rules for one authored input.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/input",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "role",
+            "type"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/input"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/input/propertyNames",
+        "path_kind": "map_key"
+      },
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/inputName",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/limits",
+        "path_kind": "property"
+      },
+      "purpose": "Optional tighter resource limits for one integration execution.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/limits",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/limits"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/not_applicable",
+        "path_kind": "property"
+      },
+      "purpose": "Explicit rationale and request-fixture evidence for a normally required outcome that the source contract cannot produce.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/notApplicable",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "minProperties",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/notApplicable"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs",
+        "path_kind": "property"
+      },
+      "purpose": "Named typed outputs, or a shorthand list of output names inferred by the authoring compiler.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "array",
+          "object"
+        ],
+        "composed": true
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": []
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/0",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 64
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/0/additionalProperties",
+        "path_kind": "map_value"
+      },
+      "purpose": "A bounded scalar or recursively closed structured schema for one normalized integration output.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "local_reference": "#/$defs/output",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
+      "constraints": [],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/output"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/0/propertyNames",
+        "path_kind": "map_key"
+      },
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": true
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "arbitrary_map_keys_not_fixed_properties"
+      ],
+      "constraints": []
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/0",
+        "path_kind": "branch"
+      },
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/inputName",
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": []
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1/not",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "matched",
+            "outcome"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxItems",
+          "value": 64
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/outputs/oneOf/1/items",
+        "path_kind": "array_item"
+      },
+      "purpose": "Portable lowercase name for an integration input or output.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/inputName",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "notary",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "fixture_execution",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.integration.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "registry_notary",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "notary_config",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "security",
+        "privacy",
+        "relay",
+        "notary",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "integration",
+        "pointer": "/$defs/inputName"
+      }
+    },
+    {
+      "address": {
+        "schema": "integration",
+        "pointer": "/properties/revision",
+        "path_kind": "property"
+      },
+      "purpose": "Monotonically increasing revision of this integration contract.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "integration_contract",
+      "human_owner": "integration_maintainers",
+      "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.",
+      "field_type": {
+        "schema_types": [
+          "integer"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -53557,21 +56039,416 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted"
+      ],
+      "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 8
+        },
+        {
+          "keyword": "pattern",
+          "value": "^bodies/(?!\\.\\.?/)(?!.*(?:/)\\.\\.?/)(?!.*//).+$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody/oneOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "fixture_execution"
+      ],
+      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "consumers": [
+        "registryctl_authoring",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "privacy",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": []
+    },
+    {
+      "address": {
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody/oneOf/1/not",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "fixture_execution"
+      ],
+      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "consumers": [
+        "registryctl_authoring",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "privacy",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "file"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedClaimRef/oneOf/0",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "fixture_execution"
+      ],
+      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "consumers": [
+        "registryctl_authoring",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "privacy",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedClaimRef/oneOf/1",
+        "path_kind": "branch"
+      },
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "composed": false
+      },
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "environment_independent",
+      "sensitivity": "structural",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "fixture_execution"
+      ],
+      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "consumers": [
+        "registryctl_authoring",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "privacy",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 8
+          "keyword": "required",
+          "value": [
+            "id"
+          ]
         },
         {
-          "keyword": "pattern",
-          "value": "^bodies/(?!\\.\\.?/)(?!.*(?:/)\\.\\.?/)(?!.*//).+$"
-        },
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedClaimRef/oneOf/1/properties/id",
+        "path_kind": "property"
+      },
+      "purpose": "Names one authored claim requested by this fixture witness.",
+      "purpose_source": "schema_description",
+      "semantic_owner": "fixture_harness",
+      "human_owner": "test_maintainers",
+      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "environment_independent",
+      "sensitivity": "redacted_fixture",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "fixture_execution"
+      ],
+      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "update_fixtures",
+      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "consumers": [
+        "registryctl_authoring",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "fixture_report",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "privacy",
+        "compatibility",
+        "documentation",
+        "testing"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted"
+      ],
+      "constraints": [
         {
           "keyword": "type",
           "value": "string"
@@ -53581,26 +56458,28 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/fixtureBody/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/governedClaimRef/oneOf/1/properties/version",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Pins the requested claim to one authored claim-policy version.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -53645,35 +56524,40 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/fixtureBody/oneOf/1/not",
-        "path_kind": "branch"
+        "pointer": "/$defs/governedIdentifier/properties/scheme",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Names the authored identifier scheme selected by a consultation input mapping.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -53718,29 +56602,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "file"
-          ]
+          "keyword": "maxLength",
+          "value": 96
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/governedIdentifier/properties/value",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Supplies the synthetic string value bound to this identifier scheme.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -53750,14 +56636,14 @@
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -53802,7 +56688,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
@@ -53814,28 +56700,28 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/governedRequest/properties/claims",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Lists the authored claims evaluated by this synthetic request witness.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -53880,39 +56766,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
+          "keyword": "maxItems",
+          "value": 64
+        },
+        {
+          "keyword": "minItems",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/1/properties/id",
-        "path_kind": "property"
+        "pointer": "/$defs/governedRequest/properties/claims/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Names one authored claim requested by this fixture witness.",
+      "purpose": "A requested claim ID, optionally pinned to one authored claim version.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
+          "object",
           "string"
         ],
+        "local_reference": "#/$defs/governedClaimRef",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
@@ -53964,22 +56854,22 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "array_items_share_element_contract"
       ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedClaimRef"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef/oneOf/1/properties/version",
+        "pointer": "/$defs/governedRequest/properties/disclosure",
         "path_kind": "property"
       },
-      "purpose": "Pins the requested claim to one authored claim-policy version.",
+      "purpose": "Selects the disclosure mode requested from the authored claim policy.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
@@ -54054,10 +56944,10 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedIdentifier/properties/scheme",
+        "pointer": "/$defs/governedRequest/properties/format",
         "path_kind": "property"
       },
-      "purpose": "Names the authored identifier scheme selected by a consultation input mapping.",
+      "purpose": "Selects the claim-result media type requested from the governed Notary path.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
@@ -54068,9 +56958,9 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54123,14 +57013,6 @@
         "synthetic_fixture_value_redacted"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 96
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -54140,10 +57022,10 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedIdentifier/properties/value",
+        "pointer": "/$defs/governedRequest/properties/purpose",
         "path_kind": "property"
       },
-      "purpose": "Supplies the synthetic string value bound to this identifier scheme.",
+      "purpose": "Names the authored service purpose exercised by this synthetic request witness.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
@@ -54156,7 +57038,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54209,6 +57091,14 @@
         "synthetic_fixture_value_redacted"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -54218,18 +57108,19 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/claims",
+        "pointer": "/$defs/governedRequest/properties/target",
         "path_kind": "property"
       },
-      "purpose": "Lists the authored claims evaluated by this synthetic request witness.",
+      "purpose": "The synthetic subject target presented to the same governed request boundary as a live Notary evaluation.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/governedTarget",
         "composed": false
       },
       "requiredness": "required",
@@ -54288,41 +57179,41 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 64
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "type"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedTarget"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/claims/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/governedRequest/properties/variables",
+        "path_kind": "property"
       },
-      "purpose": "A requested claim ID, optionally pinned to one authored claim version.",
+      "purpose": "Supplies synthetic date variables to the governed evaluation request.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object",
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/governedClaimRef",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54372,23 +57263,27 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedClaimRef"
-      }
+      "constraints": [
+        {
+          "keyword": "maxProperties",
+          "value": 16
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/disclosure",
-        "path_kind": "property"
+        "pointer": "/$defs/governedRequest/properties/variables/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Selects the disclosure mode requested from the authored claim policy.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -54398,7 +57293,7 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
@@ -54450,9 +57345,14 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "date"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -54462,23 +57362,21 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/format",
-        "path_kind": "property"
+        "pointer": "/$defs/governedRequest/properties/variables/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Selects the claim-result media type requested from the governed Notary path.",
-      "purpose_source": "schema_description",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54528,35 +57426,36 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/purpose",
+        "pointer": "/$defs/governedTarget/properties/attributes",
         "path_kind": "property"
       },
-      "purpose": "Names the authored service purpose exercised by this synthetic request witness.",
+      "purpose": "Supplies independently authored typed target attributes for consultation input mapping.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54610,40 +57509,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/target",
-        "path_kind": "property"
+        "pointer": "/$defs/governedTarget/properties/attributes/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "The synthetic subject target presented to the same governed request boundary as a live Notary evaluation.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean",
+          "integer",
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/governedTarget",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54693,45 +57590,41 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "type"
+            "string",
+            "boolean",
+            "integer",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedTarget"
-      }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/variables",
+        "pointer": "/$defs/governedTarget/properties/id",
         "path_kind": "property"
       },
-      "purpose": "Supplies synthetic date variables to the governed evaluation request.",
+      "purpose": "Supplies an optional synthetic direct target identifier.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54784,36 +57677,32 @@
         "synthetic_fixture_value_redacted"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 16
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/variables/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/governedTarget/properties/identifiers",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Supplies independently authored synthetic identifiers for consultation input mapping.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -54863,33 +57752,35 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "date"
+          "keyword": "maxItems",
+          "value": 16
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedRequest/properties/variables/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/governedTarget/properties/identifiers/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "One synthetic target identifier with an authored scheme and string value.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/governedIdentifier",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -54945,35 +57836,46 @@
         "knowledge_only",
         "generated_docs_never_load_country_values",
         "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "scheme",
+            "value"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedIdentifier"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/attributes",
+        "pointer": "/$defs/governedTarget/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Supplies independently authored typed target attributes for consultation input mapping.",
+      "purpose": "Names the authored target entity type used for claim evaluation.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55027,38 +57929,40 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "maxLength",
+          "value": 64
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/attributes/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/interaction/properties/expect",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Exact HTTP request shape the adapter must produce.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "boolean",
-          "integer",
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/request",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55108,41 +58012,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
+            "method",
+            "path"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/request"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/id",
+        "pointer": "/$defs/interaction/properties/respond",
         "path_kind": "property"
       },
-      "purpose": "Supplies an optional synthetic direct target identifier.",
+      "purpose": "Synthetic HTTP response or timeout returned to the adapter.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/response",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55194,28 +58104,28 @@
         "generated_docs_never_load_country_values",
         "synthetic_fixture_value_redacted"
       ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/response"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/identifiers",
+        "pointer": "/$defs/request/properties/body",
         "path_kind": "property"
       },
-      "purpose": "Supplies independently authored synthetic identifiers for consultation input mapping.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the synthetic request body expectation or fixture-local file reference without reading a source.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/fixtureBody",
         "composed": false
       },
       "requiredness": "optional",
@@ -55272,25 +58182,20 @@
         "generated_docs_never_load_country_values",
         "synthetic_fixture_value_redacted"
       ],
-      "constraints": [
-        {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/identifiers/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/request/properties/headers",
+        "path_kind": "property"
       },
-      "purpose": "One synthetic target identifier with an authored scheme and string value.",
-      "purpose_source": "schema_description",
+      "purpose": "States the synthetic request headers expected from one offline fixture interaction.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -55298,10 +58203,9 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/governedIdentifier",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -55353,35 +58257,27 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "scheme",
-            "value"
-          ]
+          "keyword": "maxProperties",
+          "value": 32
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedIdentifier"
-      }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/governedTarget/properties/type",
-        "path_kind": "property"
+        "pointer": "/$defs/request/properties/headers/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Names the authored target entity type used for claim evaluation.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -55391,9 +58287,9 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55443,16 +58339,13 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
           "keyword": "maxLength",
-          "value": 64
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "value": 8192
         },
         {
           "keyword": "type",
@@ -55463,22 +58356,19 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/interaction/properties/expect",
-        "path_kind": "property"
+        "pointer": "/$defs/request/properties/headers/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Exact HTTP request shape the adapter must produce.",
-      "purpose_source": "schema_description",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/request",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -55530,123 +58420,32 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "method",
-            "path"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "pattern",
+          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
         }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/request"
-      }
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/$defs/interaction/properties/respond",
-        "path_kind": "property"
-      },
-      "purpose": "Synthetic HTTP response or timeout returned to the adapter.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/response",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
-      ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/response"
-      }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/body",
+        "pointer": "/$defs/request/properties/method",
         "path_kind": "property"
       },
-      "purpose": "Defines the synthetic request body expectation or fixture-local file reference without reading a source.",
+      "purpose": "States the synthetic request method expected from the offline integration fixture.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/fixtureBody",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -55700,32 +58499,36 @@
         "generated_docs_never_load_country_values",
         "synthetic_fixture_value_redacted"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody"
-      }
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "GET",
+            "POST"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/headers",
+        "pointer": "/$defs/request/properties/path",
         "path_kind": "property"
       },
-      "purpose": "States the synthetic request headers expected from one offline fixture interaction.",
+      "purpose": "States the synthetic request path expected from the offline integration fixture.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55779,35 +58582,43 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
+          "keyword": "maxLength",
+          "value": 4096
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^/[^?#]*$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/headers/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/request/properties/query",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "States the synthetic query parameters expected from one offline fixture interaction.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55857,38 +58668,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 8192
+          "keyword": "maxProperties",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/headers/propertyNames",
-        "path_kind": "map_key"
+        "pointer": "/$defs/request/properties/query/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
-        "composed": false
+        "schema_types": [
+          "array",
+          "boolean",
+          "integer",
+          "null",
+          "string"
+        ],
+        "composed": true
       },
       "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -55941,36 +58757,36 @@
         "synthetic_fixture_value_redacted",
         "arbitrary_map_keys_not_fixed_properties"
       ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/method",
-        "path_kind": "property"
+        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "States the synthetic request method expected from the offline integration fixture.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "boolean",
+          "integer",
+          "null",
+          "string"
+        ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56015,14 +58831,16 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "GET",
-            "POST"
+            "string",
+            "boolean",
+            "integer",
+            "null"
           ]
         }
       ]
@@ -56030,28 +58848,28 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/path",
-        "path_kind": "property"
+        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "States the synthetic request path expected from the offline integration fixture.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56096,47 +58914,42 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 4096
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
-        },
-        {
-          "keyword": "pattern",
-          "value": "^/[^?#]*$"
+          "keyword": "maxItems",
+          "value": 64
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/query",
-        "path_kind": "property"
+        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1/items",
+        "path_kind": "array_item"
       },
-      "purpose": "States the synthetic query parameters expected from one offline fixture interaction.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean",
+          "integer",
+          "null",
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -56186,48 +58999,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxProperties",
-          "value": 64
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "boolean",
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/$defs/response/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "array",
-          "boolean",
-          "integer",
-          "null",
-          "string"
+          "object"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56272,39 +59083,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "branch_has_no_authored_value"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "status"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/response/oneOf/0/properties/body",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Defines the synthetic response body returned by the offline fixture harness to the integration.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "boolean",
-          "integer",
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/fixtureBody",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56349,45 +59168,39 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/fixtureBody"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/$defs/response/oneOf/0/properties/headers",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Defines the synthetic HTTP response headers returned by the offline fixture harness.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56432,41 +59245,38 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 64
+          "keyword": "maxProperties",
+          "value": 32
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1/items",
-        "path_kind": "array_item"
+        "pointer": "/$defs/response/oneOf/0/properties/headers/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "boolean",
-          "integer",
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "not_applicable",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
@@ -56518,45 +59328,44 @@
         "knowledge_only",
         "generated_docs_never_load_country_values",
         "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 8192
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/$defs/response/oneOf/0/properties/status",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Selects the synthetic HTTP status returned by the offline fixture harness.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56601,29 +59410,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "status"
-          ]
+          "keyword": "maximum",
+          "value": 599
+        },
+        {
+          "keyword": "minimum",
+          "value": 100
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/body",
-        "path_kind": "property"
+        "pointer": "/$defs/response/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Defines the synthetic response body returned by the offline fixture harness to the integration.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -56631,17 +59442,16 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/fixtureBody",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56686,34 +59496,41 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "branch_has_no_authored_value"
       ],
-      "constraints": [],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/fixtureBody"
-      }
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "timeout"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/headers",
+        "pointer": "/$defs/response/oneOf/1/properties/timeout",
         "path_kind": "property"
       },
-      "purpose": "Defines the synthetic HTTP response headers returned by the offline fixture harness.",
+      "purpose": "Records bounded synthetic timeout intent; offline execution returns the timeout outcome without waiting for the authored interval.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -56767,40 +59584,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 32
+          "keyword": "pattern",
+          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/headers/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/properties/classification",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Declares that fixture data is synthetic and safe for offline testing.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
@@ -56844,36 +59659,31 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 8192
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "const",
+          "value": "synthetic"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/0/properties/status",
+        "pointer": "/properties/expect",
         "path_kind": "property"
       },
-      "purpose": "Selects the synthetic HTTP status returned by the offline fixture harness.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Observable adapter result required for the scenario to pass.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/expectation",
         "composed": false
       },
       "requiredness": "required",
@@ -56932,27 +59742,27 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 599
-        },
-        {
-          "keyword": "minimum",
-          "value": 100
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/expectation"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/properties/input",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Typed consultation inputs supplied to the adapter under test.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -56962,14 +59772,14 @@
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "structural",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -57014,14 +59824,16 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "timeout"
-          ]
+          "keyword": "maxProperties",
+          "value": 16
+        },
+        {
+          "keyword": "minProperties",
+          "value": 1
         },
         {
           "keyword": "type",
@@ -57032,23 +59844,26 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/$defs/response/oneOf/1/properties/timeout",
-        "path_kind": "property"
+        "pointer": "/properties/input/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Records bounded synthetic timeout intent; offline execution returns the timeout outcome without waiting for the authored interval.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
+          "boolean",
+          "integer",
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -57098,27 +59913,29 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,3}|1[0-9]{4}|20000)ms|(?:[1-9]|1[0-9]|20)s)$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "boolean",
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/classification",
-        "path_kind": "property"
+        "pointer": "/properties/input/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Declares that fixture data is synthetic and safe for offline testing.",
-      "purpose_source": "schema_description",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -57126,14 +59943,14 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "public",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -57177,31 +59994,32 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "synthetic"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/expect",
+        "pointer": "/properties/interactions",
         "path_kind": "property"
       },
-      "purpose": "Observable adapter result required for the scenario to pass.",
+      "purpose": "Ordered upstream request and response exchanges expected during execution.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/expectation",
         "composed": false
       },
       "requiredness": "required",
@@ -57260,26 +60078,26 @@
       ],
       "constraints": [
         {
-          "keyword": "minProperties",
+          "keyword": "maxItems",
+          "value": 16
+        },
+        {
+          "keyword": "minItems",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/expectation"
-      }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/input",
-        "path_kind": "property"
+        "pointer": "/properties/interactions/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Typed consultation inputs supplied to the adapter under test.",
+      "purpose": "One expected upstream request paired with its synthetic response.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
@@ -57288,9 +60106,10 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/interaction",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -57342,133 +60161,52 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
-        },
-        {
-          "keyword": "minProperties",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "expect",
+            "respond"
+          ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/interaction"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/input/additionalProperties",
-        "path_kind": "map_value"
+        "pointer": "/properties/name",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Human-readable scenario name shown in test output.",
+      "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "boolean",
-          "integer",
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "fixture_execution"
-      ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
-      "consumers": [
-        "registryctl_authoring",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "fixture_report",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "compatibility",
-        "documentation",
-        "testing"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "boolean",
-            "integer",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "fixture",
-        "pointer": "/properties/input/propertyNames",
-        "path_kind": "map_key"
-      },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
@@ -57488,7 +60226,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "update_fixtures",
@@ -57512,35 +60250,42 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/interactions",
+        "pointer": "/properties/request",
         "path_kind": "property"
       },
-      "purpose": "Ordered upstream request and response exchanges expected during execution.",
+      "purpose": "Optional independently authored synthetic Notary request used to prove the request-to-consultation binding before Relay access.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/governedRequest",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -57596,26 +60341,30 @@
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 16
-        },
-        {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "target",
+            "claims",
+            "purpose"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "fixture",
+        "pointer": "/$defs/governedRequest"
+      }
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/interactions/items",
-        "path_kind": "array_item"
+        "pointer": "/properties/variables",
+        "path_kind": "property"
       },
-      "purpose": "One expected upstream request paired with its synthetic response.",
+      "purpose": "Named date values available to deterministic fixture interpolation.",
       "purpose_source": "schema_description",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
@@ -57624,10 +60373,9 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/interaction",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -57679,35 +60427,27 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "array_items_share_element_contract"
+        "synthetic_fixture_value_redacted"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "expect",
-            "respond"
-          ]
+          "keyword": "maxProperties",
+          "value": 16
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/interaction"
-      }
+      ]
     },
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/name",
-        "path_kind": "property"
+        "pointer": "/properties/variables/additionalProperties",
+        "path_kind": "map_value"
       },
-      "purpose": "Human-readable scenario name shown in test output.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
@@ -57717,14 +60457,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "environment_independent",
-      "sensitivity": "public",
+      "sensitivity": "redacted_fixture",
       "state": "authored",
       "products": [
         "registryctl",
@@ -57744,7 +60484,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": true,
+        "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "update_fixtures",
@@ -57768,16 +60508,14 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
-        },
-        {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "format",
+          "value": "date"
         },
         {
           "keyword": "type",
@@ -57788,22 +60526,19 @@
     {
       "address": {
         "schema": "fixture",
-        "pointer": "/properties/request",
-        "path_kind": "property"
+        "pointer": "/properties/variables/propertyNames",
+        "path_kind": "map_key"
       },
-      "purpose": "Optional independently authored synthetic Notary request used to prove the request-to-consultation binding before Relay access.",
-      "purpose_source": "schema_description",
+      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "fixture_harness",
       "human_owner": "test_maintainers",
       "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/governedRequest",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -57855,55 +60590,45 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "synthetic_fixture_value_redacted",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "target",
-            "claims",
-            "purpose"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         }
-      ],
-      "local_reference": {
-        "schema": "fixture",
-        "pointer": "/$defs/governedRequest"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "fixture",
-        "pointer": "/properties/variables",
-        "path_kind": "property"
+        "schema": "entity",
+        "pointer": "",
+        "path_kind": "root"
       },
-      "purpose": "Named date values available to deterministic fixture interpolation.",
+      "purpose": "Defines a bounded, materialized entity that Relay can query without coupling the project to a specific source product.",
       "purpose_source": "schema_description",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
           "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
+        "relay",
         "editor",
         "docs"
       ],
@@ -57912,45 +60637,54 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "fixture_execution"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
-        "schema_examples_available": false,
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": true,
         "contains_country_values": false
       },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
+        "registry_relay",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "fixture_report",
+        "project_build",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
         "privacy",
+        "relay",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
-          "value": 16
+          "keyword": "required",
+          "value": [
+            "version",
+            "id",
+            "revision",
+            "primary_key",
+            "schema",
+            "materialization"
+          ]
         },
         {
           "keyword": "type",
@@ -57960,32 +60694,31 @@
     },
     {
       "address": {
-        "schema": "fixture",
-        "pointer": "/properties/variables/additionalProperties",
-        "path_kind": "map_value"
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/const",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "purpose": "Requires one entity field to equal the single authored value supplied by this schema constraint.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
+        "relay",
         "editor",
         "docs"
       ],
@@ -57994,79 +60727,74 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "fixture_execution"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
+        "registry_relay",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "fixture_report",
+        "project_build",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
         "privacy",
+        "relay",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "date"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
-        "schema": "fixture",
-        "pointer": "/properties/variables/propertyNames",
-        "path_kind": "map_key"
+        "schema": "entity",
+        "pointer": "/$defs/fieldSchema/properties/enum",
+        "path_kind": "property"
       },
-      "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "fixture_harness",
-      "human_owner": "test_maintainers",
-      "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.",
+      "purpose": "Restricts one entity field to the unique authored values listed by this schema constraint.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "array"
+        ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "environment_independent",
-      "sensitivity": "redacted_fixture",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
+        "relay",
         "editor",
         "docs"
       ],
@@ -58075,74 +60803,81 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "fixture_execution"
+        "cross_file_semantic",
+        "product_build"
       ],
-      "diagnostic": "registryctl.authoring.fixture.invalid",
+      "diagnostic": "registryctl.authoring.entity.invalid",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.",
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "update_fixtures",
-      "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.",
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
       "consumers": [
         "registryctl_authoring",
+        "registry_relay",
         "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
         "editor_schemas",
-        "fixture_report",
+        "project_build",
+        "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
         "privacy",
+        "relay",
         "compatibility",
-        "documentation",
-        "testing"
+        "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "synthetic_fixture_value_redacted",
-        "arbitrary_map_keys_not_fixed_properties"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "minItems",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "",
-        "path_kind": "root"
+        "pointer": "/$defs/fieldSchema/properties/format",
+        "path_kind": "property"
       },
-      "purpose": "Defines a bounded, materialized entity that Relay can query without coupling the project to a specific source product.",
-      "purpose_source": "schema_description",
+      "purpose": "Adds a reviewed semantic format constraint to one string-valued entity field.",
+      "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "object"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -58164,7 +60899,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
+        "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
@@ -58194,35 +60929,26 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "version",
-            "id",
-            "revision",
-            "primary_key",
-            "schema",
-            "materialization"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
+          "keyword": "const",
+          "value": "date"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/const",
+        "pointer": "/$defs/fieldSchema/properties/maxLength",
         "path_kind": "property"
       },
-      "purpose": "Requires one entity field to equal the single authored value supplied by this schema constraint.",
+      "purpose": "Caps the character length accepted for one string-valued entity field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "optional",
@@ -58282,22 +61008,35 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": []
+      "constraints": [
+        {
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
+        }
+      ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/enum",
+        "pointer": "/$defs/fieldSchema/properties/maximum",
         "path_kind": "property"
       },
-      "purpose": "Restricts one entity field to the unique authored values listed by this schema constraint.",
+      "purpose": "Sets the inclusive upper numeric bound accepted for one entity field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -58360,32 +61099,34 @@
       ],
       "constraints": [
         {
-          "keyword": "minItems",
-          "value": 1
+          "keyword": "maximum",
+          "value": 9007199254740991
         },
         {
-          "keyword": "type",
-          "value": "array"
+          "keyword": "minimum",
+          "value": -9007199254740991
         },
         {
-          "keyword": "uniqueItems",
-          "value": true
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/format",
+        "pointer": "/$defs/fieldSchema/properties/minLength",
         "path_kind": "property"
       },
-      "purpose": "Adds a reviewed semantic format constraint to one string-valued entity field.",
+      "purpose": "Sets the minimum character length accepted for one string-valued entity field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
       "requiredness": "optional",
@@ -58447,18 +61188,26 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "date"
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/maxLength",
+        "pointer": "/$defs/fieldSchema/properties/minimum",
         "path_kind": "property"
       },
-      "purpose": "Caps the character length accepted for one string-valued entity field.",
+      "purpose": "Sets the inclusive lower numeric bound accepted for one entity field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
@@ -58529,11 +61278,11 @@
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 65536
+          "value": 9007199254740991
         },
         {
           "keyword": "minimum",
-          "value": 1
+          "value": -9007199254740991
         },
         {
           "keyword": "type",
@@ -58544,23 +61293,23 @@
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/maximum",
+        "pointer": "/$defs/fieldSchema/properties/pattern",
         "path_kind": "property"
       },
-      "purpose": "Sets the inclusive upper numeric bound accepted for one entity field.",
+      "purpose": "Constrains a string-valued entity field with the authored regular expression.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -58617,37 +61366,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 9007199254740991
+          "keyword": "maxLength",
+          "value": 1024
         },
         {
-          "keyword": "minimum",
-          "value": -9007199254740991
+          "keyword": "minLength",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/minLength",
+        "pointer": "/$defs/fieldSchema/properties/type",
         "path_kind": "property"
       },
-      "purpose": "Sets the minimum character length accepted for one string-valued entity field.",
+      "purpose": "Declares the closed scalar, array, or object type accepted for one entity field.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
+        "local_reference": "#/$defs/scalarType",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -58704,39 +61454,28 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
+      "constraints": [],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/scalarType"
+      }
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/minimum",
+        "pointer": "/$defs/objectSchema/properties/additionalProperties",
         "path_kind": "property"
       },
-      "purpose": "Sets the inclusive lower numeric bound accepted for one entity field.",
+      "purpose": "Controls whether the entity object accepts fields outside its declared closed property set.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -58795,39 +61534,31 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 9007199254740991
-        },
-        {
-          "keyword": "minimum",
-          "value": -9007199254740991
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
+          "keyword": "const",
+          "value": false
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/pattern",
+        "pointer": "/$defs/objectSchema/properties/properties",
         "path_kind": "property"
       },
-      "purpose": "Constrains a string-valued entity field with the authored regular expression.",
+      "purpose": "Maps every declared entity property name to its closed field schema.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -58884,38 +61615,38 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 1024
+          "keyword": "maxProperties",
+          "value": 256
         },
         {
-          "keyword": "minLength",
+          "keyword": "minProperties",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/fieldSchema/properties/type",
+        "pointer": "/$defs/objectSchema/properties/properties/additionalProperties",
         "path_kind": "property"
       },
-      "purpose": "Declares the closed scalar, array, or object type accepted for one entity field.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Bounded schema keywords supported for one scalar materialized field.",
+      "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
-        "local_reference": "#/$defs/scalarType",
+        "local_reference": "#/$defs/fieldSchema",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -58972,30 +61703,44 @@
         "knowledge_only",
         "generated_docs_never_load_country_values"
       ],
-      "constraints": [],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "type"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
       "local_reference": {
         "schema": "entity",
-        "pointer": "/$defs/scalarType"
+        "pointer": "/$defs/fieldSchema"
       }
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/additionalProperties",
+        "pointer": "/$defs/objectSchema/properties/properties/propertyNames",
         "path_kind": "property"
       },
-      "purpose": "Controls whether the entity object accepts fields outside its declared closed property set.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Portable lowercase record field name.",
+      "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/propertyName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -59052,25 +61797,33 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": false
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/propertyName"
+      }
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/properties",
+        "pointer": "/$defs/objectSchema/properties/required",
         "path_kind": "property"
       },
-      "purpose": "Maps every declared entity property name to its closed field schema.",
+      "purpose": "Lists the entity properties that every validated materialized record must contain.",
       "purpose_source": "reviewed_override",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -59133,38 +61886,130 @@
       ],
       "constraints": [
         {
-          "keyword": "maxProperties",
+          "keyword": "maxItems",
           "value": 256
         },
         {
-          "keyword": "minProperties",
+          "keyword": "minItems",
           "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
+        },
+        {
+          "keyword": "uniqueItems",
+          "value": true
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/properties/additionalProperties",
-        "path_kind": "property"
+        "pointer": "/$defs/objectSchema/properties/required/items",
+        "path_kind": "array_item"
       },
-      "purpose": "Bounded schema keywords supported for one scalar materialized field.",
+      "purpose": "Portable lowercase record field name.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/fieldSchema",
+        "local_reference": "#/$defs/propertyName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "internal",
+      "state": "authored",
+      "products": [
+        "registryctl",
+        "relay",
+        "editor",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "cross_file_semantic",
+        "product_build"
+      ],
+      "diagnostic": "registryctl.authoring.entity.invalid",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "rebuild_project",
+      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
+      "consumers": [
+        "registryctl_authoring",
+        "registry_relay",
+        "editor_tooling",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "editor_schemas",
+        "project_build",
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "privacy",
+        "relay",
+        "compatibility",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]{0,63}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/propertyName"
+      }
+    },
+    {
+      "address": {
+        "schema": "entity",
+        "pointer": "/$defs/objectSchema/properties/type",
+        "path_kind": "property"
+      },
+      "purpose": "Declares the materialized entity record schema as an object.",
+      "purpose_source": "reviewed_override",
+      "semantic_owner": "entity_contract",
+      "human_owner": "data_model_maintainers",
+      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
+      "field_type": {
+        "schema_types": [],
+        "composed": false
+      },
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -59223,47 +62068,34 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type"
-          ]
-        },
-        {
-          "keyword": "type",
+          "keyword": "const",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/fieldSchema"
-      }
+      ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/properties/propertyNames",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Portable lowercase record field name.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/propertyName",
+        "schema_types": [],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -59311,31 +62143,28 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/propertyName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/required",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Lists the entity properties that every validated materialized record must contain.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
@@ -59345,14 +62174,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -59400,16 +62229,17 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "maxItems",
-          "value": 256
+          "value": 2
         },
         {
           "keyword": "minItems",
-          "value": 1
+          "value": 2
         },
         {
           "keyword": "type",
@@ -59424,24 +62254,21 @@
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/required/items",
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
         "path_kind": "array_item"
       },
-      "purpose": "Portable lowercase record field name.",
-      "purpose_source": "schema_description",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/propertyName",
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -59499,27 +62326,23 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]{0,63}$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
+          "keyword": "enum",
+          "value": [
+            "string",
+            "boolean",
+            "integer"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/propertyName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/objectSchema/properties/type",
-        "path_kind": "property"
+        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
+        "path_kind": "array_item"
       },
-      "purpose": "Declares the materialized entity record schema as an object.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
@@ -59527,7 +62350,7 @@
         "schema_types": [],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
@@ -59582,38 +62405,42 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "const",
-          "value": "object"
+          "value": "null"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/0",
-        "path_kind": "branch"
+        "pointer": "/properties/id",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Stable project-local identifier for the entity.",
+      "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -59661,45 +62488,48 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/1",
-        "path_kind": "branch"
+        "pointer": "/properties/materialization",
+        "path_kind": "property"
       },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Authored resource, refresh, and bounded recovery-set retention applied while building entity generations.",
+      "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "authored",
       "products": [
         "registryctl",
@@ -59747,46 +62577,45 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxItems",
-          "value": 2
-        },
-        {
-          "keyword": "minItems",
-          "value": 2
+          "keyword": "required",
+          "value": [
+            "max_records",
+            "max_bytes",
+            "refresh",
+            "retain_generations"
+          ]
         },
         {
           "keyword": "type",
-          "value": "array"
-        },
-        {
-          "keyword": "uniqueItems",
-          "value": true
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0",
-        "path_kind": "array_item"
+        "pointer": "/properties/materialization/properties/max_bytes",
+        "path_kind": "property"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
-      "purpose_source": "structural_taxonomy",
+      "purpose": "Maximum encoded size of one generation, up to 1 GiB, as bytes or a KiB/MiB quantity.",
+      "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
-        "composed": false
+        "schema_types": [
+          "integer",
+          "string"
+        ],
+        "composed": true
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -59813,7 +62642,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
@@ -59839,43 +62668,35 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "boolean",
-            "integer"
-          ]
-        }
-      ]
+      "constraints": []
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1",
-        "path_kind": "array_item"
+        "pointer": "/properties/materialization/properties/max_bytes/oneOf/0",
+        "path_kind": "branch"
       },
-      "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
       "purpose_source": "structural_taxonomy",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "integer"
+        ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -59924,23 +62745,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": "null"
+          "keyword": "maximum",
+          "value": 1073741824
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
+        {
+          "keyword": "type",
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/id",
-        "path_kind": "property"
+        "pointer": "/properties/materialization/properties/max_bytes/oneOf/1",
+        "path_kind": "branch"
       },
-      "purpose": "Stable project-local identifier for the entity.",
-      "purpose_source": "schema_description",
+      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
+      "purpose_source": "structural_taxonomy",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
@@ -59948,17 +62777,16 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/stableId",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "conditional",
+      "null_behavior": "not_applicable",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "authored",
       "products": [
         "registryctl",
@@ -60006,37 +62834,34 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "branch_has_no_authored_value"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "value": "^(?:(?:[1-9][0-9]{0,5}|10[0-3][0-9]{4}|104[0-7][0-9]{3}|1048[0-4][0-9]{2}|10485[0-6][0-9]|104857[0-6])KiB|(?:[1-9][0-9]{0,2}|10[0-1][0-9]|102[0-4])MiB)$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/stableId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization",
+        "pointer": "/properties/materialization/properties/max_records",
         "path_kind": "property"
       },
-      "purpose": "Authored resource, refresh, and bounded recovery-set retention applied while building entity generations.",
+      "purpose": "Maximum number of records allowed in one generation.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
@@ -60069,7 +62894,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
+        "schema_examples_available": true,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
@@ -60099,34 +62924,32 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "max_records",
-            "max_bytes",
-            "refresh",
-            "retain_generations"
-          ]
+          "keyword": "maximum",
+          "value": 100000000
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_bytes",
+        "pointer": "/properties/materialization/properties/refresh",
         "path_kind": "property"
       },
-      "purpose": "Maximum encoded size of one generation, up to 1 GiB, as bytes or a KiB/MiB quantity.",
+      "purpose": "Refresh cadence as a canonical positive duration no greater than 30 days, or manual when an operator initiates every refresh.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "integer",
           "string"
         ],
         "composed": true
@@ -60193,7 +63016,7 @@
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_bytes/oneOf/0",
+        "pointer": "/properties/materialization/properties/refresh/oneOf/0",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
@@ -60202,9 +63025,7 @@
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "conditional",
@@ -60267,23 +63088,15 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 1073741824
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
+          "keyword": "const",
+          "value": "manual"
         }
       ]
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_bytes/oneOf/1",
+        "pointer": "/properties/materialization/properties/refresh/oneOf/1",
         "path_kind": "branch"
       },
       "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
@@ -60358,7 +63171,7 @@
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,5}|10[0-3][0-9]{4}|104[0-7][0-9]{3}|1048[0-4][0-9]{2}|10485[0-6][0-9]|104857[0-6])KiB|(?:[1-9][0-9]{0,2}|10[0-1][0-9]|102[0-4])MiB)$"
+          "value": "^(?:(?:[1-9][0-9]{0,8}|1[0-9]{9}|2[0-4][0-9]{8}|25[0-8][0-9]{7}|259[0-1][0-9]{6}|2592000000)ms|(?:[1-9][0-9]{0,5}|1[0-9]{6}|2[0-4][0-9]{5}|25[0-8][0-9]{4}|259[0-1][0-9]{3}|2592000)s|(?:[1-9][0-9]{0,3}|[1-3][0-9]{4}|4[0-2][0-9]{3}|43[0-1][0-9]{2}|43200)m|(?:[1-9][0-9]{0,1}|[1-6][0-9]{2}|7[0-1][0-9]{1}|720)h|(?:[1-9][0-9]{0,0}|[1-2][0-9]{1}|30)d)$"
         },
         {
           "keyword": "type",
@@ -60369,10 +63182,10 @@
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization/properties/max_records",
+        "pointer": "/properties/materialization/properties/retain_generations",
         "path_kind": "property"
       },
-      "purpose": "Maximum number of records allowed in one generation.",
+      "purpose": "Number of completed cache generations, including the active generation, retained as a bounded recovery set after successful publication. This does not make arbitrary retained generations selectable for rollback.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
@@ -60443,7 +63256,7 @@
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 100000000
+          "value": 16
         },
         {
           "keyword": "minimum",
@@ -60458,10 +63271,10 @@
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization/properties/refresh",
+        "pointer": "/properties/primary_key",
         "path_kind": "property"
       },
-      "purpose": "Refresh cadence as a canonical positive duration no greater than 30 days, or manual when an operator initiates every refresh.",
+      "purpose": "Field whose value uniquely identifies each materialized record.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
@@ -60470,7 +63283,8 @@
         "schema_types": [
           "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/stableId",
+        "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
@@ -60499,162 +63313,6 @@
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": []
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/refresh/oneOf/0",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
-      "consumers": [
-        "registryctl_authoring",
-        "registry_relay",
-        "editor_tooling",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "privacy",
-        "relay",
-        "compatibility",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
-      ],
-      "constraints": [
-        {
-          "keyword": "const",
-          "value": "manual"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "entity",
-        "pointer": "/properties/materialization/properties/refresh/oneOf/1",
-        "path_kind": "branch"
-      },
-      "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.",
-      "purpose_source": "structural_taxonomy",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "conditional",
-      "null_behavior": "not_applicable",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "structural",
-      "state": "authored",
-      "products": [
-        "registryctl",
-        "relay",
-        "editor",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
-      ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
       "example": {
         "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
         "schema_examples_available": false,
@@ -60683,27 +63341,30 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "branch_has_no_authored_value"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^(?:(?:[1-9][0-9]{0,8}|1[0-9]{9}|2[0-4][0-9]{8}|25[0-8][0-9]{7}|259[0-1][0-9]{6}|2592000000)ms|(?:[1-9][0-9]{0,5}|1[0-9]{6}|2[0-4][0-9]{5}|25[0-8][0-9]{4}|259[0-1][0-9]{3}|2592000)s|(?:[1-9][0-9]{0,3}|[1-3][0-9]{4}|4[0-2][0-9]{3}|43[0-1][0-9]{2}|43200)m|(?:[1-9][0-9]{0,1}|[1-6][0-9]{2}|7[0-1][0-9]{1}|720)h|(?:[1-9][0-9]{0,0}|[1-2][0-9]{1}|30)d)$"
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "entity",
+        "pointer": "/$defs/stableId"
+      }
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/materialization/properties/retain_generations",
+        "pointer": "/properties/revision",
         "path_kind": "property"
       },
-      "purpose": "Number of completed cache generations, including the active generation, retained as a bounded recovery set after successful publication. This does not make arbitrary retained generations selectable for rollback.",
+      "purpose": "Monotonically increasing revision of this entity definition.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
@@ -60774,7 +63435,7 @@
       "constraints": [
         {
           "keyword": "maximum",
-          "value": 16
+          "value": 4294967295
         },
         {
           "keyword": "minimum",
@@ -60789,24 +63450,24 @@
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/primary_key",
+        "pointer": "/properties/schema",
         "path_kind": "property"
       },
-      "purpose": "Field whose value uniquely identifies each materialized record.",
+      "purpose": "Closed JSON object schema for materialized records.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/stableId",
+        "local_reference": "#/$defs/objectSchema",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -60863,34 +63524,37 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
+          "keyword": "required",
+          "value": [
+            "type",
+            "additionalProperties",
+            "required",
+            "properties"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "entity",
-        "pointer": "/$defs/stableId"
+        "pointer": "/$defs/objectSchema"
       }
     },
     {
       "address": {
         "schema": "entity",
-        "pointer": "/properties/revision",
+        "pointer": "/properties/version",
         "path_kind": "property"
       },
-      "purpose": "Monotonically increasing revision of this entity definition.",
+      "purpose": "Entity authoring format version.",
       "purpose_source": "schema_description",
       "semantic_owner": "entity_contract",
       "human_owner": "data_model_maintainers",
       "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
       "field_type": {
-        "schema_types": [
-          "integer"
-        ],
+        "schema_types": [],
         "composed": false
       },
       "requiredness": "required",
@@ -60900,7 +63564,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "authored",
       "products": [
         "registryctl",
@@ -60922,7 +63586,7 @@
       "version_history": [],
       "example": {
         "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
-        "schema_examples_available": true,
+        "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "rebuild_project",
@@ -60952,50 +63616,41 @@
       ],
       "constraints": [
         {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
+          "keyword": "const",
           "value": 1
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "entity",
-        "pointer": "/properties/schema",
-        "path_kind": "property"
+        "schema": "relay",
+        "pointer": "",
+        "key_path": "",
+        "path_kind": "root"
       },
-      "purpose": "Closed JSON object schema for materialized records.",
+      "purpose": "Root configuration document. Parsed from YAML at startup.",
       "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
+      "intent_profile": "relay_root_structural",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/objectSchema",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "internal",
-      "state": "authored",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
+      "state": "runtime",
       "products": [
-        "registryctl",
         "relay",
-        "editor",
         "docs"
       ],
       "availability": "published",
@@ -61003,37 +63658,30 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
+        "operator_preflight"
       ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registryctl_authoring",
         "registry_relay",
-        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "privacy",
         "relay",
-        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
@@ -61044,50 +63692,50 @@
         {
           "keyword": "required",
           "value": [
-            "type",
-            "additionalProperties",
-            "required",
-            "properties"
+            "server",
+            "catalog",
+            "auth",
+            "audit",
+            "datasets"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "entity",
-        "pointer": "/$defs/objectSchema"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "entity",
-        "pointer": "/properties/version",
+        "schema": "relay",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
+        "key_path": "datasets[].aggregates[].access.aggregate_only_execution",
         "path_kind": "property"
       },
-      "purpose": "Entity authoring format version.",
-      "purpose_source": "schema_description",
-      "semantic_owner": "entity_contract",
-      "human_owner": "data_model_maintainers",
-      "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
-        "schema_types": [],
+        "schema_types": [
+          "boolean"
+        ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "public",
-      "state": "authored",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
       "products": [
-        "registryctl",
         "relay",
-        "editor",
         "docs"
       ],
       "availability": "published",
@@ -61095,77 +63743,72 @@
       "validation_stages": [
         "json_schema",
         "rust_deserialization",
-        "cross_file_semantic",
-        "product_build"
+        "operator_preflight"
       ],
-      "diagnostic": "registryctl.authoring.entity.invalid",
+      "diagnostic": "config.validation_error",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
-      "migration": "rebuild_project",
-      "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.",
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
-        "registryctl_authoring",
         "registry_relay",
-        "editor_tooling",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "editor_schemas",
-        "project_build",
         "relay_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "privacy",
         "relay",
-        "compatibility",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": 1
+          "keyword": "type",
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "",
-        "key_path": "",
-        "path_kind": "root"
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
+        "key_path": "datasets[].entities[].aggregates[].access.aggregate_only_execution",
+        "path_kind": "property"
       },
-      "purpose": "Root configuration document. Parsed from YAML at startup.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_root_structural",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -61204,22 +63847,13 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "server",
-            "catalog",
-            "auth",
-            "audit",
-            "datasets"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
@@ -61227,7 +63861,7 @@
       "address": {
         "schema": "relay",
         "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
-        "key_path": "datasets[].aggregates[].access.aggregate_only_execution",
+        "key_path": "datasets[].tables[].aggregates[].access.aggregate_only_execution",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61295,15 +63929,95 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "boolean"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].aggregates[].access.aggregate_scope",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
-        "key_path": "datasets[].entities[].aggregates[].access.aggregate_only_execution",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].entities[].aggregates[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61314,13 +64028,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -61371,15 +64086,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution",
-        "key_path": "datasets[].tables[].aggregates[].access.aggregate_only_execution",
+        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].tables[].aggregates[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61390,13 +64108,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -61447,15 +64166,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].aggregates[].access.aggregate_scope",
+        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].aggregates[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61534,8 +64256,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].entities[].aggregates[].access.aggregate_scope",
+        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].entities[].aggregates[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61614,8 +64336,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].tables[].aggregates[].access.aggregate_scope",
+        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].tables[].aggregates[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61694,8 +64416,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].aggregates[].access.metadata_scope",
+        "pointer": "/$defs/AggregateConfig/properties/access",
+        "key_path": "datasets[].aggregates[].access",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61707,16 +64429,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -61765,8 +64487,8 @@
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -61774,8 +64496,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].entities[].aggregates[].access.metadata_scope",
+        "pointer": "/$defs/AggregateConfig/properties/access",
+        "key_path": "datasets[].entities[].aggregates[].access",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61787,16 +64509,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -61845,8 +64567,8 @@
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -61854,8 +64576,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].tables[].aggregates[].access.metadata_scope",
+        "pointer": "/$defs/AggregateConfig/properties/access",
+        "key_path": "datasets[].tables[].aggregates[].access",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61867,16 +64589,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -61925,8 +64647,8 @@
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -61934,8 +64656,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/access",
-        "key_path": "datasets[].aggregates[].access",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
+        "key_path": "datasets[].aggregates[].allowed_filters",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -61946,17 +64668,168 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62004,39 +64877,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/access",
-        "key_path": "datasets[].entities[].aggregates[].access",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].aggregates[].allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/AllowedFilter",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62083,40 +64952,47 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "null",
-            "object"
+            "field",
+            "ops"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/access",
-        "key_path": "datasets[].tables[].aggregates[].access",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/AllowedFilter",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62163,39 +65039,47 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "null",
-            "object"
+            "field",
+            "ops"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
-        "key_path": "datasets[].aggregates[].allowed_filters",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62241,17 +65125,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters",
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
+        "key_path": "datasets[].aggregates[].default_group_by",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -62270,8 +65165,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62326,8 +65221,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters",
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
+        "key_path": "datasets[].entities[].aggregates[].default_group_by",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -62346,8 +65241,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62402,115 +65297,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].aggregates[].allowed_filters[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/AllowedFilter",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
+        "key_path": "datasets[].tables[].aggregates[].default_group_by",
+        "path_kind": "property"
       },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62556,46 +65364,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[]",
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
+        "key_path": "datasets[].aggregates[].default_group_by[]",
         "path_kind": "array_item"
       },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
@@ -62643,29 +65439,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field",
-            "ops"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
-        "key_path": "datasets[].aggregates[].default_group_by",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
+        "key_path": "datasets[].entities[].aggregates[].default_group_by[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -62675,16 +65460,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62732,16 +65516,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
-        "key_path": "datasets[].entities[].aggregates[].default_group_by",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
+        "key_path": "datasets[].tables[].aggregates[].default_group_by[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -62751,16 +65535,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62808,15 +65591,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by",
-        "key_path": "datasets[].tables[].aggregates[].default_group_by",
+        "pointer": "/$defs/AggregateConfig/properties/description",
+        "key_path": "datasets[].aggregates[].description",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -62827,16 +65610,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62884,16 +65666,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
-        "key_path": "datasets[].aggregates[].default_group_by[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/description",
+        "key_path": "datasets[].entities[].aggregates[].description",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -62907,11 +65689,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -62966,9 +65748,9 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
-        "key_path": "datasets[].entities[].aggregates[].default_group_by[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/description",
+        "key_path": "datasets[].tables[].aggregates[].description",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -62982,11 +65764,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63041,9 +65823,9 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/default_group_by/items",
-        "key_path": "datasets[].tables[].aggregates[].default_group_by[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/dimensions",
+        "key_path": "datasets[].aggregates[].dimensions",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -63053,15 +65835,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63109,15 +65892,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/description",
-        "key_path": "datasets[].aggregates[].description",
+        "pointer": "/$defs/AggregateConfig/properties/dimensions",
+        "key_path": "datasets[].entities[].aggregates[].dimensions",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -63128,15 +65911,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63184,15 +65968,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/description",
-        "key_path": "datasets[].entities[].aggregates[].description",
+        "pointer": "/$defs/AggregateConfig/properties/dimensions",
+        "key_path": "datasets[].tables[].aggregates[].dimensions",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -63203,15 +65987,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63259,16 +66044,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/description",
-        "key_path": "datasets[].tables[].aggregates[].description",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
+        "key_path": "datasets[].aggregates[].dimensions[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -63278,15 +66063,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateDimensionConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63332,18 +66118,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions",
-        "key_path": "datasets[].aggregates[].dimensions",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -63353,16 +66151,104 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateDimensionConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig"
+      }
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/AggregateDimensionConfig",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63408,37 +66294,49 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions",
-        "key_path": "datasets[].entities[].aggregates[].dimensions",
+        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
+        "key_path": "datasets[].aggregates[].disclosure_control",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63486,35 +66384,39 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions",
-        "key_path": "datasets[].tables[].aggregates[].dimensions",
+        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63562,19 +66464,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DisclosureControlConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
-        "key_path": "datasets[].aggregates[].dimensions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -63583,14 +66489,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateDimensionConfig",
+        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63636,14 +66542,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -63651,15 +66549,15 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig"
+        "pointer": "/$defs/DisclosureControlConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/group_by",
+        "key_path": "datasets[].aggregates[].group_by",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -63669,16 +66567,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateDimensionConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63724,30 +66622,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/dimensions/items",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/group_by",
+        "key_path": "datasets[].entities[].aggregates[].group_by",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -63757,16 +66643,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateDimensionConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63812,49 +66698,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "field"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
-        "key_path": "datasets[].aggregates[].disclosure_control",
+        "pointer": "/$defs/AggregateConfig/properties/group_by",
+        "key_path": "datasets[].tables[].aggregates[].group_by",
         "path_kind": "property"
       },
-      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63902,39 +66776,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
+        "key_path": "datasets[].aggregates[].group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -63982,39 +66851,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/disclosure_control",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
+        "key_path": "datasets[].entities[].aggregates[].group_by[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DisclosureControlConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64062,20 +66926,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by",
-        "key_path": "datasets[].aggregates[].group_by",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
+        "key_path": "datasets[].tables[].aggregates[].group_by[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -64085,16 +66945,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64142,35 +67001,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by",
-        "key_path": "datasets[].entities[].aggregates[].group_by",
+        "pointer": "/$defs/AggregateConfig/properties/id",
+        "key_path": "datasets[].aggregates[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate identifier within a resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64217,96 +67076,28 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by",
-        "key_path": "datasets[].tables[].aggregates[].group_by",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
-        "key_path": "datasets[].aggregates[].group_by[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/id",
+        "key_path": "datasets[].entities[].aggregates[].id",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate identifier within a resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -64315,13 +67106,14 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64367,21 +67159,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
-        "key_path": "datasets[].entities[].aggregates[].group_by[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/id",
+        "key_path": "datasets[].tables[].aggregates[].id",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate identifier within a resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -64390,13 +67190,14 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64442,18 +67243,26 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/group_by/items",
-        "key_path": "datasets[].tables[].aggregates[].group_by[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/indicators",
+        "key_path": "datasets[].aggregates[].indicators",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -64463,15 +67272,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64519,35 +67329,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/id",
-        "key_path": "datasets[].aggregates[].id",
+        "pointer": "/$defs/AggregateConfig/properties/indicators",
+        "key_path": "datasets[].entities[].aggregates[].indicators",
         "path_kind": "property"
       },
-      "purpose": "Aggregate identifier within a resource.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64593,45 +67403,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/id",
-        "key_path": "datasets[].entities[].aggregates[].id",
+        "pointer": "/$defs/AggregateConfig/properties/indicators",
+        "key_path": "datasets[].tables[].aggregates[].indicators",
         "path_kind": "property"
       },
-      "purpose": "Aggregate identifier within a resource.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateId",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64677,45 +67479,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/id",
-        "key_path": "datasets[].tables[].aggregates[].id",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
+        "key_path": "datasets[].aggregates[].indicators[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Aggregate identifier within a resource.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/AggregateId",
+        "local_reference": "#/$defs/AggregateIndicatorConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64762,25 +67556,31 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateId"
+        "pointer": "/$defs/AggregateIndicatorConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators",
-        "key_path": "datasets[].aggregates[].indicators",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
+        "key_path": "datasets[].entities[].aggregates[].indicators[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -64790,16 +67590,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateIndicatorConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64845,18 +67645,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators",
-        "key_path": "datasets[].entities[].aggregates[].indicators",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
+        "key_path": "datasets[].tables[].aggregates[].indicators[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -64866,16 +67680,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateIndicatorConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -64921,21 +67735,35 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "label",
+            "function",
+            "column",
+            "unit_measure"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators",
-        "key_path": "datasets[].tables[].aggregates[].indicators",
+        "pointer": "/$defs/AggregateConfig/properties/joins",
+        "key_path": "datasets[].aggregates[].joins",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -65006,28 +67834,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
-        "key_path": "datasets[].aggregates[].indicators[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/joins",
+        "key_path": "datasets[].entities[].aggregates[].joins",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateIndicatorConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65073,51 +67901,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
-        "key_path": "datasets[].entities[].aggregates[].indicators[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/joins",
+        "key_path": "datasets[].tables[].aggregates[].joins",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateIndicatorConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65163,31 +67977,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/indicators/items",
-        "key_path": "datasets[].tables[].aggregates[].indicators[]",
+        "pointer": "/$defs/AggregateConfig/properties/joins/items",
+        "key_path": "datasets[].aggregates[].joins[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -65200,7 +68000,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateIndicatorConfig",
+        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -65256,11 +68056,7 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "label",
-            "function",
-            "column",
-            "unit_measure"
+            "relationship"
           ]
         },
         {
@@ -65270,34 +68066,34 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig"
+        "pointer": "/$defs/AggregateJoinConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins",
-        "key_path": "datasets[].aggregates[].joins",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/joins/items",
+        "key_path": "datasets[].entities[].aggregates[].joins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65343,37 +68139,47 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relationship"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateJoinConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins",
-        "key_path": "datasets[].entities[].aggregates[].joins",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/joins/items",
+        "key_path": "datasets[].tables[].aggregates[].joins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65419,21 +68225,31 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relationship"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateJoinConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins",
-        "key_path": "datasets[].tables[].aggregates[].joins",
+        "pointer": "/$defs/AggregateConfig/properties/measures",
+        "key_path": "datasets[].aggregates[].measures",
         "path_kind": "property"
       },
-      "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -65504,9 +68320,9 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins/items",
-        "key_path": "datasets[].aggregates[].joins[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/measures",
+        "key_path": "datasets[].entities[].aggregates[].measures",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -65516,16 +68332,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65571,28 +68387,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins/items",
-        "key_path": "datasets[].entities[].aggregates[].joins[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/measures",
+        "key_path": "datasets[].tables[].aggregates[].measures",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -65602,16 +68408,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateJoinConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65657,31 +68463,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/joins/items",
-        "key_path": "datasets[].tables[].aggregates[].joins[]",
+        "pointer": "/$defs/AggregateConfig/properties/measures/items",
+        "key_path": "datasets[].aggregates[].measures[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "One measure inside an aggregate.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -65690,7 +68486,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateJoinConfig",
+        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -65746,7 +68542,9 @@
         {
           "keyword": "required",
           "value": [
-            "relationship"
+            "name",
+            "function",
+            "column"
           ]
         },
         {
@@ -65756,34 +68554,34 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig"
+        "pointer": "/$defs/AggregateMeasure"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures",
-        "key_path": "datasets[].aggregates[].measures",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/measures/items",
+        "key_path": "datasets[].entities[].aggregates[].measures[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "One measure inside an aggregate.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65829,37 +68627,49 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "function",
+            "column"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures",
-        "key_path": "datasets[].entities[].aggregates[].measures",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/measures/items",
+        "key_path": "datasets[].tables[].aggregates[].measures[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "One measure inside an aggregate.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -65905,21 +68715,33 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "function",
+            "column"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateMeasure"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures",
-        "key_path": "datasets[].tables[].aggregates[].measures",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].aggregates[].required_filter_bindings",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -65990,11 +68812,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures/items",
-        "key_path": "datasets[].aggregates[].measures[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings",
+        "path_kind": "property"
       },
-      "purpose": "One measure inside an aggregate.",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -66002,16 +68824,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66057,32 +68879,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "function",
-            "column"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures/items",
-        "key_path": "datasets[].entities[].aggregates[].measures[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings",
+        "path_kind": "property"
       },
-      "purpose": "One measure inside an aggregate.",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -66090,16 +68900,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AggregateMeasure",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66145,33 +68955,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "function",
-            "column"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/measures/items",
-        "key_path": "datasets[].tables[].aggregates[].measures[]",
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].aggregates[].required_filter_bindings[]",
         "path_kind": "array_item"
       },
-      "purpose": "One measure inside an aggregate.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -66180,7 +68978,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateMeasure",
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -66236,9 +69034,7 @@
         {
           "keyword": "required",
           "value": [
-            "name",
-            "function",
-            "column"
+            "field"
           ]
         },
         {
@@ -66248,34 +69044,34 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure"
+        "pointer": "/$defs/RequiredFilterBindingConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].aggregates[].required_filter_bindings",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66321,37 +69117,47 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66397,20 +69203,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters",
+        "key_path": "datasets[].aggregates[].required_filters",
         "path_kind": "property"
       },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.",
+      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -66426,8 +69242,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66482,28 +69298,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].aggregates[].required_filter_bindings[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/required_filters",
+        "key_path": "datasets[].entities[].aggregates[].required_filters",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66549,47 +69365,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/required_filters",
+        "key_path": "datasets[].tables[].aggregates[].required_filters",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66635,27 +69441,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[]",
+        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
+        "key_path": "datasets[].aggregates[].required_filters[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -66666,14 +69462,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
@@ -66721,47 +69516,36 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "field"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters",
-        "key_path": "datasets[].aggregates[].required_filters",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
+        "key_path": "datasets[].entities[].aggregates[].required_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66809,35 +69593,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters",
-        "key_path": "datasets[].entities[].aggregates[].required_filters",
-        "path_kind": "property"
+        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
+        "key_path": "datasets[].tables[].aggregates[].required_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -66885,32 +69668,33 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters",
-        "key_path": "datasets[].tables[].aggregates[].required_filters",
+        "pointer": "/$defs/AggregateConfig/properties/source_entity",
+        "key_path": "datasets[].aggregates[].source_entity",
         "path_kind": "property"
       },
-      "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -66961,16 +69745,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
-        "key_path": "datasets[].aggregates[].required_filters[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/source_entity",
+        "key_path": "datasets[].entities[].aggregates[].source_entity",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -66980,15 +69767,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67036,16 +69825,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
-        "key_path": "datasets[].entities[].aggregates[].required_filters[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/source_entity",
+        "key_path": "datasets[].tables[].aggregates[].source_entity",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -67055,15 +69847,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67111,16 +69905,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/required_filters/items",
-        "key_path": "datasets[].tables[].aggregates[].required_filters[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AggregateConfig/properties/spatial",
+        "key_path": "datasets[].aggregates[].spatial",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -67130,15 +69927,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67184,17 +69983,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/source_entity",
-        "key_path": "datasets[].aggregates[].source_entity",
+        "pointer": "/$defs/AggregateConfig/properties/spatial",
+        "key_path": "datasets[].entities[].aggregates[].spatial",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67206,16 +70018,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67261,11 +70073,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -67273,8 +70095,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/source_entity",
-        "key_path": "datasets[].entities[].aggregates[].source_entity",
+        "pointer": "/$defs/AggregateConfig/properties/spatial",
+        "key_path": "datasets[].tables[].aggregates[].spatial",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67286,16 +70108,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67341,11 +70163,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode",
+            "dimension",
+            "geometry_entity",
+            "geometry_id_field",
+            "geometry_field"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -67353,8 +70185,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/source_entity",
-        "key_path": "datasets[].tables[].aggregates[].source_entity",
+        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
+        "key_path": "datasets[].aggregates[].temporal_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67433,8 +70265,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/spatial",
-        "key_path": "datasets[].aggregates[].spatial",
+        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
+        "key_path": "datasets[].entities[].aggregates[].temporal_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67446,16 +70278,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67501,21 +70333,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -67523,8 +70345,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/spatial",
-        "key_path": "datasets[].entities[].aggregates[].spatial",
+        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
+        "key_path": "datasets[].tables[].aggregates[].temporal_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67536,16 +70358,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67591,21 +70413,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -67613,8 +70425,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/spatial",
-        "key_path": "datasets[].tables[].aggregates[].spatial",
+        "pointer": "/$defs/AggregateConfig/properties/title",
+        "key_path": "datasets[].aggregates[].title",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67626,16 +70438,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -67681,21 +70493,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode",
-            "dimension",
-            "geometry_entity",
-            "geometry_id_field",
-            "geometry_field"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -67703,8 +70505,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
-        "key_path": "datasets[].aggregates[].temporal_field",
+        "pointer": "/$defs/AggregateConfig/properties/title",
+        "key_path": "datasets[].entities[].aggregates[].title",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67783,8 +70585,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
-        "key_path": "datasets[].entities[].aggregates[].temporal_field",
+        "pointer": "/$defs/AggregateConfig/properties/title",
+        "key_path": "datasets[].tables[].aggregates[].title",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67863,8 +70665,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/temporal_field",
-        "key_path": "datasets[].tables[].aggregates[].temporal_field",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
+        "key_path": "datasets[].aggregates[].dimensions[].codelist",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -67943,8 +70745,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/title",
-        "key_path": "datasets[].aggregates[].title",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].codelist",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68023,8 +70825,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/title",
-        "key_path": "datasets[].entities[].aggregates[].title",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].codelist",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68103,8 +70905,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig/properties/title",
-        "key_path": "datasets[].tables[].aggregates[].title",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
+        "key_path": "datasets[].aggregates[].dimensions[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68115,17 +70917,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -68173,18 +70973,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
-        "key_path": "datasets[].aggregates[].dimensions[].codelist",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68195,17 +70992,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -68253,18 +71048,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].codelist",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68275,17 +71067,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -68333,18 +71123,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/codelist",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].codelist",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
+        "key_path": "datasets[].aggregates[].dimensions[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68355,17 +71142,90 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].id",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -68413,18 +71273,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
-        "key_path": "datasets[].aggregates[].dimensions[].field",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68498,8 +71355,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].field",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
+        "key_path": "datasets[].aggregates[].dimensions[].label",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68573,8 +71430,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/field",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].field",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
+        "key_path": "datasets[].entities[].aggregates[].dimensions[].label",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68648,8 +71505,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
-        "key_path": "datasets[].aggregates[].dimensions[].id",
+        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
+        "key_path": "datasets[].tables[].aggregates[].dimensions[].label",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68723,8 +71580,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].id",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
+        "key_path": "datasets[].aggregates[].indicators[].column",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68798,8 +71655,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/id",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].id",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].column",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68873,8 +71730,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
-        "key_path": "datasets[].aggregates[].dimensions[].label",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].column",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68948,8 +71805,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
-        "key_path": "datasets[].entities[].aggregates[].dimensions[].label",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
+        "key_path": "datasets[].aggregates[].indicators[].decimals",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -68960,15 +71817,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69014,17 +71873,124 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateDimensionConfig/properties/label",
-        "key_path": "datasets[].tables[].aggregates[].dimensions[].label",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].decimals",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "integer",
+          "null"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
+        {
+          "keyword": "type",
+          "value": [
+            "integer",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].decimals",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69035,15 +72001,109 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "integer",
+          "null"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
+        {
+          "keyword": "type",
+          "value": [
+            "integer",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
+        "key_path": "datasets[].aggregates[].indicators[].definition_uri",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69091,15 +72151,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
-        "key_path": "datasets[].aggregates[].indicators[].column",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].definition_uri",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69110,15 +72173,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69166,15 +72231,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].column",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].definition_uri",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69185,15 +72253,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69241,15 +72311,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/column",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].column",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
+        "key_path": "datasets[].aggregates[].indicators[].frequency",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69260,15 +72333,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69316,15 +72391,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
-        "key_path": "datasets[].aggregates[].indicators[].decimals",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].frequency",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69335,14 +72413,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -69391,22 +72469,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
           "value": [
-            "integer",
+            "string",
             "null"
           ]
         }
@@ -69415,8 +72481,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].decimals",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].frequency",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69427,14 +72493,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -69483,22 +72549,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
           "value": [
-            "integer",
+            "string",
             "null"
           ]
         }
@@ -69507,29 +72561,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].decimals",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
+        "key_path": "datasets[].aggregates[].indicators[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69576,52 +72629,146 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
         },
         {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].function",
+        "path_kind": "property"
+      },
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/AggregateFunction",
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
-        "key_path": "datasets[].aggregates[].indicators[].definition_uri",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69668,19 +72815,33 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].definition_uri",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
+        "key_path": "datasets[].aggregates[].indicators[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69691,17 +72852,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69749,18 +72908,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].definition_uri",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69771,17 +72927,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69829,18 +72983,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
-        "key_path": "datasets[].aggregates[].indicators[].frequency",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69851,17 +73002,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69909,18 +73058,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].frequency",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
+        "key_path": "datasets[].aggregates[].indicators[].label",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -69931,17 +73077,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -69989,18 +73133,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].frequency",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].label",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70011,17 +73152,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -70069,22 +73208,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
-        "key_path": "datasets[].aggregates[].indicators[].function",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].label",
         "path_kind": "property"
       },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -70093,12 +73229,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -70146,38 +73281,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].function",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
+        "key_path": "datasets[].aggregates[].indicators[].unit_measure",
         "path_kind": "property"
       },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -70186,12 +73304,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -70239,38 +73356,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/function",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].function",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_measure",
         "path_kind": "property"
       },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -70279,12 +73379,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -70332,34 +73431,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
-        "key_path": "datasets[].aggregates[].indicators[].id",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_measure",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70426,15 +73508,107 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
+        "key_path": "datasets[].aggregates[].indicators[].unit_mult",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "integer",
+          "null"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "format",
+          "value": "int32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
+        {
+          "keyword": "type",
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].id",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
+        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_mult",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70445,15 +73619,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -70499,17 +73675,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/id",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].id",
+        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
+        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_mult",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70520,15 +73711,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -70574,17 +73767,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 2147483647
+        },
+        {
+          "keyword": "minimum",
+          "value": -2147483648
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
-        "key_path": "datasets[].aggregates[].indicators[].label",
+        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
+        "key_path": "datasets[].aggregates[].joins[].relationship",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70658,8 +73866,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].label",
+        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
+        "key_path": "datasets[].entities[].aggregates[].joins[].relationship",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70733,8 +73941,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/label",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].label",
+        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
+        "key_path": "datasets[].tables[].aggregates[].joins[].relationship",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70808,8 +74016,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
-        "key_path": "datasets[].aggregates[].indicators[].unit_measure",
+        "pointer": "/$defs/AggregateMeasure/properties/column",
+        "key_path": "datasets[].aggregates[].measures[].column",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70883,8 +74091,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_measure",
+        "pointer": "/$defs/AggregateMeasure/properties/column",
+        "key_path": "datasets[].entities[].aggregates[].measures[].column",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -70958,8 +74166,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_measure",
+        "pointer": "/$defs/AggregateMeasure/properties/column",
+        "key_path": "datasets[].tables[].aggregates[].measures[].column",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -71033,29 +74241,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
-        "key_path": "datasets[].aggregates[].indicators[].unit_mult",
+        "pointer": "/$defs/AggregateMeasure/properties/function",
+        "key_path": "datasets[].aggregates[].measures[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -71102,144 +74309,53 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "int32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
-        },
-        {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "integer",
-            "null"
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
           ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
-        "key_path": "datasets[].entities[].aggregates[].indicators[].unit_mult",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer",
-          "null"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "int32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult",
-        "key_path": "datasets[].tables[].aggregates[].indicators[].unit_mult",
+        "pointer": "/$defs/AggregateMeasure/properties/function",
+        "key_path": "datasets[].entities[].aggregates[].measures[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -71286,35 +74402,37 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "int32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 2147483647
-        },
-        {
-          "keyword": "minimum",
-          "value": -2147483648
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
-        "key_path": "datasets[].aggregates[].joins[].relationship",
+        "pointer": "/$defs/AggregateMeasure/properties/function",
+        "key_path": "datasets[].tables[].aggregates[].measures[].function",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -71323,11 +74441,12 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -71375,17 +74494,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "count",
+            "sum",
+            "avg",
+            "min",
+            "max",
+            "median",
+            "count_distinct",
+            "stddev"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateFunction"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
-        "key_path": "datasets[].entities[].aggregates[].joins[].relationship",
+        "pointer": "/$defs/AggregateMeasure/properties/name",
+        "key_path": "datasets[].aggregates[].measures[].name",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -71459,8 +74595,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateJoinConfig/properties/relationship",
-        "key_path": "datasets[].tables[].aggregates[].joins[].relationship",
+        "pointer": "/$defs/AggregateMeasure/properties/name",
+        "key_path": "datasets[].entities[].aggregates[].measures[].name",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -71534,8 +74670,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/column",
-        "key_path": "datasets[].aggregates[].measures[].column",
+        "pointer": "/$defs/AggregateMeasure/properties/name",
+        "key_path": "datasets[].tables[].aggregates[].measures[].name",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -71609,8 +74745,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/column",
-        "key_path": "datasets[].entities[].aggregates[].measures[].column",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -71621,15 +74757,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -71675,17 +74813,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/column",
-        "key_path": "datasets[].tables[].aggregates[].measures[].column",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -71696,15 +74846,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -71750,37 +74902,50 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/function",
-        "key_path": "datasets[].aggregates[].measures[].function",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields",
         "path_kind": "property"
       },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "local_reference": "#/$defs/AggregateFunction",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -71827,53 +74992,129 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
+        "key_path": "datasets[].aggregates[].spatial.collection_id",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": [
+            "string",
+            "null"
+          ]
+        }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/function",
-        "key_path": "datasets[].entities[].aggregates[].measures[].function",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
+        "key_path": "datasets[].entities[].aggregates[].spatial.collection_id",
         "path_kind": "property"
       },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -71920,37 +75161,103 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
+            "string",
+            "null"
           ]
-        },
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
+        "key_path": "datasets[].tables[].aggregates[].spatial.collection_id",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/function",
-        "key_path": "datasets[].tables[].aggregates[].measures[].function",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
+        "key_path": "datasets[].aggregates[].spatial.dimension",
         "path_kind": "property"
       },
-      "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -71959,12 +75266,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AggregateFunction",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -72012,34 +75318,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "count",
-            "sum",
-            "avg",
-            "min",
-            "max",
-            "median",
-            "count_distinct",
-            "stddev"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateFunction"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/name",
-        "key_path": "datasets[].aggregates[].measures[].name",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
+        "key_path": "datasets[].entities[].aggregates[].spatial.dimension",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72113,8 +75402,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/name",
-        "key_path": "datasets[].entities[].aggregates[].measures[].name",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
+        "key_path": "datasets[].tables[].aggregates[].spatial.dimension",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72188,8 +75477,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateMeasure/properties/name",
-        "key_path": "datasets[].tables[].aggregates[].measures[].name",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
+        "key_path": "datasets[].aggregates[].spatial.geometry_entity",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72263,8 +75552,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
+        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_entity",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72275,17 +75564,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72331,29 +75618,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
+        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_entity",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72364,17 +75639,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72420,29 +75693,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
+        "key_path": "datasets[].aggregates[].spatial.geometry_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72453,17 +75714,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72509,29 +75768,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
-        "key_path": "datasets[].aggregates[].spatial.collection_id",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
+        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72542,17 +75789,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72600,18 +75845,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
-        "key_path": "datasets[].entities[].aggregates[].spatial.collection_id",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
+        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72622,17 +75864,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72680,18 +75920,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id",
-        "key_path": "datasets[].tables[].aggregates[].spatial.collection_id",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
+        "key_path": "datasets[].aggregates[].spatial.geometry_id_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72702,17 +75939,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72760,18 +75995,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
-        "key_path": "datasets[].aggregates[].spatial.dimension",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
+        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_id_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72845,8 +76077,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
-        "key_path": "datasets[].entities[].aggregates[].spatial.dimension",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
+        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_id_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72920,8 +76152,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension",
-        "key_path": "datasets[].tables[].aggregates[].spatial.dimension",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
+        "key_path": "datasets[].aggregates[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -72932,15 +76164,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -72986,17 +76219,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
-        "key_path": "datasets[].aggregates[].spatial.geometry_entity",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
+        "key_path": "datasets[].entities[].aggregates[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73007,15 +76252,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -73061,17 +76307,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
-        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_entity",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
+        "key_path": "datasets[].tables[].aggregates[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73082,15 +76340,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -73136,17 +76395,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity",
-        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_entity",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].aggregates[].spatial.mode",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73163,7 +76434,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -73211,6 +76482,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "admin_area"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -73220,8 +76495,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
-        "key_path": "datasets[].aggregates[].spatial.geometry_field",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].entities[].aggregates[].spatial.mode",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73238,7 +76513,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -73286,6 +76561,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "admin_area"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -73295,8 +76574,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
-        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_field",
+        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].tables[].aggregates[].spatial.mode",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73313,7 +76592,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -73361,6 +76640,10 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "admin_area"
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -73370,8 +76653,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field",
-        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_field",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].aggregates[].allowed_filters[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73445,8 +76728,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
-        "key_path": "datasets[].aggregates[].spatial.geometry_id_field",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73520,8 +76803,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
-        "key_path": "datasets[].entities[].aggregates[].spatial.geometry_id_field",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].entities[].api.allowed_filters[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73595,8 +76878,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field",
-        "key_path": "datasets[].tables[].aggregates[].spatial.geometry_id_field",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73670,96 +76953,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
-        "key_path": "datasets[].aggregates[].spatial.max_geometry_vertices",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "integer"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
-        {
-          "keyword": "type",
-          "value": "integer"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
-        "key_path": "datasets[].entities[].aggregates[].spatial.max_geometry_vertices",
+        "pointer": "/$defs/AllowedFilter/properties/field",
+        "key_path": "datasets[].tables[].api.allowed_filters[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73770,16 +76965,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -73825,29 +77019,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices",
-        "key_path": "datasets[].tables[].aggregates[].spatial.max_geometry_vertices",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].aggregates[].allowed_filters[].ops",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73858,16 +77040,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -73913,29 +77094,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].aggregates[].spatial.mode",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -73946,13 +77115,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -74000,21 +77169,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": "admin_area"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].entities[].aggregates[].spatial.mode",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].entities[].api.allowed_filters[].ops",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -74025,13 +77190,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -74079,21 +77244,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": "admin_area"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].tables[].aggregates[].spatial.mode",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -74104,13 +77265,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -74158,21 +77319,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": "admin_area"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].aggregates[].allowed_filters[].field",
+        "pointer": "/$defs/AllowedFilter/properties/ops",
+        "key_path": "datasets[].tables[].api.allowed_filters[].ops",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -74183,13 +77340,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -74239,19 +77396,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].field",
-        "path_kind": "property"
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].aggregates[].allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -74260,13 +77417,14 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -74312,21 +77470,35 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].entities[].api.allowed_filters[].field",
-        "path_kind": "property"
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -74335,13 +77507,14 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -74387,21 +77560,35 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].field",
-        "path_kind": "property"
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].entities[].api.allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -74410,13 +77597,104 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "local_reference": "#/$defs/FilterOp",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
+      "default": {
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -74462,21 +77740,35 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/field",
-        "key_path": "datasets[].tables[].api.allowed_filters[].field",
-        "path_kind": "property"
+        "pointer": "/$defs/AllowedFilter/properties/ops/items",
+        "key_path": "datasets[].tables[].api.allowed_filters[].ops[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Filter operator opted into per field.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -74485,13 +77777,14 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -74537,29 +77830,44 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "eq",
+            "in",
+            "gte",
+            "lte",
+            "between"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FilterOp"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].aggregates[].allowed_filters[].ops",
+        "pointer": "/$defs/ApiKeyConfig/properties/fingerprint",
+        "key_path": "auth.api_keys[].fingerprint",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_auth_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/CredentialFingerprintSchema",
         "composed": false
       },
       "requiredness": "required",
@@ -74568,8 +77876,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -74604,47 +77912,66 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "provider",
+              "name"
+            ],
+            [
+              "provider",
+              "path"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/CredentialFingerprintSchema"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops",
+        "pointer": "/$defs/ApiKeyConfig/properties/id",
+        "key_path": "auth.api_keys[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -74679,30 +78006,33 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].entities[].api.allowed_filters[].ops",
+        "pointer": "/$defs/ApiKeyConfig/properties/scopes",
+        "key_path": "auth.api_keys[].scopes",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -74712,14 +78042,15 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -74754,11 +78085,14 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -74771,30 +78105,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops",
-        "path_kind": "property"
+        "pointer": "/$defs/ApiKeyConfig/properties/scopes/items",
+        "key_path": "auth.api_keys[].scopes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -74829,29 +78163,32 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops",
-        "key_path": "datasets[].tables[].api.allowed_filters[].ops",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/claims",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Claims released on success. Non-empty; at least one `required`.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -74921,101 +78258,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].aggregates[].allowed_filters[].ops[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/FilterOp",
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops[]",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/claims/items",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[]",
         "path_kind": "array_item"
       },
-      "purpose": "Filter operator opted into per field.",
+      "purpose": "A single released claim. Exactly one of `source_field` or `expression`\nmust be set: a claim is either a direct source-field projection or a\nCEL-computed value.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -75023,14 +78270,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/FilterOp",
+        "local_reference": "#/$defs/ReleaseClaimConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
@@ -75079,50 +78326,47 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "required",
           "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
+            "name"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/FilterOp"
+        "pointer": "/$defs/ReleaseClaimConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].entities[].api.allowed_filters[].ops[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AttributeReleaseProfile/properties/description",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].description",
+        "path_kind": "property"
       },
-      "purpose": "Filter operator opted into per field.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -75169,33 +78413,22 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AttributeReleaseProfile/properties/id",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].id",
+        "path_kind": "property"
       },
-      "purpose": "Filter operator opted into per field.",
+      "purpose": "Profile identifier, lower-kebab/snake (`^[a-z][a-z0-9_-]*$`). Globally\nunique with `version`.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -75205,14 +78438,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -75258,34 +78490,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter/properties/ops/items",
-        "key_path": "datasets[].tables[].api.allowed_filters[].ops[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AttributeReleaseProfile/properties/purpose",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].purpose",
+        "path_kind": "property"
       },
-      "purpose": "Filter operator opted into per field.",
+      "purpose": "Data-purpose this profile is bound to. When the backing entity declares\n`governed_policy.permitted_purposes`, this must be a member.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -75295,14 +78513,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/FilterOp",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -75348,54 +78565,41 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "eq",
-            "in",
-            "gte",
-            "lte",
-            "between"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FilterOp"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/fingerprint",
-        "key_path": "auth.api_keys[].fingerprint",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/release_conditions",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/CredentialFingerprintSchema",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -75430,49 +78634,39 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            [
-              "provider",
-              "name"
-            ],
-            [
-              "provider",
-              "path"
-            ]
+            "expression"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/id",
-        "key_path": "auth.api_keys[].id",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/release_scope",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_scope",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
+      "purpose": "Dataset-bound scope a caller must hold to invoke this release. The\nstable profile is exactly `<dataset_id>:identity_release`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -75488,8 +78682,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -75524,14 +78718,11 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -75544,31 +78735,32 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/scopes",
-        "key_path": "auth.api_keys[].scopes",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/response",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].response",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/ReleaseResponseConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -75603,47 +78795,49 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseResponseConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig/properties/scopes/items",
-        "key_path": "auth.api_keys[].scopes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AttributeReleaseProfile/properties/subject",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].subject",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ReleaseSubjectConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -75688,40 +78882,52 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "source_field",
+            "id_type"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseSubjectConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/claims",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims",
+        "pointer": "/$defs/AttributeReleaseProfile/properties/title",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].title",
         "path_kind": "property"
       },
-      "purpose": "Claims released on success. Non-empty; at least one `required`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -75769,18 +78975,21 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/claims/items",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AttributeReleaseProfile/properties/version",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].version",
+        "path_kind": "property"
       },
-      "purpose": "A single released claim. Exactly one of `source_field` or `expression`\nmust be set: a claim is either a direct source-field projection or a\nCEL-computed value.",
+      "purpose": "Profile version. Globally unique with `id`; no silent \"latest\".",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -75788,16 +78997,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ReleaseClaimConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -75843,48 +79051,36 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/description",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].description",
+        "pointer": "/$defs/AuditConfig/oneOf/0/properties/sink",
+        "key_path": "audit.sink",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -75926,29 +79122,33 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "const",
           "value": [
-            "string",
-            "null"
+            "file",
+            "stdout",
+            "syslog"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/id",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].id",
+        "pointer": "/$defs/AuditConfig/oneOf/1/properties/path",
+        "key_path": "audit.path",
         "path_kind": "property"
       },
-      "purpose": "Profile identifier, lower-kebab/snake (`^[a-z][a-z0-9_-]*$`). Globally\nunique with `version`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_audit_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -75964,8 +79164,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -76000,12 +79200,14 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -76017,27 +79219,29 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/purpose",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].purpose",
+        "pointer": "/$defs/AuditConfig/oneOf/1/properties/rotate",
+        "key_path": "audit.rotate",
         "path_kind": "property"
       },
-      "purpose": "Data-purpose this profile is bound to. When the backing entity declares\n`governed_policy.permitted_purposes`, this must be a member.",
+      "purpose": "In-process rotation for the `file` audit sink.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RotateConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -76079,42 +79283,51 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "max_size_mb",
+            "max_files"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RotateConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/release_conditions",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions",
+        "pointer": "/$defs/AuditConfig/properties/chain",
+        "key_path": "audit.chain",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Retains the compatibility switch in the authored contract; Relay audit envelopes remain integrity-chained regardless of this setting.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "boolean"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -76156,35 +79369,25 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "expression"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/release_scope",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_scope",
+        "pointer": "/$defs/AuditConfig/properties/format",
+        "key_path": "audit.format",
         "path_kind": "property"
       },
-      "purpose": "Dataset-bound scope a caller must hold to invoke this release. The\nstable profile is exactly `<dataset_id>:identity_release`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -76192,13 +79395,15 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AuditFormat",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -76240,45 +79445,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "jsonl"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditFormat"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/response",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].response",
+        "pointer": "/$defs/AuditConfig/properties/hash_secret_env",
+        "key_path": "audit.hash_secret_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Name of the environment variable holding the per-deploy secret\nused to HMAC sensitive audit values (single-record primary keys,\nsensitive query parameters). Runtime startup fails closed when\nthis field is unset, empty, or points to a missing, empty, or\nweak secret. Direct middleware tests can opt into the explicit\nunkeyed dev-only hasher without using runtime config.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/ReleaseResponseConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -76313,52 +79525,57 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[^=\\x00]*[^=\\x00\\x09-\\x0D\\x20\\x85\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000][^=\\x00]*$"
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "string"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseResponseConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/subject",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].subject",
+        "pointer": "/$defs/AuditConfig/properties/include_health",
+        "key_path": "audit.include_health",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
+      "purpose": "Include `/healthz` liveness probes in the audit stream. `/ready` is\nalways excluded because auditing it would advance the chain after its\nzero-backlog shipping check and self-invalidate the next probe.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/ReleaseSubjectConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -76393,56 +79610,42 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "source_field",
-            "id_type"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseSubjectConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/title",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].title",
+        "pointer": "/$defs/AuditConfig/properties/write_policy",
+        "key_path": "audit.write_policy",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Behavior when an audit record fails to write.\n\n`fail_closed` (default) fails the request with a stable error code so\nthat no request outcome is returned without a durable audit record.\n`availability_first` logs the failure and lets the request succeed for\ndeployments that explicitly accept best-effort audit durability.\nPer-route-family selection is out of scope; this is a single\ndeployment-wide policy.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/AuditWritePolicySchema",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -76487,43 +79690,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "availability_first",
+            "fail_closed",
+            "fail_closed_route_families"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditWritePolicySchema"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile/properties/version",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].version",
-        "path_kind": "property"
+        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig/items",
+        "key_path": "consultation.audit_pseudonym_materials[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Profile version. Globally unique with `id`; no silent \"latest\".",
+      "purpose": "One public epoch id bound to one secret source reference.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AuditPseudonymMaterialConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -76569,22 +79781,33 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "key_id",
+            "source"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/oneOf/0/properties/sink",
-        "key_path": "audit.sink",
+        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/key_id",
+        "key_path": "consultation.audit_pseudonym_materials[].key_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -76592,6 +79815,7 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/AuditPseudonymKeyIdSchema",
         "composed": false
       },
       "requiredness": "required",
@@ -76640,50 +79864,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": [
-            "file",
-            "stdout",
-            "syslog"
-          ]
+          "keyword": "pattern",
+          "value": "^[a-z0-9][a-z0-9._-]{0,63}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymKeyIdSchema"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/oneOf/1/properties/path",
-        "key_path": "audit.path",
+        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/source",
+        "key_path": "consultation.audit_pseudonym_materials[].source",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_sensitive",
+      "purpose": "Closed v1 set of audit-pseudonym secret source providers.\n\nThe configured name is a reference only. Secret values cannot be embedded\nin this model and are loaded exactly once during runtime compilation.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AuditPseudonymSecretSourceConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -76718,51 +79944,59 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "provider",
+            "name"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymSecretSourceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/oneOf/1/properties/rotate",
-        "key_path": "audit.rotate",
+        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/name",
+        "key_path": "consultation.audit_pseudonym_materials[].source.name",
         "path_kind": "property"
       },
-      "purpose": "In-process rotation for the `file` audit sink.",
+      "purpose": "Portable environment-variable name used only as a secret reference.\n\nDebug output is redacted even though the name is not itself key material,\npreventing configuration diagnostics from disclosing secret topology.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RotateConfig",
+        "local_reference": "#/$defs/AuditPseudonymSecretEnvironmentName",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -76797,55 +80031,54 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "max_size_mb",
-            "max_files"
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/RotateConfig"
+        "pointer": "/$defs/AuditPseudonymSecretEnvironmentName"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/chain",
-        "key_path": "audit.chain",
+        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/provider",
+        "key_path": "consultation.audit_pseudonym_materials[].source.provider",
         "path_kind": "property"
       },
-      "purpose": "Retains the compatibility switch in the authored contract; Relay audit envelopes remain integrity-chained regardless of this setting.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_audit_internal",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -76887,44 +80120,48 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": "environment"
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/format",
-        "key_path": "audit.format",
+        "pointer": "/$defs/AuthConfig/properties/api_keys",
+        "key_path": "auth.api_keys",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/AuditFormat",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -76959,56 +80196,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": "jsonl"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditFormat"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/hash_secret_env",
-        "key_path": "audit.hash_secret_env",
-        "path_kind": "property"
+        "pointer": "/$defs/AuthConfig/properties/api_keys/items",
+        "key_path": "auth.api_keys[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Name of the environment variable holding the per-deploy secret\nused to HMAC sensitive audit values (single-record primary keys,\nsensitive query parameters). Runtime startup fails closed when\nthis field is unset, empty, or points to a missing, empty, or\nweak secret. Direct middleware tests can opt into the explicit\nunkeyed dev-only hasher without using runtime config.",
+      "purpose": "One configured API key, identified by an id and a fingerprint reference.\nThe raw key never appears in config.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_secret_reference",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/ApiKeyConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -77050,47 +80282,53 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[^=\\x00]*[^=\\x00\\x09-\\x0D\\x20\\x85\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000][^=\\x00]*$"
+          "keyword": "required",
+          "value": [
+            "id",
+            "fingerprint"
+          ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ApiKeyConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/include_health",
-        "key_path": "audit.include_health",
+        "pointer": "/$defs/AuthConfig/properties/failure_throttle",
+        "key_path": "auth.failure_throttle",
         "path_kind": "property"
       },
-      "purpose": "Include `/healthz` liveness probes in the audit stream. `/ready` is\nalways excluded because auditing it would advance the chain after its\nzero-backlog shipping check and self-invalidate the next probe.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
+        "local_reference": "#/$defs/AuthFailureThrottleConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -77132,25 +80370,30 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuthFailureThrottleConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig/properties/write_policy",
-        "key_path": "audit.write_policy",
+        "pointer": "/$defs/AuthConfig/properties/mode",
+        "key_path": "auth.mode",
         "path_kind": "property"
       },
-      "purpose": "Behavior when an audit record fails to write.\n\n`fail_closed` (default) fails the request with a stable error code so\nthat no request outcome is returned without a durable audit record.\n`availability_first` logs the failure and lets the request succeed for\ndeployments that explicitly accept best-effort audit durability.\nPer-route-family selection is out of scope; this is a single\ndeployment-wide policy.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -77158,15 +80401,14 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AuditWritePolicySchema",
+        "local_reference": "#/$defs/AuthMode",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -77208,15 +80450,15 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "const",
           "value": [
-            "availability_first",
-            "fail_closed",
-            "fail_closed_route_families"
+            "api_key",
+            "oidc"
           ]
         },
         {
@@ -77226,34 +80468,35 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AuditWritePolicySchema"
+        "pointer": "/$defs/AuthMode"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig/items",
-        "key_path": "consultation.audit_pseudonym_materials[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AuthConfig/properties/oidc",
+        "key_path": "auth.oidc",
+        "path_kind": "property"
       },
-      "purpose": "One public epoch id bound to one secret source reference.",
+      "purpose": "OIDC / OAuth2 resource-server configuration. The relay validates\nincoming bearer JWTs against a configured external IdP. No tokens\nare minted here.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/AuditPseudonymMaterialConfig",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -77302,45 +80545,44 @@
         {
           "keyword": "required",
           "value": [
-            "key_id",
-            "source"
+            "issuer",
+            "audiences"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/key_id",
-        "key_path": "consultation.audit_pseudonym_materials[].key_id",
+        "pointer": "/$defs/AuthFailureThrottleConfig/properties/enabled",
+        "key_path": "auth.failure_throttle.enabled",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
-        "local_reference": "#/$defs/AuditPseudonymKeyIdSchema",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -77386,45 +80628,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z0-9][a-z0-9._-]{0,63}$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymKeyIdSchema"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/source",
-        "key_path": "consultation.audit_pseudonym_materials[].source",
+        "pointer": "/$defs/AuthFailureThrottleConfig/properties/max_failures",
+        "key_path": "auth.failure_throttle.max_failures",
         "path_kind": "property"
       },
-      "purpose": "Closed v1 set of audit-pseudonym secret source providers.\n\nThe configured name is a reference only. Secret values cannot be embedded\nin this model and are loaded exactly once during runtime compilation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/AuditPseudonymSecretSourceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -77471,50 +80705,51 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "provider",
-            "name"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretSourceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/name",
-        "key_path": "consultation.audit_pseudonym_materials[].source.name",
+        "pointer": "/$defs/AuthFailureThrottleConfig/properties/window_seconds",
+        "key_path": "auth.failure_throttle.window_seconds",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a secret reference.\n\nDebug output is redacted even though the name is not itself key material,\npreventing configuration diagnostics from disclosing secret topology.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/AuditPseudonymSecretEnvironmentName",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -77549,57 +80784,61 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/provider",
-        "key_path": "consultation.audit_pseudonym_materials[].source.provider",
+        "pointer": "/$defs/CatalogConfig/properties/authority_type",
+        "key_path": "catalog.authority_type",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "BRegDCAT-AP: type IRI for the `foaf:Agent` publisher. When set, emits\n`dcterms:type` on the publisher node.\n\nBRegDCAT-AP 2.1.0 SHACL checks publisher type values against the ADMS\npublishertype scheme (`http://purl.org/adms/publishertype/...`).\nThe relay does not enforce a vocabulary: any IRI passes through.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_catalog_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -77617,12 +80856,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -77634,49 +80873,47 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": "environment"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/api_keys",
-        "key_path": "auth.api_keys",
+        "pointer": "/$defs/CatalogConfig/properties/base_url",
+        "key_path": "catalog.base_url",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay catalog identity and public metadata exposed for governed discovery.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
+      "intent_profile": "relay_catalog_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -77721,44 +80958,44 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/api_keys/items",
-        "key_path": "auth.api_keys[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/CatalogConfig/properties/default_spatial_coverage",
+        "key_path": "catalog.default_spatial_coverage",
+        "path_kind": "property"
       },
-      "purpose": "One configured API key, identified by an id and a fingerprint reference.\nThe raw key never appears in config.",
+      "purpose": "BRegDCAT-AP: default `dcterms:spatial` IRI applied to datasets that\ndo not declare their own `spatial_coverage`. Typically an EU\nauthority country IRI under\n`http://publications.europa.eu/resource/authority/country/`.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
+      "intent_profile": "relay_catalog_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/ApiKeyConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -77776,12 +81013,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -77793,63 +81030,52 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "id",
-            "fingerprint"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ApiKeyConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/failure_throttle",
-        "key_path": "auth.failure_throttle",
+        "pointer": "/$defs/CatalogConfig/properties/participant_id",
+        "key_path": "catalog.participant_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Identifies the participant in catalog output; when omitted, Relay derives the participant identifier from the reviewed catalog base URL.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_catalog_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/AuthFailureThrottleConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -77867,12 +81093,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -77884,52 +81110,50 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/mode",
-        "key_path": "auth.mode",
+        "pointer": "/$defs/CatalogConfig/properties/publisher",
+        "key_path": "catalog.publisher",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_catalog_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AuthMode",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -77947,12 +81171,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -77964,60 +81188,49 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "api_key",
-            "oidc"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuthMode"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthConfig/properties/oidc",
-        "key_path": "auth.oidc",
+        "pointer": "/$defs/CatalogConfig/properties/publisher_iri",
+        "key_path": "catalog.publisher_iri",
         "path_kind": "property"
       },
-      "purpose": "OIDC / OAuth2 resource-server configuration. The relay validates\nincoming bearer JWTs against a configured external IdP. No tokens\nare minted here.",
+      "purpose": "BRegDCAT-AP: identifier IRI for the `foaf:Agent` publisher. Use a\ncontrolled-vocabulary corporate body IRI when publishing strict\nBRegDCAT-AP.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_catalog_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -78035,12 +81248,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78052,26 +81265,19 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "issuer",
-            "audiences"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -78079,31 +81285,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig/properties/enabled",
-        "key_path": "auth.failure_throttle.enabled",
+        "pointer": "/$defs/CatalogConfig/properties/title",
+        "key_path": "catalog.title",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_catalog_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -78121,12 +81326,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78138,48 +81343,47 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig/properties/max_failures",
-        "key_path": "auth.failure_throttle.max_failures",
+        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
+        "key_path": "config_trust.antirollback_state_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_config_trust_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -78214,60 +81418,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/AuthFailureThrottleConfig/properties/window_seconds",
-        "key_path": "auth.failure_throttle.window_seconds",
+        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
+        "key_path": "config_trust.break_glass_override_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_config_trust_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -78302,61 +81497,52 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/authority_type",
-        "key_path": "catalog.authority_type",
+        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
+        "key_path": "config_trust.bundle_path",
         "path_kind": "property"
       },
-      "purpose": "BRegDCAT-AP: type IRI for the `foaf:Agent` publisher. When set, emits\n`dcterms:type` on the publisher node.\n\nBRegDCAT-AP 2.1.0 SHACL checks publisher type values against the ADMS\npublishertype scheme (`http://purl.org/adms/publishertype/...`).\nThe relay does not enforce a vocabulary: any IRI passes through.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_public",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_config_trust_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -78374,12 +81560,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78391,33 +81577,32 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/base_url",
-        "key_path": "catalog.base_url",
+        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
+        "key_path": "config_trust.trust_anchor_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay catalog identity and public metadata exposed for governed discovery.",
+      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_catalog_sensitive",
+      "intent_profile": "relay_config_trust_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -78488,32 +81673,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/default_spatial_coverage",
-        "key_path": "catalog.default_spatial_coverage",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence",
+        "key_path": "consultation.artifacts.evidence",
         "path_kind": "property"
       },
-      "purpose": "BRegDCAT-AP: default `dcterms:spatial` IRI applied to datasets that\ndo not declare their own `spatial_coverage`. Typically an EU\nauthority country IRI under\n`http://publications.europa.eu/resource/authority/country/`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_public",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -78531,12 +81714,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78548,52 +81731,48 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/participant_id",
-        "key_path": "catalog.participant_id",
-        "path_kind": "property"
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence/items",
+        "key_path": "consultation.artifacts.evidence[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Identifies the participant in catalog output; when omitted, Relay derives the participant identifier from the reviewed catalog base URL.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_catalog_public",
+      "purpose": "One bounded, hash-pinned integration evidence file.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationEvidenceArtifactConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -78611,12 +81790,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78628,50 +81807,59 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "class",
+            "path",
+            "sha256"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/publisher",
-        "key_path": "catalog.publisher",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs",
+        "key_path": "consultation.artifacts.integration_packs",
         "path_kind": "property"
       },
-      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_catalog_public",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -78689,12 +81877,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78706,49 +81894,48 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/publisher_iri",
-        "key_path": "catalog.publisher_iri",
-        "path_kind": "property"
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs/items",
+        "key_path": "consultation.artifacts.integration_packs[]",
+        "path_kind": "array_item"
       },
-      "purpose": "BRegDCAT-AP: identifier IRI for the `foaf:Agent` publisher. Use a\ncontrolled-vocabulary corporate body IRI when publishing strict\nBRegDCAT-AP.",
+      "purpose": "One hash-pinned public contract or reviewed integration pack.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_public",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -78766,12 +81953,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78783,50 +81970,59 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "path",
+            "hash",
+            "sha256"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig/properties/title",
-        "key_path": "catalog.title",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings",
+        "key_path": "consultation.artifacts.private_bindings",
         "path_kind": "property"
       },
-      "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_catalog_public",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -78844,12 +82040,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -78861,47 +82057,48 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
-        "key_path": "config_trust.antirollback_state_path",
-        "path_kind": "property"
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings/items",
+        "key_path": "consultation.artifacts.private_bindings[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
+      "purpose": "One hash-pinned public contract or reviewed integration pack.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -78936,51 +82133,59 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path",
+            "hash",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
-        "key_path": "config_trust.break_glass_override_path",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts",
+        "key_path": "consultation.artifacts.public_contracts",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -79015,52 +82220,48 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
-        "key_path": "config_trust.bundle_path",
-        "path_kind": "property"
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts/items",
+        "key_path": "consultation.artifacts.public_contracts[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
+      "purpose": "One hash-pinned public contract or reviewed integration pack.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -79095,49 +82296,60 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path",
+            "hash",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
-        "key_path": "config_trust.trust_anchor_path",
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts",
+        "key_path": "consultation.artifacts.rhai_scripts",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_config_trust_sensitive",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -79172,46 +82384,45 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence",
-        "key_path": "consultation.artifacts.evidence",
-        "path_kind": "property"
+        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts/items",
+        "key_path": "consultation.artifacts.rhai_scripts[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "One hash-pinned private binding or standalone Rhai script.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/ConsultationArtifactReferenceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -79257,40 +82468,50 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "path",
+            "sha256"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationArtifactReferenceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence/items",
-        "key_path": "consultation.artifacts.evidence[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.rhai_scripts[].path",
+        "path_kind": "property"
       },
-      "purpose": "One bounded, hash-pinned integration evidence file.",
+      "purpose": "Normalized bundle-root-relative path.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ConsultationEvidenceArtifactConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -79325,54 +82546,45 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "class",
-            "path",
-            "sha256"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs",
-        "key_path": "consultation.artifacts.integration_packs",
+        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.rhai_scripts[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -79420,37 +82632,42 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs/items",
-        "key_path": "consultation.artifacts.integration_packs[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ConsultationConfig/properties/artifacts",
+        "key_path": "consultation.artifacts",
+        "path_kind": "property"
       },
-      "purpose": "One hash-pinned public contract or reviewed integration pack.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -79499,30 +82716,30 @@
         {
           "keyword": "required",
           "value": [
-            "path",
-            "hash",
-            "sha256"
+            "public_contracts",
+            "integration_packs",
+            "private_bindings",
+            "evidence"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings",
-        "key_path": "consultation.artifacts.private_bindings",
+        "pointer": "/$defs/ConsultationConfig/properties/audit_pseudonym_materials",
+        "key_path": "consultation.audit_pseudonym_materials",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Bounded startup catalog of audit-pseudonym material references.\n\nThe 1..=32 bound and cross-entry uniqueness are enforced by config\nvalidation and repeated by the material provider before loading secrets.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -79531,6 +82748,7 @@
         "schema_types": [
           "array"
         ],
+        "local_reference": "#/$defs/AuditPseudonymMaterialCatalogConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -79587,17 +82805,21 @@
           "keyword": "type",
           "value": "array"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings/items",
-        "key_path": "consultation.artifacts.private_bindings[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ConsultationConfig/properties/authorized_workload",
+        "key_path": "consultation.authorized_workload",
+        "path_kind": "property"
       },
-      "purpose": "One hash-pinned public contract or reviewed integration pack.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -79606,14 +82828,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
+        "local_reference": "#/$defs/ConsultationWorkloadConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -79662,9 +82884,10 @@
         {
           "keyword": "required",
           "value": [
-            "path",
-            "hash",
-            "sha256"
+            "audience",
+            "client_claim_selector",
+            "client_value",
+            "principal_id"
           ]
         },
         {
@@ -79674,19 +82897,19 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+        "pointer": "/$defs/ConsultationWorkloadConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts",
-        "key_path": "consultation.artifacts.public_contracts",
+        "pointer": "/$defs/ConsultationConfig/properties/source_credentials",
+        "key_path": "consultation.source_credentials",
         "path_kind": "property"
       },
       "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -79694,16 +82917,18 @@
         "schema_types": [
           "array"
         ],
+        "local_reference": "#/$defs/ConsultationSourceCredentialCatalogConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -79738,11 +82963,14 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -79750,17 +82978,21 @@
           "keyword": "type",
           "value": "array"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts/items",
-        "key_path": "consultation.artifacts.public_contracts[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ConsultationConfig/properties/state_plane",
+        "key_path": "consultation.state_plane",
+        "path_kind": "property"
       },
-      "purpose": "One hash-pinned public contract or reviewed integration pack.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -79769,14 +83001,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig",
+        "local_reference": "#/$defs/ConsultationStatePlaneConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -79825,9 +83057,10 @@
         {
           "keyword": "required",
           "value": [
-            "path",
-            "hash",
-            "sha256"
+            "database_url_env",
+            "chain_key_epoch_id",
+            "serving_fence_lock_key",
+            "audit_pseudonym_keyring_lock_key"
           ]
         },
         {
@@ -79837,93 +83070,17 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig"
+        "pointer": "/$defs/ConsultationStatePlaneConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts",
-        "key_path": "consultation.artifacts.rhai_scripts",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/class",
+        "key_path": "consultation.artifacts.evidence[].class",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts/items",
-        "key_path": "consultation.artifacts.rhai_scripts[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "One hash-pinned private binding or standalone Rhai script.",
+      "purpose": "Closed evidence classes understood by consultation source-plan v1.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
@@ -79931,16 +83088,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ConsultationArtifactReferenceConfig",
+        "local_reference": "#/$defs/ConsultationEvidenceClassConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -79987,31 +83144,32 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "path",
-            "sha256"
+            "conformance",
+            "negative_security",
+            "minimization"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactReferenceConfig"
+        "pointer": "/$defs/ConsultationEvidenceClassConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.rhai_scripts[].path",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/path",
+        "key_path": "consultation.artifacts.evidence[].path",
         "path_kind": "property"
       },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -80084,12 +83242,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.rhai_scripts[].sha256",
+        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/sha256",
+        "key_path": "consultation.artifacts.evidence[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -80163,32 +83321,31 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/artifacts",
-        "key_path": "consultation.artifacts",
-        "path_kind": "property"
+        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig/items",
+        "key_path": "consultation.source_credentials[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Closed V1 source-credential provider configuration.\n\nEnvironment names are opaque references and are redacted from `Debug`.\nThere is deliberately no field capable of carrying an embedded username,\npassword, bearer token, or provider-specific extension.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/ConsultationSourceCredentialConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -80223,50 +83380,75 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "public_contracts",
-            "integration_packs",
-            "private_bindings",
-            "evidence"
+            [
+              "type",
+              "ref",
+              "generation",
+              "client_id_env",
+              "client_secret_env"
+            ],
+            [
+              "type",
+              "ref",
+              "generation",
+              "token_env"
+            ],
+            [
+              "type",
+              "ref",
+              "generation",
+              "username_env",
+              "password_env"
+            ],
+            [
+              "type",
+              "ref",
+              "generation",
+              "value_env"
+            ]
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/audit_pseudonym_materials",
-        "key_path": "consultation.audit_pseudonym_materials",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/generation",
+        "key_path": "consultation.source_credentials[].generation",
         "path_kind": "property"
       },
-      "purpose": "Bounded startup catalog of audit-pseudonym material references.\n\nThe 1..=32 bound and cross-entry uniqueness are enforced by config\nvalidation and repeated by the material provider before loading secrets.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
-        "local_reference": "#/$defs/AuditPseudonymMaterialCatalogConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -80275,8 +83457,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -80311,52 +83493,63 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/authorized_workload",
-        "key_path": "consultation.authorized_workload",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/password_env",
+        "key_path": "consultation.source_credentials[].password_env",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ConsultationWorkloadConfig",
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -80391,59 +83584,55 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "audience",
-            "client_claim_selector",
-            "client_value",
-            "principal_id"
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig"
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/source_credentials",
-        "key_path": "consultation.source_credentials",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/ref",
+        "key_path": "consultation.source_credentials[].ref",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Exact private-binding credential reference grammar.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
-        "local_reference": "#/$defs/ConsultationSourceCredentialCatalogConfig",
+        "local_reference": "#/$defs/ConsultationSourceCredentialReference",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -80492,44 +83681,47 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9._-]{0,95}$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig"
+        "pointer": "/$defs/ConsultationSourceCredentialReference"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationConfig/properties/state_plane",
-        "key_path": "consultation.state_plane",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/type",
+        "key_path": "consultation.source_credentials[].type",
         "path_kind": "property"
       },
       "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ConsultationStatePlaneConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -80564,43 +83756,43 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "const",
           "value": [
-            "database_url_env",
-            "chain_key_epoch_id",
-            "serving_fence_lock_key",
-            "audit_pseudonym_keyring_lock_key"
+            "api_key_header",
+            "api_key_query",
+            "basic",
+            "oauth_client_credentials",
+            "static_bearer"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/class",
-        "key_path": "consultation.artifacts.evidence[].class",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/username_env",
+        "key_path": "consultation.source_credentials[].username_env",
         "path_kind": "property"
       },
-      "purpose": "Closed evidence classes understood by consultation source-plan v1.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -80608,7 +83800,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationEvidenceClassConfig",
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
@@ -80617,8 +83809,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -80653,21 +83845,19 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "conformance",
-            "negative_security",
-            "minimization"
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
@@ -80676,19 +83866,19 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceClassConfig"
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/path",
-        "key_path": "consultation.artifacts.evidence[].path",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/1/properties/token_env",
+        "key_path": "consultation.source_credentials[].token_env",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -80696,16 +83886,17 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -80747,26 +83938,33 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/sha256",
-        "key_path": "consultation.artifacts.evidence[].sha256",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/2/properties/value_env",
+        "key_path": "consultation.source_credentials[].value_env",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -80774,6 +83972,7 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
@@ -80782,8 +83981,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -80818,52 +84017,58 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig/items",
-        "key_path": "consultation.source_credentials[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_id_env",
+        "key_path": "consultation.source_credentials[].client_id_env",
+        "path_kind": "property"
       },
-      "purpose": "Closed V1 source-credential provider configuration.\n\nEnvironment names are opaque references and are redacted from `Debug`.\nThere is deliberately no field capable of carrying an embedded username,\npassword, bearer token, or provider-specific extension.",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ConsultationSourceCredentialConfig",
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -80905,78 +84110,51 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "ref",
-              "generation",
-              "client_id_env",
-              "client_secret_env"
-            ],
-            [
-              "type",
-              "ref",
-              "generation",
-              "token_env"
-            ],
-            [
-              "type",
-              "ref",
-              "generation",
-              "username_env",
-              "password_env"
-            ],
-            [
-              "type",
-              "ref",
-              "generation",
-              "value_env"
-            ]
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig"
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/generation",
-        "key_path": "consultation.source_credentials[].generation",
+        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_secret_env",
+        "key_path": "consultation.source_credentials[].client_secret_env",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -81018,56 +84196,50 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/password_env",
-        "key_path": "consultation.source_credentials[].password_env",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/audit_pseudonym_keyring_lock_key",
+        "key_path": "consultation.state_plane.audit_pseudonym_keyring_lock_key",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81109,32 +84281,37 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+          "keyword": "format",
+          "value": "int64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/ref",
-        "key_path": "consultation.source_credentials[].ref",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/chain_key_epoch_id",
+        "key_path": "consultation.state_plane.chain_key_epoch_id",
         "path_kind": "property"
       },
-      "purpose": "Exact private-binding credential reference grammar.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -81143,12 +84320,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationSourceCredentialReference",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -81199,30 +84375,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9._-]{0,95}$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialReference"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/type",
-        "key_path": "consultation.source_credentials[].type",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/database_url_env",
+        "key_path": "consultation.state_plane.database_url_env",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "purpose": "Portable environment-variable name that resolves the state-plane URL.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -81230,6 +84398,7 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationDatabaseUrlEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
@@ -81239,7 +84408,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -81281,54 +84450,52 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "const",
-          "value": [
-            "api_key_header",
-            "api_key_query",
-            "basic",
-            "oauth_client_credentials",
-            "static_bearer"
-          ]
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationDatabaseUrlEnvironmentName"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/username_env",
-        "key_path": "consultation.source_credentials[].username_env",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/root_certificate_path",
+        "key_path": "consultation.state_plane.root_certificate_path",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81370,51 +84537,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/1/properties/token_env",
-        "key_path": "consultation.source_credentials[].token_env",
+        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/serving_fence_lock_key",
+        "key_path": "consultation.state_plane.serving_fence_lock_key",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81456,33 +84618,38 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+          "keyword": "format",
+          "value": "int64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 9223372036854775807
+        },
+        {
+          "keyword": "minimum",
+          "value": -9223372036854775808
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/2/properties/value_env",
-        "key_path": "consultation.source_credentials[].value_env",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
+        "key_path": "consultation.artifacts.integration_packs[].hash",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -81490,7 +84657,6 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
@@ -81500,7 +84666,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81542,33 +84708,30 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+          "value": "^sha256:[0-9a-f]{64}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_id_env",
-        "key_path": "consultation.source_credentials[].client_id_env",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
+        "key_path": "consultation.artifacts.private_bindings[].hash",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -81576,7 +84739,6 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
@@ -81586,7 +84748,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81628,33 +84790,30 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+          "value": "^sha256:[0-9a-f]{64}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_secret_env",
-        "key_path": "consultation.source_credentials[].client_secret_env",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
+        "key_path": "consultation.artifacts.public_contracts[].hash",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name used only as a credential reference.",
+      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -81662,7 +84821,6 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationCredentialEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
@@ -81672,7 +84830,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81714,45 +84872,42 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
+          "value": "^sha256:[0-9a-f]{64}$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationCredentialEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/audit_pseudonym_keyring_lock_key",
-        "key_path": "consultation.state_plane.audit_pseudonym_keyring_lock_key",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.integration_packs[].path",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Normalized bundle-root-relative path.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -81803,33 +84958,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/chain_key_epoch_id",
-        "key_path": "consultation.state_plane.chain_key_epoch_id",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.private_bindings[].path",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Normalized bundle-root-relative path.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -81902,13 +85045,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/database_url_env",
-        "key_path": "consultation.state_plane.database_url_env",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
+        "key_path": "consultation.artifacts.public_contracts[].path",
         "path_kind": "property"
       },
-      "purpose": "Portable environment-variable name that resolves the state-plane URL.",
+      "purpose": "Normalized bundle-root-relative path.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_secret_reference",
+      "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -81916,17 +85059,16 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ConsultationDatabaseUrlEnvironmentName",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -81968,52 +85110,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationDatabaseUrlEnvironmentName"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/root_certificate_path",
-        "key_path": "consultation.state_plane.root_certificate_path",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.integration_packs[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -82048,53 +85181,51 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationStatePlaneConfig/properties/serving_fence_lock_key",
-        "key_path": "consultation.state_plane.serving_fence_lock_key",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.private_bindings[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -82129,45 +85260,34 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "int64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 9223372036854775807
-        },
-        {
-          "keyword": "minimum",
-          "value": -9223372036854775808
+          "keyword": "pattern",
+          "value": "^sha256:[0-9a-f]{64}$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
-        "key_path": "consultation.artifacts.integration_packs[].hash",
+        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
+        "key_path": "consultation.artifacts.public_contracts[].sha256",
         "path_kind": "property"
       },
-      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
+      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -82183,8 +85303,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -82219,14 +85339,11 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -82243,12 +85360,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
-        "key_path": "consultation.artifacts.private_bindings[].hash",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/audience",
+        "key_path": "consultation.authorized_workload.audience",
         "path_kind": "property"
       },
-      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -82261,7 +85378,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -82312,10 +85429,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -82325,13 +85438,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash",
-        "key_path": "consultation.artifacts.public_contracts[].hash",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_claim_selector",
+        "key_path": "consultation.authorized_workload.client_claim_selector",
         "path_kind": "property"
       },
-      "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.",
+      "purpose": "Closed set of verified OAuth claims that may identify Registry Notary.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -82339,6 +85452,7 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/ConsultationClientClaimSelectorConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -82347,8 +85461,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -82383,36 +85497,40 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
+          "keyword": "enum",
+          "value": [
+            "azp",
+            "client_id"
+          ]
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ConsultationClientClaimSelectorConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.integration_packs[].path",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_value",
+        "key_path": "consultation.authorized_workload.client_value",
         "path_kind": "property"
       },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -82485,12 +85603,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.private_bindings[].path",
+        "pointer": "/$defs/ConsultationWorkloadConfig/properties/principal_id",
+        "key_path": "consultation.authorized_workload.principal_id",
         "path_kind": "property"
       },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_consultation_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -82563,27 +85681,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path",
-        "key_path": "consultation.artifacts.public_contracts[].path",
+        "pointer": "/$defs/CorsConfig/properties/allowed_origins",
+        "key_path": "server.cors.allowed_origins",
         "path_kind": "property"
       },
-      "purpose": "Normalized bundle-root-relative path.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_sensitive",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_server_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -82634,20 +85753,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.integration_packs[].sha256",
-        "path_kind": "property"
+        "pointer": "/$defs/CorsConfig/properties/allowed_origins/items",
+        "key_path": "server.cors.allowed_origins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_server_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -82657,14 +85776,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -82699,18 +85818,17 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -82720,13 +85838,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.private_bindings[].sha256",
+        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/name",
+        "key_path": "auth.api_keys[].fingerprint.name",
         "path_kind": "property"
       },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -82734,6 +85852,7 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/RuntimeEnvironmentNameSchema",
         "composed": false
       },
       "requiredness": "required",
@@ -82742,8 +85861,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -82778,34 +85897,40 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
+          "value": "^[^=\\x00]+$"
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RuntimeEnvironmentNameSchema"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256",
-        "key_path": "consultation.artifacts.public_contracts[].sha256",
+        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/provider",
+        "key_path": "auth.api_keys[].fingerprint.provider",
         "path_kind": "property"
       },
-      "purpose": "Raw file hash recorded by Registry Config Bundle v1.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -82821,8 +85946,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -82857,17 +85982,22 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^sha256:[0-9a-f]{64}$"
+          "keyword": "const",
+          "value": [
+            "env",
+            "file"
+          ]
         },
         {
           "keyword": "type",
@@ -82878,13 +86008,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/audience",
-        "key_path": "consultation.authorized_workload.audience",
+        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/1/properties/path",
+        "key_path": "auth.api_keys[].fingerprint.path",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "intent_profile": "relay_auth_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -82901,7 +86031,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -82943,8 +86073,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
@@ -82956,28 +86085,29 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_claim_selector",
-        "key_path": "consultation.authorized_workload.client_claim_selector",
+        "pointer": "/$defs/CsvFormatConfig/properties/delimiter",
+        "key_path": "datasets[].tables[].source.format.csv.delimiter",
         "path_kind": "property"
       },
-      "purpose": "Closed set of verified OAuth claims that may identify Registry Notary.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
-        "local_reference": "#/$defs/ConsultationClientClaimSelectorConfig",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -83024,49 +86154,55 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "azp",
-            "client_id"
-          ]
+          "keyword": "format",
+          "value": "uint8"
+        },
+        {
+          "keyword": "maximum",
+          "value": 255
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ConsultationClientClaimSelectorConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_value",
-        "key_path": "consultation.authorized_workload.client_value",
+        "pointer": "/$defs/CsvFormatConfig/properties/header_row",
+        "key_path": "datasets[].tables[].source.format.csv.header_row",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83101,50 +86237,64 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ConsultationWorkloadConfig/properties/principal_id",
-        "key_path": "consultation.authorized_workload.principal_id",
+        "pointer": "/$defs/CsvFormatConfig/properties/quote",
+        "key_path": "datasets[].tables[].source.format.csv.quote",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83179,51 +86329,63 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint8"
+        },
+        {
+          "keyword": "maximum",
+          "value": 255
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CorsConfig/properties/allowed_origins",
-        "key_path": "server.cors.allowed_origins",
+        "pointer": "/$defs/DatasetConfig/properties/access_rights",
+        "key_path": "datasets[].access_rights",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
+      "purpose": "Access rights classification, mirrors DCAT-AP `dcterms:accessRights`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/AccessRights",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83258,50 +86420,60 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "public",
+            "restricted",
+            "non_public"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AccessRights"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CorsConfig/properties/allowed_origins/items",
-        "key_path": "server.cors.allowed_origins[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DatasetConfig/properties/aggregates",
+        "key_path": "datasets[].aggregates",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83336,51 +86508,48 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/name",
-        "key_path": "auth.api_keys[].fingerprint.name",
-        "path_kind": "property"
+        "pointer": "/$defs/DatasetConfig/properties/aggregates/items",
+        "key_path": "datasets[].aggregates[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
+      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/RuntimeEnvironmentNameSchema",
+        "local_reference": "#/$defs/AggregateConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83415,57 +86584,60 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[^=\\x00]+$"
+          "keyword": "required",
+          "value": [
+            "id",
+            "description",
+            "disclosure_control"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/RuntimeEnvironmentNameSchema"
+        "pointer": "/$defs/AggregateConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/provider",
-        "key_path": "auth.api_keys[].fingerprint.provider",
+        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation",
+        "key_path": "datasets[].applicable_legislation",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
+      "purpose": "DCAT-AP `dcatap:applicableLegislation` IRIs. This is evidence\npublished for standard consumers, not an application-specific\nauthorization or source-of-truth verdict.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83500,39 +86672,30 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "env",
-            "file"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CredentialFingerprintSchema/oneOf/1/properties/path",
-        "key_path": "auth.api_keys[].fingerprint.path",
-        "path_kind": "property"
+        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation/items",
+        "key_path": "datasets[].applicable_legislation[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_secret_reference",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -83542,14 +86705,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -83584,14 +86747,12 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -83603,8 +86764,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CsvFormatConfig/properties/delimiter",
-        "key_path": "datasets[].tables[].source.format.csv.delimiter",
+        "pointer": "/$defs/DatasetConfig/properties/conforms_to",
+        "key_path": "datasets[].conforms_to",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -83615,13 +86776,12 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -83671,33 +86831,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint8"
-        },
-        {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CsvFormatConfig/properties/header_row",
-        "key_path": "datasets[].tables[].source.format.csv.header_row",
-        "path_kind": "property"
+        "pointer": "/$defs/DatasetConfig/properties/conforms_to/items",
+        "key_path": "datasets[].conforms_to[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -83707,17 +86852,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -83763,53 +86906,38 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/CsvFormatConfig/properties/quote",
-        "key_path": "datasets[].tables[].source.format.csv.quote",
+        "pointer": "/$defs/DatasetConfig/properties/defaults",
+        "key_path": "datasets[].defaults",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Optional table defaults for reducing repetition within one dataset.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "object"
         ],
+        "local_reference": "#/$defs/DatasetDefaultsConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -83855,36 +86983,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint8"
-        },
-        {
-          "keyword": "maximum",
-          "value": 255
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetDefaultsConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/access_rights",
-        "key_path": "datasets[].access_rights",
+        "pointer": "/$defs/DatasetConfig/properties/description",
+        "key_path": "datasets[].description",
         "path_kind": "property"
       },
-      "purpose": "Access rights classification, mirrors DCAT-AP `dcterms:accessRights`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -83893,12 +87010,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/AccessRights",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -83946,29 +87062,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "public",
-            "restricted",
-            "non_public"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/AccessRights"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/aggregates",
-        "key_path": "datasets[].aggregates",
+        "pointer": "/$defs/DatasetConfig/properties/entities",
+        "key_path": "datasets[].entities",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -84043,12 +87147,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/aggregates/items",
-        "key_path": "datasets[].aggregates[]",
+        "pointer": "/$defs/DatasetConfig/properties/entities/items",
+        "key_path": "datasets[].entities[]",
         "path_kind": "array_item"
       },
-      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -84057,7 +87161,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateConfig",
+        "local_reference": "#/$defs/EntityConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -84113,9 +87217,10 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "description",
-            "disclosure_control"
+            "name",
+            "table",
+            "access",
+            "api"
           ]
         },
         {
@@ -84125,17 +87230,17 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig"
+        "pointer": "/$defs/EntityConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation",
-        "key_path": "datasets[].applicable_legislation",
+        "pointer": "/$defs/DatasetConfig/properties/id",
+        "key_path": "datasets[].id",
         "path_kind": "property"
       },
-      "purpose": "DCAT-AP `dcatap:applicableLegislation` IRIs. This is evidence\npublished for standard consumers, not an application-specific\nauthorization or source-of-truth verdict.",
+      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -84143,16 +87248,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84198,18 +87303,26 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/applicable_legislation/items",
-        "key_path": "datasets[].applicable_legislation[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DatasetConfig/properties/owner",
+        "key_path": "datasets[].owner",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -84223,11 +87336,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84282,12 +87395,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/conforms_to",
-        "key_path": "datasets[].conforms_to",
+        "pointer": "/$defs/DatasetConfig/properties/public_services",
+        "key_path": "datasets[].public_services",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "CPSV public services that produce this dataset. Registry Relay emits\nthem as standard `cpsv:PublicService` nodes; consumers decide how to\ninterpret that evidence.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -84302,8 +87415,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84358,8 +87471,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/conforms_to/items",
-        "key_path": "datasets[].conforms_to[]",
+        "pointer": "/$defs/DatasetConfig/properties/public_services/items",
+        "key_path": "datasets[].public_services[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -84370,13 +87483,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/PublicServiceConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
@@ -84424,20 +87538,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "title"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/PublicServiceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/defaults",
-        "key_path": "datasets[].defaults",
+        "pointer": "/$defs/DatasetConfig/properties/sensitivity",
+        "key_path": "datasets[].sensitivity",
         "path_kind": "property"
       },
-      "purpose": "Optional table defaults for reducing repetition within one dataset.",
+      "purpose": "Sensitivity classification. Operator-defined values cover common\npersonal and public dataset classifications in V1.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -84445,17 +87569,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DatasetDefaultsConfig",
+        "local_reference": "#/$defs/Sensitivity",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84501,40 +87624,52 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "public",
+            "internal",
+            "personal",
+            "confidential",
+            "secret"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetDefaultsConfig"
+        "pointer": "/$defs/Sensitivity"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/description",
-        "key_path": "datasets[].description",
+        "pointer": "/$defs/DatasetConfig/properties/spatial_coverage",
+        "key_path": "datasets[].spatial_coverage",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "BRegDCAT-AP: `dct:spatial` IRI for this dataset. Overrides the\ncatalog-level `default_spatial_coverage` when set.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84582,35 +87717,39 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/entities",
-        "key_path": "datasets[].entities",
+        "pointer": "/$defs/DatasetConfig/properties/status",
+        "key_path": "datasets[].status",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Publishes the dataset lifecycle status; when omitted, Relay emits its weakest lifecycle claim instead of inferring a stronger status.",
+      "purpose_source": "reviewed_override",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84656,18 +87795,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "under_development",
+            "completed",
+            "deprecated",
+            "withdrawn"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/entities/items",
-        "key_path": "datasets[].entities[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DatasetConfig/properties/tables",
+        "key_path": "datasets[].tables",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -84677,16 +87828,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/EntityConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84732,33 +87883,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "table",
-            "access",
-            "api"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/id",
-        "key_path": "datasets[].id",
-        "path_kind": "property"
+        "pointer": "/$defs/DatasetConfig/properties/tables/items",
+        "key_path": "datasets[].tables[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
+      "purpose": "One private storage table under a dataset.\n\nThe public API should not expose these ids. Entity config maps one\nresource into one domain resource, with optional field renaming and\nrelationship declarations.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -84766,16 +87904,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/DatasetId",
+        "local_reference": "#/$defs/ResourceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -84822,24 +87960,28 @@
       ],
       "constraints": [
         {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
+          "keyword": "required",
+          "value": [
+            "id",
+            "source",
+            "schema"
+          ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetId"
+        "pointer": "/$defs/ResourceConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/owner",
-        "key_path": "datasets[].owner",
+        "pointer": "/$defs/DatasetConfig/properties/title",
+        "key_path": "datasets[].title",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -84906,111 +88048,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/public_services",
-        "key_path": "datasets[].public_services",
-        "path_kind": "property"
-      },
-      "purpose": "CPSV public services that produce this dataset. Registry Relay emits\nthem as standard `cpsv:PublicService` nodes; consumers decide how to\ninterpret that evidence.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/public_services/items",
-        "key_path": "datasets[].public_services[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DatasetConfig/properties/update_frequency",
+        "key_path": "datasets[].update_frequency",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Update cadence; mirrors DCAT-AP `dcterms:accrualPeriodicity`. The\nV1 set is the codes used by the example plus the common alternates.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/PublicServiceConfig",
+        "local_reference": "#/$defs/UpdateFrequency",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85057,29 +88123,38 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "enum",
           "value": [
-            "title"
+            "continuous",
+            "daily",
+            "weekly",
+            "termly",
+            "monthly",
+            "quarterly",
+            "annual",
+            "irregular",
+            "as_needed",
+            "unknown"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig"
+        "pointer": "/$defs/UpdateFrequency"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/sensitivity",
-        "key_path": "datasets[].sensitivity",
+        "pointer": "/$defs/DatasetDefaultsConfig/properties/materialization",
+        "key_path": "datasets[].defaults.materialization",
         "path_kind": "property"
       },
-      "purpose": "Sensitivity classification. Operator-defined values cover common\npersonal and public dataset classifications in V1.",
+      "purpose": "How a configured private table is registered for query planning.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -85087,16 +88162,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/Sensitivity",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85145,32 +88221,27 @@
         {
           "keyword": "enum",
           "value": [
-            "public",
-            "internal",
-            "personal",
-            "confidential",
-            "secret"
+            "snapshot"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "string"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Sensitivity"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/spatial_coverage",
-        "key_path": "datasets[].spatial_coverage",
+        "pointer": "/$defs/DatasetDefaultsConfig/properties/refresh",
+        "key_path": "datasets[].defaults.refresh",
         "path_kind": "property"
       },
-      "purpose": "BRegDCAT-AP: `dct:spatial` IRI for this dataset. Overrides the\ncatalog-level `default_spatial_coverage` when set.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -85178,16 +88249,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85233,11 +88304,23 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "mode",
+              "interval"
+            ],
+            [
+              "mode"
+            ]
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -85245,13 +88328,94 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/status",
-        "key_path": "datasets[].status",
+        "pointer": "/$defs/DeploymentConfig/properties/evidence",
+        "key_path": "deployment.evidence",
         "path_kind": "property"
       },
-      "purpose": "Publishes the dataset lifecycle status; when omitted, Relay emits its weakest lifecycle claim instead of inferring a stronger status.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_deployment_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/DeploymentEvidenceConfig",
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentEvidenceConfig"
+      }
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentConfig/properties/profile",
+        "key_path": "deployment.profile",
+        "path_kind": "property"
+      },
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -85316,10 +88480,10 @@
         {
           "keyword": "enum",
           "value": [
-            "under_development",
-            "completed",
-            "deprecated",
-            "withdrawn"
+            "local",
+            "hosted_lab",
+            "production",
+            "evidence_grade"
           ]
         },
         {
@@ -85334,13 +88498,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/tables",
-        "key_path": "datasets[].tables",
+        "pointer": "/$defs/DeploymentConfig/properties/waivers",
+        "key_path": "deployment.waivers",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Per-deployment waivers. Each names one finding id, a required operator\nreference, an optional summary, and a mandatory expiry date. Expired\nwaivers stop suppressing their finding and raise\n`deployment.waiver_expired`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -85410,13 +88574,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/tables/items",
-        "key_path": "datasets[].tables[]",
+        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
+        "key_path": "deployment.waivers[]",
         "path_kind": "array_item"
       },
-      "purpose": "One private storage table under a dataset.\n\nThe public API should not expose these ids. Entity config maps one\nresource into one domain resource, with optional field renaming and\nrelationship declarations.",
+      "purpose": "One declared waiver. `expires` is an ISO 8601 `YYYY-MM-DD` date; format is\nvalidated at load time. The reference and optional summary are validated by\nthe shared operations contract before either can reach posture or logs.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -85424,7 +88588,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ResourceConfig",
+        "local_reference": "#/$defs/DeploymentWaiverConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -85480,9 +88644,9 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "source",
-            "schema"
+            "finding",
+            "reference",
+            "expires"
           ]
         },
         {
@@ -85492,36 +88656,37 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig"
+        "pointer": "/$defs/DeploymentWaiverConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/title",
-        "key_path": "datasets[].title",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/api_key_rotation",
+        "key_path": "deployment.evidence.api_key_rotation",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Operator asserts an API-key rotation process is in place.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -85556,48 +88721,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetConfig/properties/update_frequency",
-        "key_path": "datasets[].update_frequency",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
+        "key_path": "deployment.evidence.audit_ack_cursor_path",
         "path_kind": "property"
       },
-      "purpose": "Update cadence; mirrors DCAT-AP `dcterms:accrualPeriodicity`. The\nV1 set is the codes used by the example plus the common alternates.",
+      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. When set, the runtime reads it to\nobserve shipping freshness and surfaces it as posture shipping health;\nabsent, shipping health stays `unverified` and only the declared\nshipping target is reported.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_deployment_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/UpdateFrequency",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -85632,65 +88800,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "continuous",
-            "daily",
-            "weekly",
-            "termly",
-            "monthly",
-            "quarterly",
-            "annual",
-            "irregular",
-            "as_needed",
-            "unknown"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/UpdateFrequency"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetDefaultsConfig/properties/materialization",
-        "key_path": "datasets[].defaults.materialization",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
+        "key_path": "deployment.evidence.audit_ack_max_age_secs",
         "path_kind": "property"
       },
-      "purpose": "How a configured private table is registered for query planning.",
+      "purpose": "Optional freshness window in seconds for the ack cursor's `acked_at`\ntimestamp. Defaults to `DEFAULT_AUDIT_ACK_MAX_AGE` (900) when unset. A\nwindow without `audit_ack_cursor_path` is rejected at load, since a\nfreshness window is meaningless without a cursor to observe.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer",
+          "null"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85737,16 +88891,22 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "snapshot"
-          ]
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "string"
+            "integer",
+            "null"
           ]
         }
       ]
@@ -85754,29 +88914,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DatasetDefaultsConfig/properties/refresh",
-        "key_path": "datasets[].defaults.refresh",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
+        "key_path": "deployment.evidence.audit_offhost_shipping",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Operator asserts audit records are shipped off-host (for example to a\nlog collector or SIEM) rather than relying solely on local retention.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "boolean"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85822,53 +88981,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "mode",
-              "interval"
-            ],
-            [
-              "mode"
-            ]
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/evidence",
-        "key_path": "deployment.evidence",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/ingress_rate_limit",
+        "key_path": "deployment.evidence.ingress_rate_limit",
         "path_kind": "property"
       },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Operator asserts ingress rate limiting is enforced (for example by a\ngateway or reverse proxy in front of the relay).",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/DeploymentEvidenceConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85916,19 +89059,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/profile",
-        "key_path": "deployment.profile",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
+        "key_path": "deployment.waivers[].expires",
         "path_kind": "property"
       },
       "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
@@ -85939,17 +89078,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -85995,49 +89132,36 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "local",
-            "hosted_lab",
-            "production",
-            "evidence_grade"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers",
-        "key_path": "deployment.waivers",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
+        "key_path": "deployment.waivers[].finding",
         "path_kind": "property"
       },
-      "purpose": "Per-deployment waivers. Each names one finding id, a required operator\nreference, an optional summary, and a mandatory expiry date. Expired\nwaivers stop suppressing their finding and raise\n`deployment.waiver_expired`.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86085,35 +89209,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
-        "key_path": "deployment.waivers[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
+        "key_path": "deployment.waivers[].reference",
+        "path_kind": "property"
       },
-      "purpose": "One declared waiver. `expires` is an ISO 8601 `YYYY-MM-DD` date; format is\nvalidated at load time. The reference and optional summary are validated by\nthe shared operations contract before either can reach posture or logs.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverConfig",
+        "local_reference": "#/$defs/DeploymentWaiverReference",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86160,51 +89284,56 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "finding",
-            "reference",
-            "expires"
-          ]
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig"
+        "pointer": "/$defs/DeploymentWaiverReference"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/api_key_rotation",
-        "key_path": "deployment.evidence.api_key_rotation",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
+        "key_path": "deployment.waivers[].summary",
         "path_kind": "property"
       },
-      "purpose": "Operator asserts an API-key rotation process is in place.",
+      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_sensitive",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
+        "local_reference": "#/$defs/DeploymentWaiverSummary",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -86239,51 +89368,60 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DeploymentWaiverSummary"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
-        "key_path": "deployment.evidence.audit_ack_cursor_path",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method",
+        "key_path": "datasets[].aggregates[].disclosure_control.method",
         "path_kind": "property"
       },
-      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. When set, the runtime reads it to\nobserve shipping freshness and surfaces it as posture shipping health;\nabsent, shipping health stays `unverified` and only the declared\nshipping target is reported.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_sensitive",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -86318,47 +89456,41 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
-        "key_path": "deployment.evidence.audit_ack_max_age_secs",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method",
         "path_kind": "property"
       },
-      "purpose": "Optional freshness window in seconds for the ack cursor's `acked_at`\ntimestamp. Defaults to `DEFAULT_AUDIT_ACK_MAX_AGE` (900) when unset. A\nwindow without `audit_ack_cursor_path` is rejected at load, since a\nfreshness window is meaningless without a cursor to observe.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -86408,43 +89540,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
-        "key_path": "deployment.evidence.audit_offhost_shipping",
+        "pointer": "/$defs/DisclosureControlConfig/properties/method",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method",
         "path_kind": "property"
       },
-      "purpose": "Operator asserts audit records are shipped off-host (for example to a\nlog collector or SIEM) rather than relying solely on local retention.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
@@ -86501,35 +89618,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/ingress_rate_limit",
-        "key_path": "deployment.evidence.ingress_rate_limit",
-        "path_kind": "property"
+        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
+        "key_path": "datasets[].aggregates[].disclosure_control.method[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Operator asserts ingress rate limiting is enforced (for example by a\ngateway or reverse proxy in front of the relay).",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86577,20 +89693,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
-        "key_path": "deployment.waivers[].expires",
-        "path_kind": "property"
+        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -86600,11 +89716,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86659,13 +89775,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
-        "key_path": "deployment.waivers[].finding",
-        "path_kind": "property"
+        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -86675,11 +89791,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86734,28 +89850,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
-        "key_path": "deployment.waivers[].reference",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
+        "key_path": "datasets[].aggregates[].disclosure_control.min_cell_size",
         "path_kind": "property"
       },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverReference",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86802,53 +89918,48 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
+          "keyword": "format",
+          "value": "uint32"
         },
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "maximum",
+          "value": 4294967295
         },
         {
-          "keyword": "pattern",
-          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverReference"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
-        "key_path": "deployment.waivers[].summary",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_cell_size",
         "path_kind": "property"
       },
-      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_deployment_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverSummary",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -86895,28 +90006,28 @@
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
+          "keyword": "format",
+          "value": "uint32"
         },
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentWaiverSummary"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method",
-        "key_path": "datasets[].aggregates[].disclosure_control.method",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_cell_size",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -86927,7 +90038,7 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -86982,33 +90093,46 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
+        "key_path": "datasets[].aggregates[].disclosure_control.min_group_size",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
+      "purpose_source": "reviewed_override",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -87058,33 +90182,49 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method",
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_group_size",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
+      "purpose_source": "reviewed_override",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -87135,110 +90275,52 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
-        "key_path": "datasets[].aggregates[].disclosure_control.method[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.method[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_group_size",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
+      "purpose_source": "reviewed_override",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -87284,18 +90366,33 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/method/items",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.method[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
+        "key_path": "datasets[].aggregates[].disclosure_control.report_suppressed_rows",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -87305,15 +90402,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -87361,15 +90459,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
-        "key_path": "datasets[].aggregates[].disclosure_control.min_cell_size",
+        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.report_suppressed_rows",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -87380,7 +90478,7 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -87435,29 +90533,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_cell_size",
+        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.report_suppressed_rows",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -87468,7 +90554,7 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -87523,29 +90609,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_cell_size",
+        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
+        "key_path": "datasets[].aggregates[].disclosure_control.suppression",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -87556,16 +90630,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -87612,49 +90687,49 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "const",
+          "value": [
+            "mask",
+            "null",
+            "omit"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/Suppression"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
-        "key_path": "datasets[].aggregates[].disclosure_control.min_group_size",
+        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
+        "key_path": "datasets[].entities[].aggregates[].disclosure_control.suppression",
         "path_kind": "property"
       },
-      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
+        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -87701,52 +90776,49 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "const",
+          "value": [
+            "mask",
+            "null",
+            "omit"
+          ]
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/Suppression"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_group_size",
+        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
+        "key_path": "datasets[].tables[].aggregates[].disclosure_control.suppression",
         "path_kind": "property"
       },
-      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
-      "purpose_source": "reviewed_override",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
+        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -87793,52 +90865,47 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "const",
+          "value": [
+            "mask",
+            "null",
+            "omit"
+          ]
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/Suppression"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_group_size",
+        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/id",
+        "key_path": "metadata.ecosystem_binding.id",
         "path_kind": "property"
       },
-      "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_metadata_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -87880,53 +90947,38 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
-        "key_path": "datasets[].aggregates[].disclosure_control.report_suppressed_rows",
+        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/version",
+        "key_path": "metadata.ecosystem_binding.version",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_metadata_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -87971,21 +91023,23 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.report_suppressed_rows",
+        "pointer": "/$defs/EntityAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].entities[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -87996,16 +91050,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88053,15 +91106,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.report_suppressed_rows",
+        "pointer": "/$defs/EntityAccessConfig/properties/evidence_verification_scope",
+        "key_path": "datasets[].entities[].access.evidence_verification_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88072,13 +91125,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -88129,15 +91182,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
-        "key_path": "datasets[].aggregates[].disclosure_control.suppression",
+        "pointer": "/$defs/EntityAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].entities[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88150,15 +91203,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88204,29 +91255,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "mask",
-            "null",
-            "omit"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Suppression"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
-        "key_path": "datasets[].entities[].aggregates[].disclosure_control.suppression",
+        "pointer": "/$defs/EntityAccessConfig/properties/read_scope",
+        "key_path": "datasets[].entities[].access.read_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88239,15 +91278,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88293,29 +91330,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "mask",
-            "null",
-            "omit"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Suppression"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/DisclosureControlConfig/properties/suppression",
-        "key_path": "datasets[].tables[].aggregates[].disclosure_control.suppression",
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions",
+        "key_path": "datasets[].entities[].api.allowed_expansions",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88326,17 +91351,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/Suppression",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88382,34 +91406,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "mask",
-            "null",
-            "omit"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/Suppression"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/id",
-        "key_path": "metadata.ecosystem_binding.id",
-        "path_kind": "property"
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions/items",
+        "key_path": "datasets[].entities[].api.allowed_expansions[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -88419,11 +91431,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88465,7 +91477,8 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -88477,87 +91490,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/version",
-        "key_path": "metadata.ecosystem_binding.version",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].entities[].access.aggregate_scope",
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters",
+        "key_path": "datasets[].entities[].api.allowed_filters",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88568,15 +91502,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88624,35 +91559,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/evidence_verification_scope",
-        "key_path": "datasets[].entities[].access.evidence_verification_scope",
-        "path_kind": "property"
+        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].entities[].api.allowed_filters[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AllowedFilter",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88698,17 +91633,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "field",
+            "ops"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AllowedFilter"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].entities[].access.metadata_scope",
+        "pointer": "/$defs/EntityApiConfig/properties/default_limit",
+        "key_path": "datasets[].entities[].api.default_limit",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88719,13 +91665,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -88773,17 +91719,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig/properties/read_scope",
-        "key_path": "datasets[].entities[].access.read_scope",
+        "pointer": "/$defs/EntityApiConfig/properties/governed_policy",
+        "key_path": "datasets[].entities[].api.governed_policy",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88794,15 +91752,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88850,15 +91810,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions",
-        "key_path": "datasets[].entities[].api.allowed_expansions",
+        "pointer": "/$defs/EntityApiConfig/properties/max_limit",
+        "key_path": "datasets[].entities[].api.max_limit",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -88869,16 +91832,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -88924,18 +91886,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions/items",
-        "key_path": "datasets[].entities[].api.allowed_expansions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EntityApiConfig/properties/require_purpose_header",
+        "key_path": "datasets[].entities[].api.require_purpose_header",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -88945,15 +91919,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89001,19 +91976,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters",
-        "key_path": "datasets[].entities[].api.allowed_filters",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings",
+        "key_path": "datasets[].entities[].api.required_filter_bindings",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the query.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -89084,12 +92059,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].entities[].api.allowed_filters[]",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings/items",
+        "key_path": "datasets[].entities[].api.required_filter_bindings[]",
         "path_kind": "array_item"
       },
-      "purpose": "A single allowed filter: field name + permitted operators.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -89098,7 +92073,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AllowedFilter",
+        "local_reference": "#/$defs/RequiredFilterBindingConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -89154,8 +92129,7 @@
         {
           "keyword": "required",
           "value": [
-            "field",
-            "ops"
+            "field"
           ]
         },
         {
@@ -89165,33 +92139,34 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
+        "pointer": "/$defs/RequiredFilterBindingConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/default_limit",
-        "key_path": "datasets[].entities[].api.default_limit",
+        "pointer": "/$defs/EntityApiConfig/properties/required_filters",
+        "key_path": "datasets[].entities[].api.required_filters",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Alternative fields that can satisfy the row-scope gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89237,30 +92212,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/governed_policy",
-        "key_path": "datasets[].entities[].api.governed_policy",
-        "path_kind": "property"
+        "pointer": "/$defs/EntityApiConfig/properties/required_filters/items",
+        "key_path": "datasets[].entities[].api.required_filters[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -89270,17 +92233,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89328,18 +92289,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/max_limit",
-        "key_path": "datasets[].entities[].api.max_limit",
+        "pointer": "/$defs/EntityConfig/properties/access",
+        "key_path": "datasets[].entities[].access",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -89350,8 +92308,9 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/EntityAccessConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -89405,28 +92364,28 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "metadata_scope",
+            "aggregate_scope",
+            "read_scope"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/EntityAccessConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/require_purpose_header",
-        "key_path": "datasets[].entities[].api.require_purpose_header",
+        "pointer": "/$defs/EntityConfig/properties/aggregates",
+        "key_path": "datasets[].entities[].aggregates",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -89437,7 +92396,7 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
@@ -89445,8 +92404,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89494,18 +92453,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings",
-        "key_path": "datasets[].entities[].api.required_filter_bindings",
-        "path_kind": "property"
+        "pointer": "/$defs/EntityConfig/properties/aggregates/items",
+        "key_path": "datasets[].entities[].aggregates[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the query.",
+      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -89513,16 +92472,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89568,18 +92527,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "description",
+            "disclosure_control"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings/items",
-        "key_path": "datasets[].entities[].api.required_filter_bindings[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EntityConfig/properties/api",
+        "key_path": "datasets[].entities[].api",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -89591,14 +92562,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingConfig",
+        "local_reference": "#/$defs/EntityApiConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89647,7 +92618,8 @@
         {
           "keyword": "required",
           "value": [
-            "field"
+            "default_limit",
+            "max_limit"
           ]
         },
         {
@@ -89657,17 +92629,17 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig"
+        "pointer": "/$defs/EntityApiConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filters",
-        "key_path": "datasets[].entities[].api.required_filters",
+        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles",
+        "key_path": "datasets[].entities[].attribute_release_profiles",
         "path_kind": "property"
       },
-      "purpose": "Alternative fields that can satisfy the row-scope gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.",
+      "purpose": "Governed identity attribute-release profiles attached to this entity.\nEach profile resolves exactly one subject and returns only the\nconfigured, minimised claims. Empty by default (feature opt-in).",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -89683,8 +92655,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89739,10 +92711,101 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig/properties/required_filters/items",
-        "key_path": "datasets[].entities[].api.required_filters[]",
+        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles/items",
+        "key_path": "datasets[].entities[].attribute_release_profiles[]",
         "path_kind": "array_item"
       },
+      "purpose": "A governed identity attribute-release profile. A profile is a\nprojection-limited, exactly-one-subject lookup that maps a configured set of\nsource fields (or CEL-computed expressions) into a minimised\nOIDC/UserInfo-style claim bundle. Every profile is purpose-bound and requires\na matching `data-purpose` at resolve time. Identified globally by the\n`(id, version)` pair; both are required path segments at resolve time.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/AttributeReleaseProfile",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "version",
+            "purpose",
+            "release_scope",
+            "subject",
+            "claims"
+          ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
+        }
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AttributeReleaseProfile"
+      }
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/EntityConfig/properties/concept_uri",
+        "key_path": "datasets[].entities[].concept_uri",
+        "path_kind": "property"
+      },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
@@ -89751,15 +92814,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89807,15 +92872,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/access",
-        "key_path": "datasets[].entities[].access",
+        "pointer": "/$defs/EntityConfig/properties/description",
+        "key_path": "datasets[].entities[].description",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -89826,16 +92894,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/EntityAccessConfig",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -89882,28 +92951,19 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "metadata_scope",
-            "aggregate_scope",
-            "read_scope"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityAccessConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/aggregates",
-        "key_path": "datasets[].entities[].aggregates",
+        "pointer": "/$defs/EntityConfig/properties/fields",
+        "key_path": "datasets[].entities[].fields",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -89978,12 +93038,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/aggregates/items",
-        "key_path": "datasets[].entities[].aggregates[]",
+        "pointer": "/$defs/EntityConfig/properties/fields/items",
+        "key_path": "datasets[].entities[].fields[]",
         "path_kind": "array_item"
       },
-      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -89992,7 +93052,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateConfig",
+        "local_reference": "#/$defs/EntityFieldConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -90048,9 +93108,7 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "description",
-            "disclosure_control"
+            "name"
           ]
         },
         {
@@ -90060,14 +93118,14 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig"
+        "pointer": "/$defs/EntityFieldConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/api",
-        "key_path": "datasets[].entities[].api",
+        "pointer": "/$defs/EntityConfig/properties/name",
+        "key_path": "datasets[].entities[].name",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -90078,14 +93136,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/EntityApiConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -90133,32 +93190,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "default_limit",
-            "max_limit"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityApiConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles",
-        "key_path": "datasets[].entities[].attribute_release_profiles",
+        "pointer": "/$defs/EntityConfig/properties/relationships",
+        "key_path": "datasets[].entities[].relationships",
         "path_kind": "property"
       },
-      "purpose": "Governed identity attribute-release profiles attached to this entity.\nEach profile resolves exactly one subject and returns only the\nconfigured, minimised claims. Empty by default (feature opt-in).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -90229,12 +93275,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles/items",
-        "key_path": "datasets[].entities[].attribute_release_profiles[]",
+        "pointer": "/$defs/EntityConfig/properties/relationships/items",
+        "key_path": "datasets[].entities[].relationships[]",
         "path_kind": "array_item"
       },
-      "purpose": "A governed identity attribute-release profile. A profile is a\nprojection-limited, exactly-one-subject lookup that maps a configured set of\nsource fields (or CEL-computed expressions) into a minimised\nOIDC/UserInfo-style claim bundle. Every profile is purpose-bound and requires\na matching `data-purpose` at resolve time. Identified globally by the\n`(id, version)` pair; both are required path segments at resolve time.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -90243,7 +93289,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AttributeReleaseProfile",
+        "local_reference": "#/$defs/EntityRelationshipConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -90299,12 +93345,10 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "version",
-            "purpose",
-            "release_scope",
-            "subject",
-            "claims"
+            "name",
+            "kind",
+            "target",
+            "foreign_key"
           ]
         },
         {
@@ -90314,14 +93358,14 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AttributeReleaseProfile"
+        "pointer": "/$defs/EntityRelationshipConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/concept_uri",
-        "key_path": "datasets[].entities[].concept_uri",
+        "pointer": "/$defs/EntityConfig/properties/spatial",
+        "key_path": "datasets[].entities[].spatial",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -90333,16 +93377,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90389,90 +93433,16 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "geometry"
           ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/description",
-        "key_path": "datasets[].entities[].description",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -90480,28 +93450,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/fields",
-        "key_path": "datasets[].entities[].fields",
+        "pointer": "/$defs/EntityConfig/properties/table",
+        "key_path": "datasets[].entities[].table",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Resource identifier within a dataset.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/ResourceId",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90547,18 +93517,26 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/fields/items",
-        "key_path": "datasets[].entities[].fields[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EntityConfig/properties/title",
+        "key_path": "datasets[].entities[].title",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -90568,16 +93546,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/EntityFieldConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90624,26 +93603,19 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "name"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/name",
-        "key_path": "datasets[].entities[].name",
+        "pointer": "/$defs/EntityFieldConfig/properties/codelist",
+        "key_path": "datasets[].entities[].fields[].codelist",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -90654,15 +93626,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90710,15 +93684,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/relationships",
-        "key_path": "datasets[].entities[].relationships",
+        "pointer": "/$defs/EntityFieldConfig/properties/concept_uri",
+        "key_path": "datasets[].entities[].fields[].concept_uri",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -90729,16 +93706,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90786,16 +93764,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/relationships/items",
-        "key_path": "datasets[].entities[].relationships[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EntityFieldConfig/properties/from",
+        "key_path": "datasets[].entities[].fields[].from",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -90805,16 +93786,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/EntityRelationshipConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90861,29 +93843,19 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "name",
-            "kind",
-            "target",
-            "foreign_key"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/spatial",
-        "key_path": "datasets[].entities[].spatial",
+        "pointer": "/$defs/EntityFieldConfig/properties/language",
+        "key_path": "datasets[].entities[].fields[].language",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -90895,16 +93867,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -90950,17 +93922,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "geometry"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -90968,12 +93934,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/table",
-        "key_path": "datasets[].entities[].table",
+        "pointer": "/$defs/EntityFieldConfig/properties/name",
+        "key_path": "datasets[].entities[].fields[].name",
         "path_kind": "property"
       },
-      "purpose": "Resource identifier within a dataset.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -90982,12 +93948,11 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/ResourceId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -91035,25 +94000,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityConfig/properties/title",
-        "key_path": "datasets[].entities[].title",
+        "pointer": "/$defs/EntityFieldConfig/properties/sensitive",
+        "key_path": "datasets[].entities[].fields[].sensitive",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91064,14 +94021,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -91122,18 +94078,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/codelist",
-        "key_path": "datasets[].entities[].fields[].codelist",
+        "pointer": "/$defs/EntityFieldConfig/properties/unit",
+        "key_path": "datasets[].entities[].fields[].unit",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91212,8 +94165,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/concept_uri",
-        "key_path": "datasets[].entities[].fields[].concept_uri",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/concept_uri",
+        "key_path": "datasets[].entities[].relationships[].concept_uri",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91292,32 +94245,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/from",
-        "key_path": "datasets[].entities[].fields[].from",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/foreign_key",
+        "key_path": "datasets[].entities[].relationships[].foreign_key",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -91352,28 +94303,27 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/language",
-        "key_path": "datasets[].entities[].fields[].language",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/kind",
+        "key_path": "datasets[].entities[].relationships[].kind",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91384,17 +94334,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/RelationshipKind",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -91441,19 +94390,28 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "belongs_to",
+            "has_many",
+            "has_one"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RelationshipKind"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/name",
-        "key_path": "datasets[].entities[].fields[].name",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/name",
+        "key_path": "datasets[].entities[].relationships[].name",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91527,8 +94485,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/sensitive",
-        "key_path": "datasets[].entities[].fields[].sensitive",
+        "pointer": "/$defs/EntityRelationshipConfig/properties/target",
+        "key_path": "datasets[].entities[].relationships[].target",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91539,16 +94497,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -91596,15 +94553,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityFieldConfig/properties/unit",
-        "key_path": "datasets[].entities[].fields[].unit",
+        "pointer": "/$defs/EntitySpatialConfig/properties/bbox_fields",
+        "key_path": "datasets[].entities[].spatial.bbox_fields",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91616,16 +94573,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -91671,11 +94628,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "min_x",
+            "min_y",
+            "max_x",
+            "max_y"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -91683,8 +94649,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/concept_uri",
-        "key_path": "datasets[].entities[].relationships[].concept_uri",
+        "pointer": "/$defs/EntitySpatialConfig/properties/collection_id",
+        "key_path": "datasets[].entities[].spatial.collection_id",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91763,30 +94729,32 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/foreign_key",
-        "key_path": "datasets[].entities[].relationships[].foreign_key",
+        "pointer": "/$defs/EntitySpatialConfig/properties/datetime_field",
+        "key_path": "datasets[].entities[].spatial.datetime_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -91821,27 +94789,28 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/kind",
-        "key_path": "datasets[].entities[].relationships[].kind",
+        "pointer": "/$defs/EntitySpatialConfig/properties/description",
+        "key_path": "datasets[].entities[].spatial.description",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91852,16 +94821,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/RelationshipKind",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -91908,28 +94878,19 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
           "value": [
-            "belongs_to",
-            "has_many",
-            "has_one"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RelationshipKind"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/name",
-        "key_path": "datasets[].entities[].relationships[].name",
+        "pointer": "/$defs/EntitySpatialConfig/properties/geometry",
+        "key_path": "datasets[].entities[].spatial.geometry",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -91940,13 +94901,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/SpatialGeometryConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -91994,17 +94956,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "kind",
+              "field",
+              "crs"
+            ],
+            [
+              "kind",
+              "longitude_field",
+              "latitude_field",
+              "crs"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SpatialGeometryConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntityRelationshipConfig/properties/target",
-        "key_path": "datasets[].entities[].relationships[].target",
+        "pointer": "/$defs/EntitySpatialConfig/properties/max_bbox_degrees",
+        "key_path": "datasets[].entities[].spatial.max_bbox_degrees",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92015,15 +94997,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "number"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -92069,17 +95052,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "double"
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "number"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/bbox_fields",
-        "key_path": "datasets[].entities[].spatial.bbox_fields",
+        "pointer": "/$defs/EntitySpatialConfig/properties/max_geometry_vertices",
+        "key_path": "datasets[].entities[].spatial.max_geometry_vertices",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92090,17 +95077,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "integer"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -92147,28 +95133,28 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "min_x",
-            "min_y",
-            "max_x",
-            "max_y"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/collection_id",
-        "key_path": "datasets[].entities[].spatial.collection_id",
+        "pointer": "/$defs/EntitySpatialConfig/properties/title",
+        "key_path": "datasets[].entities[].spatial.title",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92247,8 +95233,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/datetime_field",
-        "key_path": "datasets[].entities[].spatial.datetime_field",
+        "pointer": "/$defs/FieldConfig/properties/codelist",
+        "key_path": "datasets[].tables[].schema.fields[].codelist",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92327,8 +95313,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/description",
-        "key_path": "datasets[].entities[].spatial.description",
+        "pointer": "/$defs/FieldConfig/properties/concept_uri",
+        "key_path": "datasets[].tables[].schema.fields[].concept_uri",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92407,8 +95393,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/geometry",
-        "key_path": "datasets[].entities[].spatial.geometry",
+        "pointer": "/$defs/FieldConfig/properties/language",
+        "key_path": "datasets[].tables[].schema.fields[].language",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92419,16 +95405,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/SpatialGeometryConfig",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -92475,36 +95462,19 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            [
-              "kind",
-              "field",
-              "crs"
-            ],
-            [
-              "kind",
-              "longitude_field",
-              "latitude_field",
-              "crs"
-            ]
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/max_bbox_degrees",
-        "key_path": "datasets[].entities[].spatial.max_bbox_degrees",
+        "pointer": "/$defs/FieldConfig/properties/name",
+        "key_path": "datasets[].tables[].schema.fields[].name",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92515,16 +95485,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "number"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -92570,21 +95539,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "double"
-        },
         {
           "keyword": "type",
-          "value": "number"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/max_geometry_vertices",
-        "key_path": "datasets[].entities[].spatial.max_geometry_vertices",
+        "pointer": "/$defs/FieldConfig/properties/nullable",
+        "key_path": "datasets[].tables[].schema.fields[].nullable",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92595,7 +95560,7 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -92650,29 +95615,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/EntitySpatialConfig/properties/title",
-        "key_path": "datasets[].entities[].spatial.title",
+        "pointer": "/$defs/FieldConfig/properties/sensitive",
+        "key_path": "datasets[].tables[].schema.fields[].sensitive",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92683,14 +95636,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -92741,39 +95693,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/codelist",
-        "key_path": "datasets[].tables[].schema.fields[].codelist",
+        "pointer": "/$defs/FieldConfig/properties/type",
+        "key_path": "datasets[].tables[].schema.fields[].type",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Physical type of a column. The set is fixed in V1; semantic types\nare carried via `concept_uri`.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/FieldType",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -92820,19 +95768,31 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
             "string",
-            "null"
+            "number",
+            "integer",
+            "boolean",
+            "date",
+            "timestamp"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/FieldType"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/concept_uri",
-        "key_path": "datasets[].tables[].schema.fields[].concept_uri",
+        "pointer": "/$defs/FieldConfig/properties/unit",
+        "key_path": "datasets[].tables[].schema.fields[].unit",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92911,8 +95871,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/language",
-        "key_path": "datasets[].tables[].schema.fields[].language",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance",
+        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -92923,14 +95883,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -92981,19 +95940,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/name",
-        "key_path": "datasets[].tables[].schema.fields[].name",
-        "path_kind": "property"
+        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance/items",
+        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -93007,11 +95963,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -93066,8 +96022,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/nullable",
-        "key_path": "datasets[].tables[].schema.fields[].nullable",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/max_source_age_seconds",
+        "key_path": "datasets[].entities[].api.governed_policy.max_source_age_seconds",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93078,12 +96034,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -93133,17 +96090,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/sensitive",
-        "key_path": "datasets[].tables[].schema.fields[].sensitive",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/minimum_assurance",
+        "key_path": "datasets[].entities[].api.governed_policy.minimum_assurance",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93154,13 +96126,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -93211,35 +96184,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/type",
-        "key_path": "datasets[].tables[].schema.fields[].type",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions",
         "path_kind": "property"
       },
-      "purpose": "Physical type of a column. The set is fixed in V1; semantic types\nare carried via `concept_uri`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/FieldType",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -93285,33 +96261,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "string",
-            "number",
-            "integer",
-            "boolean",
-            "date",
-            "timestamp"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldType"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/FieldConfig/properties/unit",
-        "key_path": "datasets[].tables[].schema.fields[].unit",
-        "path_kind": "property"
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions/items",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -93321,17 +96282,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -93379,18 +96338,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance",
-        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93465,8 +96421,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance/items",
-        "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance[]",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes/items",
+        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93540,8 +96496,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/max_source_age_seconds",
-        "key_path": "datasets[].entities[].api.governed_policy.max_source_age_seconds",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields",
+        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93552,13 +96508,12 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -93608,33 +96563,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/minimum_assurance",
-        "key_path": "datasets[].entities[].api.governed_policy.minimum_assurance",
-        "path_kind": "property"
+        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields/items",
+        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -93644,17 +96584,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -93702,18 +96640,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/require_consent",
+        "key_path": "datasets[].entities[].api.governed_policy.require_consent",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93724,7 +96659,7 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -93781,16 +96716,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions/items",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/GovernedPolicyConfig/properties/require_legal_basis",
+        "key_path": "datasets[].entities[].api.governed_policy.require_legal_basis",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -93800,15 +96735,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -93856,15 +96792,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes",
+        "pointer": "/$defs/GovernedPolicyConfig/properties/trusted_context",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -93875,16 +96811,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/GovernedTrustedContextConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -93932,16 +96869,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/GovernedTrustedContextConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes/items",
-        "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/asserted_assurance",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.asserted_assurance",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -93951,15 +96892,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -94007,15 +96950,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields",
-        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/consent_ref",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.consent_ref",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -94026,13 +96972,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -94083,16 +97030,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields/items",
-        "key_path": "datasets[].entities[].api.governed_policy.redaction_fields[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/jurisdiction",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.jurisdiction",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
@@ -94102,15 +97052,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -94158,15 +97110,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/require_consent",
-        "key_path": "datasets[].entities[].api.governed_policy.require_consent",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/legal_basis_ref",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.legal_basis_ref",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -94177,13 +97132,14 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -94234,15 +97190,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/require_legal_basis",
-        "key_path": "datasets[].entities[].api.governed_policy.require_legal_basis",
+        "pointer": "/$defs/GovernedTrustedContextConfig/properties/source_observed_age_seconds",
+        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.source_observed_age_seconds",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -94253,12 +97212,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -94308,41 +97268,56 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedPolicyConfig/properties/trusted_context",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context",
+        "pointer": "/$defs/InstanceConfig/properties/environment",
+        "key_path": "instance.environment",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_instance_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/GovernedTrustedContextConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -94360,12 +97335,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -94377,37 +97352,112 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig"
-      }
+        "pointer": "/$defs/InstanceConfig/properties/id",
+        "key_path": "instance.id",
+        "path_kind": "property"
+      },
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_instance_public",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "public",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/asserted_assurance",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.asserted_assurance",
+        "pointer": "/$defs/InstanceConfig/properties/jurisdiction",
+        "key_path": "instance.jurisdiction",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_instance_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "null",
@@ -94423,7 +97473,7 @@
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -94441,12 +97491,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -94458,12 +97508,12 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -94478,16 +97528,16 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/consent_ref",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.consent_ref",
+        "pointer": "/$defs/InstanceConfig/properties/owner",
+        "key_path": "instance.owner",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_instance_public",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
       "field_type": {
         "schema_types": [
           "null",
@@ -94503,7 +97553,7 @@
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "public",
       "state": "runtime",
       "products": [
         "relay",
@@ -94521,12 +97571,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -94538,12 +97588,12 @@
       "review_classes": [
         "contract",
         "relay",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -94558,29 +97608,29 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/jurisdiction",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.jurisdiction",
+        "pointer": "/$defs/MetadataConfig/properties/ecosystem_binding",
+        "key_path": "metadata.ecosystem_binding",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_metadata_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -94622,15 +97672,20 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -94638,29 +97693,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/legal_basis_ref",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.legal_basis_ref",
+        "pointer": "/$defs/MetadataConfig/properties/source",
+        "key_path": "metadata.source",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_metadata_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/MetadataSourceConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -94702,42 +97756,48 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "path"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/MetadataSourceConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/GovernedTrustedContextConfig/properties/source_observed_age_seconds",
-        "key_path": "datasets[].entities[].api.governed_policy.trusted_context.source_observed_age_seconds",
+        "pointer": "/$defs/MetadataSourceConfig/properties/digest",
+        "key_path": "metadata.source.digest",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_metadata_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -94782,26 +97842,13 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
           "value": [
-            "integer",
+            "string",
             "null"
           ]
         }
@@ -94810,32 +97857,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/environment",
-        "key_path": "instance.environment",
+        "pointer": "/$defs/MetadataSourceConfig/properties/path",
+        "key_path": "metadata.source.path",
         "path_kind": "property"
       },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
+      "purpose": "Controls Relay metadata publication and registry-description behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
+      "intent_profile": "relay_metadata_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -94853,12 +97898,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -94870,51 +97915,50 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/id",
-        "key_path": "instance.id",
+        "pointer": "/$defs/OidcConfig/properties/allow_dev_insecure_fetch_urls",
+        "key_path": "auth.oidc.allow_dev_insecure_fetch_urls",
         "path_kind": "property"
       },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
+      "purpose": "Development-only escape hatch that permits loopback HTTP issuer,\ndiscovery, and JWKS URLs. Private non-loopback networks and cloud\nmetadata endpoints remain denied by the platform fetch policy.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -94932,12 +97976,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -94949,49 +97993,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
         "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/jurisdiction",
-        "key_path": "instance.jurisdiction",
+        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms",
+        "key_path": "auth.oidc.allowed_algorithms",
         "path_kind": "property"
       },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
+      "purpose": "Signature algorithms accepted by the verifier. Defaults to\nRS256, ES256, EdDSA. HS\\* and `none` are intentionally absent\nfrom [`OidcAlgorithm`].",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -95009,12 +98055,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -95026,52 +98072,48 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/InstanceConfig/properties/owner",
-        "key_path": "instance.owner",
-        "path_kind": "property"
+        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms/items",
+        "key_path": "auth.oidc.allowed_algorithms[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_instance_public",
+      "purpose": "JWS signature algorithms accepted by the OIDC verifier. Symmetric\nalgorithms (`HS*`) and `none` are intentionally absent: shared-secret\nJWTs are unsafe between a resource server and an IdP, and `none`\ndisables verification entirely.\n\nYAML values are the canonical JWA `alg` strings (`RS256`, `ES256`,\n`EdDSA`), case-sensitive.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
-      "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/OidcAlgorithm",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "public",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -95089,12 +98131,12 @@
       "introduced_in": null,
       "version_history": [],
       "example": {
-        "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.",
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
         "schema_examples_available": false,
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
       "consumers": [
         "registry_relay",
         "docs_generator"
@@ -95106,49 +98148,57 @@
       "review_classes": [
         "contract",
         "relay",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "RS256",
+            "ES256",
+            "EdDSA"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/OidcAlgorithm"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/MetadataConfig/properties/ecosystem_binding",
-        "key_path": "metadata.ecosystem_binding",
+        "pointer": "/$defs/OidcConfig/properties/allowed_clients",
+        "key_path": "auth.oidc.allowed_clients",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
+      "purpose": "Optional allowlist of client identifiers, matched against the\ntoken's `azp` (preferred) or `client_id` claim. Empty list\nmeans any client is accepted.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -95190,49 +98240,40 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/MetadataConfig/properties/source",
-        "key_path": "metadata.source",
-        "path_kind": "property"
+        "pointer": "/$defs/OidcConfig/properties/allowed_clients/items",
+        "key_path": "auth.oidc.allowed_clients[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/MetadataSourceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -95274,54 +98315,44 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "path"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/MetadataSourceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/MetadataSourceConfig/properties/digest",
-        "key_path": "metadata.source.digest",
+        "pointer": "/$defs/OidcConfig/properties/allowed_token_types",
+        "key_path": "auth.oidc.allowed_token_types",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_internal",
+      "purpose": "Accepted `typ` JOSE header values. Defaults to `JWT` and\n`at+jwt` (RFC 9068). ID tokens (`id+jwt`) are not access tokens\nand are rejected by default. Tokens without `typ` are rejected by\nthe shared verifier.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -95356,32 +98387,33 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/MetadataSourceConfig/properties/path",
-        "key_path": "metadata.source.path",
-        "path_kind": "property"
+        "pointer": "/$defs/OidcConfig/properties/allowed_token_types/items",
+        "key_path": "auth.oidc.allowed_token_types[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay metadata publication and registry-description behavior.",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_metadata_sensitive",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -95391,11 +98423,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -95440,7 +98472,8 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -95452,11 +98485,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allow_dev_insecure_fetch_urls",
-        "key_path": "auth.oidc.allow_dev_insecure_fetch_urls",
+        "pointer": "/$defs/OidcConfig/properties/audiences",
+        "key_path": "auth.oidc.audiences",
         "path_kind": "property"
       },
-      "purpose": "Development-only escape hatch that permits loopback HTTP issuer,\ndiscovery, and JWKS URLs. Private non-loopback networks and cloud\nmetadata endpoints remain denied by the platform fetch policy.",
+      "purpose": "One or more accepted `aud` values. Tokens with no `aud`, or\nwhose `aud` does not intersect this list, are rejected.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
@@ -95464,16 +98497,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -95521,82 +98553,6 @@
         "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "boolean"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms",
-        "key_path": "auth.oidc.allowed_algorithms",
-        "path_kind": "property"
-      },
-      "purpose": "Signature algorithms accepted by the verifier. Defaults to\nRS256, ES256, EdDSA. HS\\* and `none` are intentionally absent\nfrom [`OidcAlgorithm`].",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
       "constraints": [
         {
           "keyword": "type",
@@ -95607,13 +98563,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_algorithms/items",
-        "key_path": "auth.oidc.allowed_algorithms[]",
+        "pointer": "/$defs/OidcConfig/properties/audiences/items",
+        "key_path": "auth.oidc.audiences[]",
         "path_kind": "array_item"
       },
-      "purpose": "JWS signature algorithms accepted by the OIDC verifier. Symmetric\nalgorithms (`HS*`) and `none` are intentionally absent: shared-secret\nJWTs are unsafe between a resource server and an IdP, and `none`\ndisables verification entirely.\n\nYAML values are the canonical JWA `alg` strings (`RS256`, `ES256`,\n`EdDSA`), case-sensitive.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -95621,17 +98577,16 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/OidcAlgorithm",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -95666,60 +98621,52 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "RS256",
-            "ES256",
-            "EdDSA"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/OidcAlgorithm"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_clients",
-        "key_path": "auth.oidc.allowed_clients",
+        "pointer": "/$defs/OidcConfig/properties/discovery_url",
+        "key_path": "auth.oidc.discovery_url",
         "path_kind": "property"
       },
-      "purpose": "Optional allowlist of client identifiers, matched against the\ntoken's `azp` (preferred) or `client_id` claim. Empty list\nmeans any client is accepted.",
+      "purpose": "OIDC discovery document URL\n(`.well-known/openid-configuration`). The JWKS URL is resolved\nfrom `jwks_uri` in the discovered document.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -95754,30 +98701,36 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_clients/items",
-        "key_path": "auth.oidc.allowed_clients[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/OidcConfig/properties/issuer",
+        "key_path": "auth.oidc.issuer",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Issuer URL. Compared verbatim against the JWT `iss` claim.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -95787,14 +98740,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -95829,11 +98782,14 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -95846,31 +98802,32 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_token_types",
-        "key_path": "auth.oidc.allowed_token_types",
+        "pointer": "/$defs/OidcConfig/properties/jwks_cache_ttl",
+        "key_path": "auth.oidc.jwks_cache_ttl",
         "path_kind": "property"
       },
-      "purpose": "Accepted `typ` JOSE header values. Defaults to `JWT` and\n`at+jwt` (RFC 9068). ID tokens (`id+jwt`) are not access tokens\nand are rejected by default. Tokens without `typ` are rejected by\nthe shared verifier.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -95905,47 +98862,58 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/allowed_token_types/items",
-        "key_path": "auth.oidc.allowed_token_types[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/OidcConfig/properties/jwks_url",
+        "key_path": "auth.oidc.jwks_url",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "JWKS endpoint. Either this or `discovery_url` must be set.\n`discovery_url` takes precedence: when both are configured the\nvalidator rejects the document.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -95996,37 +98964,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/audiences",
-        "key_path": "auth.oidc.audiences",
+        "pointer": "/$defs/OidcConfig/properties/leeway",
+        "key_path": "auth.oidc.leeway",
         "path_kind": "property"
       },
-      "purpose": "One or more accepted `aud` values. Tokens with no `aud`, or\nwhose `aud` does not intersect this list, are rejected.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -96061,33 +99034,42 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/audiences/items",
-        "key_path": "auth.oidc.audiences[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/OidcConfig/properties/scope_claim",
+        "key_path": "auth.oidc.scope_claim",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
+      "purpose": "JWT claim whose value carries scopes. Defaults to `scope`, the\nRFC 8693 / RFC 9068 space-separated form. Some IdPs use `scp`\nor `permissions`; the value may be a string, an array of strings,\nor an object keyed by scope name.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -96097,14 +99079,15 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -96139,14 +99122,11 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -96159,32 +99139,31 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/discovery_url",
-        "key_path": "auth.oidc.discovery_url",
+        "pointer": "/$defs/OidcConfig/properties/scope_map",
+        "key_path": "auth.oidc.scope_map",
         "path_kind": "property"
       },
-      "purpose": "OIDC discovery document URL\n(`.well-known/openid-configuration`). The JWKS URL is resolved\nfrom `jwks_uri` in the discovered document.",
+      "purpose": "Optional rename map: `external_scope -> internal_scope`. Applied\nafter parsing the scope claim, before scope-based access checks\nrun. Useful for adapting IdP role names (`role:foo`) to the\nrelay's `<dataset_id>:<level>` shape.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -96219,36 +99198,30 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/issuer",
-        "key_path": "auth.oidc.issuer",
-        "path_kind": "property"
+        "pointer": "/$defs/OidcConfig/properties/scope_map/additionalProperties",
+        "key_path": "auth.oidc.scope_map.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Issuer URL. Compared verbatim against the JWT `iss` claim.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
+      "purpose": "Each reviewed key is an external token scope and each value is the bounded Relay scope mapping granted for that exact token scope.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_auth_oidc_scope_map_open_map",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -96258,14 +99231,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "relay",
@@ -96300,15 +99273,12 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -96320,32 +99290,31 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/jwks_cache_ttl",
-        "key_path": "auth.oidc.jwks_cache_ttl",
+        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys",
+        "key_path": "auth.oidc.scope_object_required_keys",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Keys that must be present inside object-valued role claim values\nbefore the role key is treated as an active scope. Object-valued\nclaims grant no scopes when this list is empty.\nThis is useful for IdPs such as Zitadel where role values are\nkeyed by organization id.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -96380,58 +99349,47 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/jwks_url",
-        "key_path": "auth.oidc.jwks_url",
-        "path_kind": "property"
+        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys/items",
+        "key_path": "auth.oidc.scope_object_required_keys[]",
+        "path_kind": "array_item"
       },
-      "purpose": "JWKS endpoint. Either this or `discovery_url` must be set.\n`discovery_url` takes precedence: when both are configured the\nvalidator rejects the document.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_auth_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -96482,23 +99440,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/leeway",
-        "key_path": "auth.oidc.leeway",
+        "pointer": "/$defs/PostgresTableConfig/properties/name",
+        "key_path": "datasets[].tables[].source.table.name",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -96506,15 +99461,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -96560,45 +99513,109 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
+      ]
+    },
+    {
+      "address": {
         "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+        "pointer": "/$defs/PostgresTableConfig/properties/schema",
+        "key_path": "datasets[].tables[].source.table.schema",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_claim",
-        "key_path": "auth.oidc.scope_claim",
+        "pointer": "/$defs/PublicServiceConfig/properties/description",
+        "key_path": "datasets[].public_services[].description",
         "path_kind": "property"
       },
-      "purpose": "JWT claim whose value carries scopes. Defaults to `scope`, the\nRFC 8693 / RFC 9068 space-separated form. Some IdPs use `scp`\nor `permissions`; the value may be a string, an array of strings,\nor an object keyed by scope name.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
@@ -96650,32 +99667,36 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_map",
-        "key_path": "auth.oidc.scope_map",
+        "pointer": "/$defs/PublicServiceConfig/properties/id",
+        "key_path": "datasets[].public_services[].id",
         "path_kind": "property"
       },
-      "purpose": "Optional rename map: `external_scope -> internal_scope`. Applied\nafter parsing the scope claim, before scope-based access checks\nrun. Useful for adapting IdP role names (`role:foo`) to the\nrelay's `<dataset_id>:<level>` shape.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -96726,20 +99747,23 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_map/additionalProperties",
-        "key_path": "auth.oidc.scope_map.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/PublicServiceConfig/properties/title",
+        "key_path": "datasets[].public_services[].title",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key is an external token scope and each value is the bounded Relay scope mapping granted for that exact token scope.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_oidc_scope_map_open_map",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -96749,14 +99773,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -96796,7 +99820,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -96808,31 +99832,32 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys",
-        "key_path": "auth.oidc.scope_object_required_keys",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
+        "key_path": "datasets[].defaults.refresh.interval",
         "path_kind": "property"
       },
-      "purpose": "Keys that must be present inside object-valued role claim values\nbefore the role key is treated as an active scope. Object-valued\nclaims grant no scopes when this list is empty.\nThis is useful for IdPs such as Zitadel where role values are\nkeyed by organization id.",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "conditional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -96867,33 +99892,42 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys/items",
-        "key_path": "auth.oidc.scope_object_required_keys[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
+        "key_path": "datasets[].tables[].refresh.interval",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_auth_sensitive",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -96901,16 +99935,18 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "conditional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -96945,28 +99981,37 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/PostgresTableConfig/properties/name",
-        "key_path": "datasets[].tables[].source.table.name",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].defaults.refresh.mode",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -96983,7 +100028,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -97031,6 +100076,14 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "interval",
+            "manual",
+            "mtime"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -97040,8 +100093,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/PostgresTableConfig/properties/schema",
-        "key_path": "datasets[].tables[].source.table.schema",
+        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
+        "key_path": "datasets[].tables[].refresh.mode",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -97058,7 +100111,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -97106,6 +100159,14 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "interval",
+            "manual",
+            "mtime"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -97115,8 +100176,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig/properties/description",
-        "key_path": "datasets[].public_services[].description",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/expression",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -97128,16 +100189,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97183,11 +100244,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "cel"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -97195,12 +100262,12 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig/properties/id",
-        "key_path": "datasets[].public_services[].id",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/format",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].format",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Optional value format hint.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -97275,8 +100342,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/PublicServiceConfig/properties/title",
-        "key_path": "datasets[].public_services[].title",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/locale",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].locale",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -97287,15 +100354,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97343,18 +100412,21 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
-        "key_path": "datasets[].defaults.refresh.interval",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/name",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].name",
         "path_kind": "property"
       },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose": "Released claim name (lower-snake).",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -97364,15 +100436,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "conditional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97418,32 +100488,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval",
-        "key_path": "datasets[].tables[].refresh.interval",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/required",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].required",
         "path_kind": "property"
       },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose": "Whether the claim must be present; a missing required claim denies.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -97451,14 +100509,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "conditional",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -97507,29 +100564,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].defaults.refresh.mode",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/sensitivity",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].sensitivity",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -97540,15 +100585,17 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97595,43 +100642,49 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
+          "keyword": "enum",
           "value": [
-            "interval",
-            "manual",
-            "mtime"
+            "direct_identifier",
+            "personal",
+            "public",
+            "pseudonymous"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode",
-        "key_path": "datasets[].tables[].refresh.mode",
+        "pointer": "/$defs/ReleaseClaimConfig/properties/source_field",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].source_field",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Source field projected into the claim. XOR with `expression`.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97678,45 +100731,39 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
+          "keyword": "type",
           "value": [
-            "interval",
-            "manual",
-            "mtime"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/expression",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression",
+        "pointer": "/$defs/ReleaseConditionsConfig/properties/expression",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "A single CEL expression evaluated over the subject's source projection.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/ReleaseExpressionConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97770,98 +100817,19 @@
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/format",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].format",
-        "path_kind": "property"
-      },
-      "purpose": "Optional value format hint.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
       ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ReleaseExpressionConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/locale",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].locale",
+        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression.cel",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -97872,17 +100840,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -97930,22 +100896,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/name",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].name",
+        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression.cel",
         "path_kind": "property"
       },
-      "purpose": "Released claim name (lower-snake).",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -98015,11 +100978,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/required",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].required",
+        "pointer": "/$defs/ReleaseResponseConfig/properties/include_source_metadata",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].response.include_source_metadata",
         "path_kind": "property"
       },
-      "purpose": "Whether the claim must be present; a missing required claim denies.",
+      "purpose": "Whether to include profile-sourced metadata in the response body.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -98091,32 +101054,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/sensitivity",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].sensitivity",
+        "pointer": "/$defs/ReleaseSubjectConfig/properties/id_type",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.id_type",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Accepted identifier type label.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -98151,61 +101112,49 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "direct_identifier",
-            "personal",
-            "public",
-            "pseudonymous"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseClaimConfig/properties/source_field",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].source_field",
+        "pointer": "/$defs/ReleaseSubjectConfig/properties/source_field",
+        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.source_field",
         "path_kind": "property"
       },
-      "purpose": "Source field projected into the claim. XOR with `expression`.",
+      "purpose": "Source field used to match the subject. Must be an exposed entity field.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -98240,46 +101189,44 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseConditionsConfig/properties/expression",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].aggregates[].required_filter_bindings[].field",
         "path_kind": "property"
       },
-      "purpose": "A single CEL expression evaluated over the subject's source projection.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ReleaseExpressionConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -98327,27 +101274,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "cel"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ReleaseExpressionConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression.cel",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -98421,8 +101358,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseExpressionConfig/properties/cel",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression.cel",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].entities[].api.required_filter_bindings[].field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -98496,28 +101433,27 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseResponseConfig/properties/include_source_metadata",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].response.include_source_metadata",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].field",
         "path_kind": "property"
       },
-      "purpose": "Whether to include profile-sourced metadata in the response body.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -98565,20 +101501,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseSubjectConfig/properties/id_type",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.id_type",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].aggregates[].required_filter_bindings[].source",
         "path_kind": "property"
       },
-      "purpose": "Accepted identifier type label.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_sensitive",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -98586,16 +101522,18 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -98630,32 +101568,40 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "principal_id"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ReleaseSubjectConfig/properties/source_field",
-        "key_path": "datasets[].entities[].attribute_release_profiles[].subject.source_field",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].source",
         "path_kind": "property"
       },
-      "purpose": "Source field used to match the subject. Must be an exposed entity field.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_sensitive",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -98663,16 +101609,18 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -98707,27 +101655,35 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "principal_id"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].aggregates[].required_filter_bindings[].field",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].entities[].api.required_filter_bindings[].source",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -98740,13 +101696,15 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -98792,17 +101750,27 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "principal_id"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].field",
+        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
+        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].source",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -98815,13 +101783,15 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -98867,17 +101837,27 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "principal_id"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/RequiredFilterBindingSource"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].entities[].api.required_filter_bindings[].field",
+        "pointer": "/$defs/ResourceAccessConfig/properties/aggregate_scope",
+        "key_path": "datasets[].tables[].access.aggregate_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -98951,8 +101931,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/field",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].field",
+        "pointer": "/$defs/ResourceAccessConfig/properties/metadata_scope",
+        "key_path": "datasets[].tables[].access.metadata_scope",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -99026,8 +102006,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].aggregates[].required_filter_bindings[].source",
+        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters",
+        "key_path": "datasets[].tables[].api.allowed_filters",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -99038,17 +102018,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99095,26 +102074,103 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters/items",
+        "key_path": "datasets[].tables[].api.allowed_filters[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "object"
+        ],
+        "local_reference": "#/$defs/AllowedFilter",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
           "value": [
-            "principal_id"
+            "field",
+            "ops"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
+        "pointer": "/$defs/AllowedFilter"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].source",
+        "pointer": "/$defs/ResourceApiConfig/properties/default_limit",
+        "key_path": "datasets[].tables[].api.default_limit",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -99125,17 +102181,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99182,26 +102236,28 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].entities[].api.required_filter_bindings[].source",
+        "pointer": "/$defs/ResourceApiConfig/properties/max_limit",
+        "key_path": "datasets[].tables[].api.max_limit",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -99212,17 +102268,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99269,26 +102323,28 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingConfig/properties/source",
-        "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].source",
+        "pointer": "/$defs/ResourceApiConfig/properties/require_purpose_header",
+        "key_path": "datasets[].tables[].api.require_purpose_header",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -99299,17 +102355,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
-        "local_reference": "#/$defs/RequiredFilterBindingSource",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99355,46 +102410,38 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "principal_id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/RequiredFilterBindingSource"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceAccessConfig/properties/aggregate_scope",
-        "key_path": "datasets[].tables[].access.aggregate_scope",
+        "pointer": "/$defs/ResourceConfig/properties/access",
+        "key_path": "datasets[].tables[].access",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Resource-level scope assignments. Private tables are not exposed as row\nresources in beta; row access is configured on public entities.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ResourceAccessConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99440,17 +102487,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "metadata_scope",
+            "aggregate_scope"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceAccessConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceAccessConfig/properties/metadata_scope",
-        "key_path": "datasets[].tables[].access.metadata_scope",
+        "pointer": "/$defs/ResourceConfig/properties/aggregates",
+        "key_path": "datasets[].tables[].aggregates",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -99461,15 +102519,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99517,35 +102576,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters",
-        "key_path": "datasets[].tables[].api.allowed_filters",
-        "path_kind": "property"
+        "pointer": "/$defs/ResourceConfig/properties/aggregates/items",
+        "key_path": "datasets[].tables[].aggregates[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AggregateConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99591,20 +102650,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "description",
+            "disclosure_control"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AggregateConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters/items",
-        "key_path": "datasets[].tables[].api.allowed_filters[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ResourceConfig/properties/api",
+        "key_path": "datasets[].tables[].api",
+        "path_kind": "property"
       },
-      "purpose": "A single allowed filter: field name + permitted operators.",
+      "purpose": "Resource-level API knobs: per-field filter allowlist, limit caps,\nand the `Data-Purpose` requirement.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -99614,14 +102685,15 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AllowedFilter",
+        "local_reference": "#/$defs/ResourceApiConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99670,8 +102742,8 @@
         {
           "keyword": "required",
           "value": [
-            "field",
-            "ops"
+            "default_limit",
+            "max_limit"
           ]
         },
         {
@@ -99681,31 +102753,32 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AllowedFilter"
+        "pointer": "/$defs/ResourceApiConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/default_limit",
-        "key_path": "datasets[].tables[].api.default_limit",
+        "pointer": "/$defs/ResourceConfig/properties/id",
+        "key_path": "datasets[].tables[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Resource identifier within a dataset.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/ResourceId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -99754,47 +102827,45 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ResourceId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/max_limit",
-        "key_path": "datasets[].tables[].api.max_limit",
+        "pointer": "/$defs/ResourceConfig/properties/materialization",
+        "key_path": "datasets[].tables[].materialization",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "How a configured private table is registered for query planning.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -99841,51 +102912,49 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "enum",
+          "value": [
+            "snapshot"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig/properties/require_purpose_header",
-        "key_path": "datasets[].tables[].api.require_purpose_header",
+        "pointer": "/$defs/ResourceConfig/properties/primary_key",
+        "key_path": "datasets[].tables[].primary_key",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -99920,46 +102989,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/access",
-        "key_path": "datasets[].tables[].access",
+        "pointer": "/$defs/ResourceConfig/properties/refresh",
+        "key_path": "datasets[].tables[].refresh",
         "path_kind": "property"
       },
-      "purpose": "Resource-level scope assignments. Private tables are not exposed as row\nresources in beta; row access is configured on public entities.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/ResourceAccessConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100008,45 +103082,49 @@
         {
           "keyword": "required",
           "value": [
-            "metadata_scope",
-            "aggregate_scope"
+            [
+              "mode",
+              "interval"
+            ],
+            [
+              "mode"
+            ]
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceAccessConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/aggregates",
-        "key_path": "datasets[].tables[].aggregates",
+        "pointer": "/$defs/ResourceConfig/properties/schema",
+        "key_path": "datasets[].tables[].schema",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Declared resource schema. `strict` is the spec's `strict_schema`\nflag; on mismatch ingestion refuses to register the resource.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/SchemaConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100092,20 +103170,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "fields"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SchemaConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/aggregates/items",
-        "key_path": "datasets[].tables[].aggregates[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ResourceConfig/properties/source",
+        "key_path": "datasets[].tables[].source",
+        "path_kind": "property"
       },
-      "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.",
+      "purpose": "Source plugin selection. Tagged on `type:` so HTTP, S3, or additional\ndatabase variants can land additively later.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -100115,14 +103203,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AggregateConfig",
+        "local_reference": "#/$defs/SourceConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100171,9 +103259,14 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "description",
-            "disclosure_control"
+            [
+              "type",
+              "connection_env"
+            ],
+            [
+              "type",
+              "path"
+            ]
           ]
         },
         {
@@ -100183,35 +103276,35 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AggregateConfig"
+        "pointer": "/$defs/SourceConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/api",
-        "key_path": "datasets[].tables[].api",
+        "pointer": "/$defs/ResourceFormatConfig/properties/csv",
+        "key_path": "datasets[].tables[].source.format.csv",
         "path_kind": "property"
       },
-      "purpose": "Resource-level API knobs: per-field filter allowlist, limit caps,\nand the `Data-Purpose` requirement.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/ResourceApiConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100258,47 +103351,40 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "default_limit",
-            "max_limit"
+            "null",
+            "object"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceApiConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/id",
-        "key_path": "datasets[].tables[].id",
+        "pointer": "/$defs/ResourceFormatConfig/properties/parquet",
+        "key_path": "datasets[].tables[].source.format.parquet",
         "path_kind": "property"
       },
-      "purpose": "Resource identifier within a dataset.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "local_reference": "#/$defs/ResourceId",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100344,29 +103430,24 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ResourceId"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/materialization",
-        "key_path": "datasets[].tables[].materialization",
+        "pointer": "/$defs/ResourceFormatConfig/properties/xlsx",
+        "key_path": "datasets[].tables[].source.format.xlsx",
         "path_kind": "property"
       },
-      "purpose": "How a configured private table is registered for query planning.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -100374,13 +103455,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
         "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -100429,17 +103510,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "snapshot"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
             "null",
-            "string"
+            "object"
           ]
         }
       ]
@@ -100447,32 +103522,30 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/primary_key",
-        "key_path": "datasets[].tables[].primary_key",
+        "pointer": "/$defs/RotateConfig/properties/max_files",
+        "key_path": "audit.rotate.max_files",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -100507,51 +103580,55 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/refresh",
-        "key_path": "datasets[].tables[].refresh",
+        "pointer": "/$defs/RotateConfig/properties/max_size_mb",
+        "key_path": "audit.rotate.max_size_mb",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "integer"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100593,49 +103670,44 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            [
-              "mode",
-              "interval"
-            ],
-            [
-              "mode"
-            ]
-          ]
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/schema",
-        "key_path": "datasets[].tables[].schema",
+        "pointer": "/$defs/SchemaConfig/properties/fields",
+        "key_path": "datasets[].tables[].schema.fields",
         "path_kind": "property"
       },
-      "purpose": "Declared resource schema. `strict` is the spec's `strict_schema`\nflag; on mismatch ingestion refuses to register the resource.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/SchemaConfig",
         "composed": false
       },
       "requiredness": "required",
@@ -100688,30 +103760,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "fields"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SchemaConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceConfig/properties/source",
-        "key_path": "datasets[].tables[].source",
-        "path_kind": "property"
+        "pointer": "/$defs/SchemaConfig/properties/fields/items",
+        "key_path": "datasets[].tables[].schema.fields[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Source plugin selection. Tagged on `type:` so HTTP, S3, or additional\ndatabase variants can land additively later.",
+      "purpose": "One column in a resource schema. Physical type and optional\nsemantic annotations used by catalog and schema metadata.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
@@ -100721,14 +103783,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/SourceConfig",
+        "local_reference": "#/$defs/FieldConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100777,14 +103839,8 @@
         {
           "keyword": "required",
           "value": [
-            [
-              "type",
-              "connection_env"
-            ],
-            [
-              "type",
-              "path"
-            ]
+            "name",
+            "type"
           ]
         },
         {
@@ -100794,14 +103850,14 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig"
+        "pointer": "/$defs/FieldConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceFormatConfig/properties/csv",
-        "key_path": "datasets[].tables[].source.format.csv",
+        "pointer": "/$defs/SchemaConfig/properties/strict",
+        "key_path": "datasets[].tables[].schema.strict",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -100812,17 +103868,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "boolean"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -100870,42 +103925,39 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceFormatConfig/properties/parquet",
-        "key_path": "datasets[].tables[].source.format.parquet",
+        "pointer": "/$defs/ServerConfig/properties/admin_bind",
+        "key_path": "server.admin_bind",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
         "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -100940,19 +103992,29 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": [
+            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
+            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
             "null",
-            "object"
+            "string"
           ]
         }
       ]
@@ -100960,29 +104022,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ResourceFormatConfig/properties/xlsx",
-        "key_path": "datasets[].tables[].source.format.xlsx",
+        "pointer": "/$defs/ServerConfig/properties/bind",
+        "key_path": "server.bind",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "local_reference": "#/$defs/SocketAddr",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -101024,43 +104085,51 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "pattern",
           "value": [
-            "null",
-            "object"
+            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
+            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SocketAddr"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RotateConfig/properties/max_files",
-        "key_path": "audit.rotate.max_files",
+        "pointer": "/$defs/ServerConfig/properties/cache_dir",
+        "key_path": "server.cache_dir",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -101105,48 +104174,38 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/RotateConfig/properties/max_size_mb",
-        "key_path": "audit.rotate.max_size_mb",
+        "pointer": "/$defs/ServerConfig/properties/cors",
+        "key_path": "server.cors",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_audit_internal",
+      "purpose": "CORS allowlist; default-deny per Section 17 item 7.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/CorsConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -101191,48 +104250,42 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/CorsConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SchemaConfig/properties/fields",
-        "key_path": "datasets[].tables[].schema.fields",
+        "pointer": "/$defs/ServerConfig/properties/http1_header_read_timeout",
+        "key_path": "server.http1_header_read_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -101274,41 +104327,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SchemaConfig/properties/fields/items",
-        "key_path": "datasets[].tables[].schema.fields[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ServerConfig/properties/max_connections",
+        "key_path": "server.max_connections",
+        "path_kind": "property"
       },
-      "purpose": "One column in a resource schema. Physical type and optional\nsemantic annotations used by catalog and schema metadata.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/FieldConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -101350,43 +104414,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "name",
-            "type"
-          ]
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/FieldConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SchemaConfig/properties/strict",
-        "key_path": "datasets[].tables[].schema.strict",
+        "pointer": "/$defs/ServerConfig/properties/max_source_file_bytes",
+        "key_path": "server.max_source_file_bytes",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
@@ -101437,45 +104501,55 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "maximum",
+          "value": 18446744073709551615
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/admin_bind",
-        "key_path": "server.admin_bind",
+        "pointer": "/$defs/ServerConfig/properties/openapi_requires_auth",
+        "key_path": "server.openapi_requires_auth",
         "path_kind": "property"
       },
-      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_sensitive",
+      "purpose": "Keeps the configured OpenAPI document behind Relay authentication unless an operator explicitly accepts unauthenticated contract discovery.",
+      "purpose_source": "reviewed_override",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -101510,41 +104584,27 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": [
-            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
-            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/bind",
-        "key_path": "server.bind",
+        "pointer": "/$defs/ServerConfig/properties/request_body_timeout",
+        "key_path": "server.request_body_timeout",
         "path_kind": "property"
       },
-      "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
       "purpose_source": "schema_description",
       "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
@@ -101554,14 +104614,15 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/SocketAddr",
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -101606,12 +104667,13 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
         {
           "keyword": "pattern",
-          "value": [
-            "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$",
-            "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$"
-          ]
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
         },
         {
           "keyword": "type",
@@ -101620,18 +104682,18 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/SocketAddr"
+        "pointer": "/$defs/HumantimeDuration"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/cache_dir",
-        "key_path": "server.cache_dir",
+        "pointer": "/$defs/ServerConfig/properties/request_timeout",
+        "key_path": "server.request_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -101640,11 +104702,12 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -101692,20 +104755,32 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/cors",
-        "key_path": "server.cors",
+        "pointer": "/$defs/ServerConfig/properties/trust_proxy",
+        "key_path": "server.trust_proxy",
         "path_kind": "property"
       },
-      "purpose": "CORS allowlist; default-deny per Section 17 item 7.",
+      "purpose": "`X-Forwarded-For` policy. Until the `ipnet` crate lands in deps we\nkeep CIDR specs as strings and validate format in\n[`validate::run`].",
       "purpose_source": "schema_description",
       "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
@@ -101715,7 +104790,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/CorsConfig",
+        "local_reference": "#/$defs/TrustProxyConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -101775,102 +104850,14 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/CorsConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/http1_header_read_timeout",
-        "key_path": "server.http1_header_read_timeout",
-        "path_kind": "property"
-      },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/HumantimeDuration",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values"
-      ],
-      "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
+        "pointer": "/$defs/TrustProxyConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/max_connections",
-        "key_path": "server.max_connections",
+        "pointer": "/$defs/ServerConfig/properties/xlsx_max_file_bytes",
+        "key_path": "server.xlsx_max_file_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
@@ -101937,7 +104924,7 @@
       "constraints": [
         {
           "keyword": "format",
-          "value": "uint"
+          "value": "uint64"
         },
         {
           "keyword": "maximum",
@@ -101956,28 +104943,29 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/max_source_file_bytes",
-        "key_path": "server.max_source_file_bytes",
+        "pointer": "/$defs/SourceConfig/oneOf/0/properties/format",
+        "key_path": "datasets[].tables[].source.format",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
+      "purpose": "Storage table format override. If omitted, ingest infers the format\nfrom the source file extension.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -102019,55 +105007,46 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/openapi_requires_auth",
-        "key_path": "server.openapi_requires_auth",
+        "pointer": "/$defs/SourceConfig/oneOf/0/properties/path",
+        "key_path": "datasets[].tables[].source.path",
         "path_kind": "property"
       },
-      "purpose": "Keeps the configured OpenAPI document behind Relay authentication unless an operator explicitly accepts unauthenticated contract discovery.",
-      "purpose_source": "reviewed_override",
-      "intent_profile": "relay_server_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -102102,29 +105081,32 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/request_body_timeout",
-        "key_path": "server.request_body_timeout",
+        "pointer": "/$defs/SourceConfig/oneOf/0/properties/type",
+        "key_path": "datasets[].tables[].source.type",
         "path_kind": "property"
       },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -102132,15 +105114,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -102182,56 +105162,52 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+          "keyword": "const",
+          "value": [
+            "file",
+            "postgres"
+          ]
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/request_timeout",
-        "key_path": "server.request_timeout",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/change_token_sql",
+        "key_path": "datasets[].tables[].source.change_token_sql",
         "path_kind": "property"
       },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -102266,57 +105242,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/trust_proxy",
-        "key_path": "server.trust_proxy",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connect_timeout",
+        "key_path": "datasets[].tables[].source.connect_timeout",
         "path_kind": "property"
       },
-      "purpose": "`X-Forwarded-For` policy. Until the `ipnet` crate lands in deps we\nkeep CIDR specs as strings and validate format in\n[`validate::run`].",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/TrustProxyConfig",
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -102358,47 +105328,56 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig"
+        "pointer": "/$defs/HumantimeDuration"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/ServerConfig/properties/xlsx_max_file_bytes",
-        "key_path": "server.xlsx_max_file_bytes",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connection_env",
+        "key_path": "datasets[].tables[].source.connection_env",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
+      "intent_profile": "relay_datasets_secret_reference",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/PostgresEnvironmentNameSchema",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "relay",
@@ -102433,40 +105412,39 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "maximum",
-          "value": 18446744073709551615
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "pattern",
+          "value": "^[A-Za-z_][A-Za-z0-9_]*$"
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/PostgresEnvironmentNameSchema"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/0/properties/format",
-        "key_path": "datasets[].tables[].source.format",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query",
+        "key_path": "datasets[].tables[].source.query",
         "path_kind": "property"
       },
-      "purpose": "Storage table format override. If omitted, ingest infers the format\nfrom the source file extension.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -102474,16 +105452,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -102532,8 +105510,8 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -102541,13 +105519,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/0/properties/path",
-        "key_path": "datasets[].tables[].source.path",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query_timeout",
+        "key_path": "datasets[].tables[].source.query_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
+      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -102555,16 +105533,18 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -102599,46 +105579,58 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 255
+        },
+        {
+          "keyword": "pattern",
+          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/0/properties/type",
-        "key_path": "datasets[].tables[].source.type",
+        "pointer": "/$defs/SourceConfig/oneOf/1/properties/table",
+        "key_path": "datasets[].tables[].source.table",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Structured database table reference. Keeping schema/name separate\navoids parsing dotted identifiers and leaves quoting to connectors.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -102685,47 +105677,48 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
+          "keyword": "required",
           "value": [
-            "file",
-            "postgres"
+            "schema",
+            "name"
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/change_token_sql",
-        "key_path": "datasets[].tables[].source.change_token_sql",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_sensitive",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -102760,34 +105753,29 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connect_timeout",
-        "key_path": "datasets[].tables[].source.connect_timeout",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_x",
         "path_kind": "property"
       },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -102796,15 +105784,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -102850,34 +105836,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/connection_env",
-        "key_path": "datasets[].tables[].source.connection_env",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.max_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_secret_reference",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -102885,17 +105859,16 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/PostgresEnvironmentNameSchema",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -102930,35 +105903,25 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[A-Za-z_][A-Za-z0-9_]*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/PostgresEnvironmentNameSchema"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query",
-        "key_path": "datasets[].tables[].source.query",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -102969,17 +105932,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -103027,22 +105988,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/query_timeout",
-        "key_path": "datasets[].tables[].source.query_timeout",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
-      "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
@@ -103051,15 +106009,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -103105,50 +106061,36 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "maxLength",
-          "value": 255
-        },
-        {
-          "keyword": "pattern",
-          "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$"
-        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SourceConfig/oneOf/1/properties/table",
-        "key_path": "datasets[].tables[].source.table",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
-      "purpose": "Structured database table reference. Keeping schema/name separate\navoids parsing dotted identifiers and leaves quoting to connectors.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -103195,26 +106137,91 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "schema",
-            "name"
-          ]
-        },
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "relay",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.max_y",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
+      "semantic_owner": "relay_runtime",
+      "human_owner": "relay_maintainers",
+      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "relay",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "config.validation_error",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "consumers": [
+        "registry_relay",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "relay_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "relay",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_x",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_y",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103288,8 +106295,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_x",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103363,8 +106370,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.max_x",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103438,8 +106445,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_x",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103513,8 +106520,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_y",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_x",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103588,8 +106595,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_y",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_y",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103663,8 +106670,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.max_y",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_y",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103738,8 +106745,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_y",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].entities[].spatial.bbox_fields.min_y",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103813,8 +106820,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
+        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_y",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103888,8 +106895,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/crs",
+        "key_path": "datasets[].entities[].spatial.geometry.crs",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103963,8 +106970,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/kind",
+        "key_path": "datasets[].entities[].spatial.geometry.kind",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -103981,7 +106988,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -104029,6 +107036,15 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "const",
+          "value": [
+            "geojson",
+            "point",
+            "wkb",
+            "wkt"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -104038,8 +107054,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_x",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/latitude_field",
+        "key_path": "datasets[].entities[].spatial.geometry.latitude_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -104113,8 +107129,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/longitude_field",
+        "key_path": "datasets[].entities[].spatial.geometry.longitude_field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -104188,8 +107204,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/SpatialGeometryConfig/oneOf/1/properties/field",
+        "key_path": "datasets[].entities[].spatial.geometry.field",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -104263,13 +107279,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].entities[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/dataset",
+        "key_path": "standards.spdci.disability_registry.dataset",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -104277,11 +107293,12 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/DatasetId",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -104329,36 +107346,45 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "pattern",
+          "value": "^[a-z][a-z0-9_]*$"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/DatasetId"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y",
-        "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_y",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values",
+        "key_path": "standards.spdci.disability_registry.disabled_positive_values",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Case-insensitive values interpreted as disabled.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -104406,20 +107432,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/crs",
-        "key_path": "datasets[].entities[].spatial.geometry.crs",
-        "path_kind": "property"
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values/items",
+        "key_path": "standards.spdci.disability_registry.disabled_positive_values[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -104429,11 +107455,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -104488,13 +107514,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/kind",
-        "key_path": "datasets[].entities[].spatial.geometry.kind",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_status_field",
+        "key_path": "standards.spdci.disability_registry.disabled_status_field",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Entity field whose value determines the SP DCI disabled response.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -104504,11 +107530,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -104554,15 +107581,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "const",
-          "value": [
-            "geojson",
-            "point",
-            "wkb",
-            "wkt"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -104572,13 +107590,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/latitude_field",
-        "key_path": "datasets[].entities[].spatial.geometry.latitude_field",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/entity",
+        "key_path": "standards.spdci.disability_registry.entity",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -104647,13 +107665,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/longitude_field",
-        "key_path": "datasets[].entities[].spatial.geometry.longitude_field",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_field",
+        "key_path": "standards.spdci.disability_registry.query_field",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Entity field filtered when the SP DCI query key is present.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -104663,11 +107681,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -104722,13 +107741,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpatialGeometryConfig/oneOf/1/properties/field",
-        "key_path": "datasets[].entities[].spatial.geometry.field",
+        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_key",
+        "key_path": "standards.spdci.disability_registry.query_key",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Query key accepted from SP DCI `disabled_criteria.query`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -104738,14 +107757,15 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -104780,12 +107800,14 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -104797,8 +107819,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/dataset",
-        "key_path": "standards.spdci.disability_registry.dataset",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/dataset",
+        "key_path": "standards.spdci.registries.*.dataset",
         "path_kind": "property"
       },
       "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
@@ -104881,19 +107903,19 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values",
-        "key_path": "standards.spdci.disability_registry.disabled_positive_values",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/default_limit",
+        "key_path": "standards.spdci.registries.*.default_limit",
         "path_kind": "property"
       },
-      "purpose": "Case-insensitive values interpreted as disabled.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -104948,18 +107970,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values/items",
-        "key_path": "standards.spdci.disability_registry.disabled_positive_values[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/SpdciRegistryConfig/properties/entity",
+        "key_path": "standards.spdci.registries.*.entity",
+        "path_kind": "property"
       },
       "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
@@ -104973,11 +108007,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -105032,11 +108066,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_status_field",
-        "key_path": "standards.spdci.disability_registry.disabled_status_field",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields",
+        "key_path": "standards.spdci.registries.*.expression_fields",
         "path_kind": "property"
       },
-      "purpose": "Entity field whose value determines the SP DCI disabled response.",
+      "purpose": "DCI expression or predicate attribute to entity field mappings.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
@@ -105044,13 +108078,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -105101,20 +108135,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/entity",
-        "key_path": "standards.spdci.disability_registry.entity",
-        "path_kind": "property"
+        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields/additionalProperties",
+        "key_path": "standards.spdci.registries.*.expression_fields.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Each reviewed key names an expression-visible field and each value defines the bounded source expression exposed under that name.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_standards_spdci_registries_expression_fields_open_map",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -105124,14 +108158,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "relay",
@@ -105171,7 +108205,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -105183,11 +108217,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_field",
-        "key_path": "standards.spdci.disability_registry.query_field",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers",
+        "key_path": "standards.spdci.registries.*.identifiers",
         "path_kind": "property"
       },
-      "purpose": "Entity field filtered when the SP DCI query key is present.",
+      "purpose": "DCI identifier type to entity field mappings for `idtype-value`.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
@@ -105195,13 +108229,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -105252,20 +108286,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_key",
-        "key_path": "standards.spdci.disability_registry.query_key",
-        "path_kind": "property"
+        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers/additionalProperties",
+        "key_path": "standards.spdci.registries.*.identifiers.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Query key accepted from SP DCI `disabled_criteria.query`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_sensitive",
+      "purpose": "Each reviewed key names an identifier role and each value defines the exact request identifier binding for that role.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_standards_spdci_registries_identifiers_open_map",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -105275,15 +108309,14 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "relay",
@@ -105318,14 +108351,12 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -105337,92 +108368,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/dataset",
-        "key_path": "standards.spdci.registries.*.dataset",
-        "path_kind": "property"
-      },
-      "purpose": "Dataset identifier. Lower-snake, starts with a letter.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/DatasetId",
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "relay",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "config.validation_error",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
-      "consumers": [
-        "registry_relay",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "relay_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "relay",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "pattern",
-          "value": "^[a-z][a-z0-9_]*$"
-        },
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetId"
-      }
-    },
-    {
-      "address": {
-        "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/default_limit",
-        "key_path": "standards.spdci.registries.*.default_limit",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/record_type",
+        "key_path": "standards.spdci.registries.*.record_type",
         "path_kind": "property"
       },
       "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
@@ -105433,13 +108380,13 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -105488,29 +108435,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/entity",
-        "key_path": "standards.spdci.registries.*.entity",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/registry_type",
+        "key_path": "standards.spdci.registries.*.registry_type",
         "path_kind": "property"
       },
       "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
@@ -105525,11 +108460,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -105584,11 +108520,11 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields",
-        "key_path": "standards.spdci.registries.*.expression_fields",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields",
+        "key_path": "standards.spdci.registries.*.response_fields",
         "path_kind": "property"
       },
-      "purpose": "DCI expression or predicate attribute to entity field mappings.",
+      "purpose": "SP DCI output path to entity field mappings for direct response\nprojection. A CEL mapping takes precedence when both are set.",
       "purpose_source": "schema_description",
       "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
@@ -105660,13 +108596,13 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields/additionalProperties",
-        "key_path": "standards.spdci.registries.*.expression_fields.*",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields/additionalProperties",
+        "key_path": "standards.spdci.registries.*.response_fields.*",
         "path_kind": "map_value"
       },
-      "purpose": "Each reviewed key names an expression-visible field and each value defines the bounded source expression exposed under that name.",
+      "purpose": "Each reviewed key names a response field and each value defines the exact bounded response projection for that field.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_spdci_registries_expression_fields_open_map",
+      "intent_profile": "relay_standards_spdci_registries_response_fields_open_map",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -105735,31 +108671,32 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers",
-        "key_path": "standards.spdci.registries.*.identifiers",
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_mapping_path",
+        "key_path": "standards.spdci.registries.*.response_mapping_path",
         "path_kind": "property"
       },
-      "purpose": "DCI identifier type to entity field mappings for `idtype-value`.",
+      "purpose": "Optional local CEL mapping document used to shape response records.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_standards_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -105794,47 +108731,54 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers/additionalProperties",
-        "key_path": "standards.spdci.registries.*.identifiers.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/SpdciRegistryConfig/properties/response_schema_path",
+        "key_path": "standards.spdci.registries.*.response_schema_path",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names an identifier role and each value defines the exact request identifier binding for that role.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_spdci_registries_identifiers_open_map",
+      "purpose": "Optional local JSON Schema used to validate shaped response records.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -105869,45 +108813,51 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/record_type",
-        "key_path": "standards.spdci.registries.*.record_type",
+        "pointer": "/$defs/SpdciStandardsConfig/properties/disability_registry",
+        "key_path": "standards.spdci.disability_registry",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Runtime binding from SP DCI Disability Registry sync APIs to one\nconfigured Registry Relay entity.",
+      "purpose_source": "schema_description",
       "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -105953,17 +108903,27 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "dataset",
+            "entity"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/registry_type",
-        "key_path": "standards.spdci.registries.*.registry_type",
+        "pointer": "/$defs/SpdciStandardsConfig/properties/registries",
+        "key_path": "standards.spdci.registries",
         "path_kind": "property"
       },
       "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
@@ -105974,16 +108934,16 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -106031,20 +108991,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields",
-        "key_path": "standards.spdci.registries.*.response_fields",
-        "path_kind": "property"
+        "pointer": "/$defs/SpdciStandardsConfig/properties/registries/additionalProperties",
+        "key_path": "standards.spdci.registries.*",
+        "path_kind": "map_value"
       },
-      "purpose": "SP DCI output path to entity field mappings for direct response\nprojection. A CEL mapping takes precedence when both are set.",
+      "purpose": "Runtime binding from a DCI registry sync search API to one configured\nRegistry Relay entity.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_standards_spdci_registries_open_map",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -106052,17 +109012,17 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/SpdciRegistryConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "relay",
@@ -106102,42 +109062,55 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "dataset",
+            "entity"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/SpdciRegistryConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields/additionalProperties",
-        "key_path": "standards.spdci.registries.*.response_fields.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/StandardsConfig/properties/spdci",
+        "key_path": "standards.spdci",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a response field and each value defines the exact bounded response projection for that field.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_spdci_registries_response_fields_open_map",
+      "purpose": "Social Protection Digital Convergence Initiative (SP DCI) adapter\nconfiguration.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -106177,44 +109150,46 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_mapping_path",
-        "key_path": "standards.spdci.registries.*.response_mapping_path",
+        "pointer": "/$defs/TrustProxyConfig/properties/enabled",
+        "key_path": "server.trust_proxy.enabled",
         "path_kind": "property"
       },
-      "purpose": "Optional local CEL mapping document used to shape response records.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_sensitive",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -106249,48 +109224,41 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig/properties/response_schema_path",
-        "key_path": "standards.spdci.registries.*.response_schema_path",
+        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies",
+        "key_path": "server.trust_proxy.trusted_proxies",
         "path_kind": "property"
       },
-      "purpose": "Optional local JSON Schema used to validate shaped response records.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_sensitive",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_server_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -106338,47 +109306,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciStandardsConfig/properties/disability_registry",
-        "key_path": "standards.spdci.disability_registry",
-        "path_kind": "property"
+        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies/items",
+        "key_path": "server.trust_proxy.trusted_proxies[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Runtime binding from SP DCI Disability Registry sync APIs to one\nconfigured Registry Relay entity.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_server_sensitive",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "relay",
@@ -106413,55 +109377,49 @@
       "review_classes": [
         "contract",
         "relay",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "dataset",
-            "entity"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciStandardsConfig/properties/registries",
-        "key_path": "standards.spdci.registries",
+        "pointer": "/$defs/XlsxFormatConfig/properties/data_range",
+        "key_path": "datasets[].tables[].source.format.xlsx.data_range",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -106509,38 +109467,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/SpdciStandardsConfig/properties/registries/additionalProperties",
-        "key_path": "standards.spdci.registries.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/XlsxFormatConfig/properties/header_row",
+        "key_path": "datasets[].tables[].source.format.xlsx.header_row",
+        "path_kind": "property"
       },
-      "purpose": "Runtime binding from a DCI registry sync search API to one configured\nRegistry Relay entity.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_spdci_registries_open_map",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer",
+          "null"
         ],
-        "local_reference": "#/$defs/SpdciRegistryConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -106580,52 +109542,56 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "dataset",
-            "entity"
-          ]
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 4294967295
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/SpdciRegistryConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/StandardsConfig/properties/spdci",
-        "key_path": "standards.spdci",
+        "pointer": "/$defs/XlsxFormatConfig/properties/sheet",
+        "key_path": "datasets[].tables[].source.format.xlsx.sheet",
         "path_kind": "property"
       },
-      "purpose": "Social Protection Digital Convergence Initiative (SP DCI) adapter\nconfiguration.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_standards_internal",
+      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -106674,8 +109640,8 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -106683,28 +109649,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig/properties/enabled",
-        "key_path": "server.trust_proxy.enabled",
+        "pointer": "/properties/audit",
+        "key_path": "audit",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_internal",
+      "purpose": "Audit configuration. Sink choice gates further fields via the\ntagged `AuditSinkConfig` enum. The enum is flattened onto the\ncontaining struct so that the YAML `sink:` key acts as the\ndiscriminator, matching the public example configuration.\n\n`deny_unknown_fields` is deliberately omitted here: `serde` does\nnot support combining it with `#[serde(flatten)]` on an internally\ntagged enum (unknown keys in `audit` are caught by the enum's own\n`deny_unknown_fields`).",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_audit_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
+        "local_reference": "#/$defs/AuditConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -106749,40 +109715,60 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "sink",
+              "path"
+            ],
+            [
+              "sink"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
+        },
+        {
+          "keyword": "unevaluatedProperties",
+          "value": false
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuditConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies",
-        "key_path": "server.trust_proxy.trusted_proxies",
+        "pointer": "/properties/auth",
+        "key_path": "auth",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
+      "purpose": "Authentication configuration. Exactly one of `api_keys` and `oidc`\nis consumed at startup, gated by `mode`; cross-field validation in\n[`validate`] enforces that only the active block is populated.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_auth_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/AuthConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -106817,50 +109803,58 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "mode"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/AuthConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies/items",
-        "key_path": "server.trust_proxy.trusted_proxies[]",
-        "path_kind": "array_item"
+        "pointer": "/properties/catalog",
+        "key_path": "catalog",
+        "path_kind": "property"
       },
-      "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_server_sensitive",
+      "purpose": "Catalog-level metadata surfaced by `/metadata/*` and DCAT outputs.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_catalog_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/CatalogConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "relay",
@@ -106895,49 +109889,57 @@
       "review_classes": [
         "contract",
         "relay",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "title",
+            "base_url",
+            "publisher"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/CatalogConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/XlsxFormatConfig/properties/data_range",
-        "key_path": "datasets[].tables[].source.format.xlsx.data_range",
+        "pointer": "/properties/config_trust",
+        "key_path": "config_trust",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Optional signed configuration bundle trust state.\n\nSimple local deployments omit this block. Bundle-aware deployments pin the\nlocal trust anchor, bundle, and anti-rollback state paths explicitly.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_config_trust_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -106979,15 +109981,22 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "trust_anchor_path",
+            "bundle_path",
+            "antirollback_state_path"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -106995,29 +110004,29 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/XlsxFormatConfig/properties/header_row",
-        "key_path": "datasets[].tables[].source.format.xlsx.header_row",
+        "pointer": "/properties/consultation",
+        "key_path": "consultation",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_consultation_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107064,22 +110073,18 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 4294967295
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "authorized_workload",
+            "state_plane",
+            "audit_pseudonym_materials"
+          ]
         },
         {
           "keyword": "type",
           "value": [
-            "integer",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -107087,8 +110092,8 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/$defs/XlsxFormatConfig/properties/sheet",
-        "key_path": "datasets[].tables[].source.format.xlsx.sheet",
+        "pointer": "/properties/datasets",
+        "key_path": "datasets",
         "path_kind": "property"
       },
       "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
@@ -107099,17 +110104,15 @@
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107157,23 +110160,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/audit",
-        "key_path": "audit",
-        "path_kind": "property"
+        "pointer": "/properties/datasets/items",
+        "key_path": "datasets[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Audit configuration. Sink choice gates further fields via the\ntagged `AuditSinkConfig` enum. The enum is flattened onto the\ncontaining struct so that the YAML `sink:` key acts as the\ndiscriminator, matching the public example configuration.\n\n`deny_unknown_fields` is deliberately omitted here: `serde` does\nnot support combining it with `#[serde(flatten)]` on an internally\ntagged enum (unknown keys in `audit` are caught by the enum's own\n`deny_unknown_fields`).",
+      "purpose": "A single dataset declaration.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_audit_internal",
+      "intent_profile": "relay_datasets_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -107181,14 +110181,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AuditConfig",
+        "local_reference": "#/$defs/DatasetConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107230,45 +110230,42 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            [
-              "sink",
-              "path"
-            ],
-            [
-              "sink"
-            ]
+            "id",
+            "title",
+            "description",
+            "owner",
+            "sensitivity",
+            "access_rights",
+            "update_frequency"
           ]
         },
         {
           "keyword": "type",
           "value": "object"
-        },
-        {
-          "keyword": "unevaluatedProperties",
-          "value": false
         }
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AuditConfig"
+        "pointer": "/$defs/DatasetConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/auth",
-        "key_path": "auth",
+        "pointer": "/properties/deployment",
+        "key_path": "deployment",
         "path_kind": "property"
       },
-      "purpose": "Authentication configuration. Exactly one of `api_keys` and `oidc`\nis consumed at startup, gated by `mode`; cross-field validation in\n[`validate`] enforces that only the active block is populated.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_auth_internal",
+      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_deployment_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -107276,14 +110273,15 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/AuthConfig",
+        "local_reference": "#/$defs/DeploymentConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107329,12 +110327,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "mode"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -107342,19 +110334,19 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/AuthConfig"
+        "pointer": "/$defs/DeploymentConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/catalog",
-        "key_path": "catalog",
+        "pointer": "/properties/instance",
+        "key_path": "instance",
         "path_kind": "property"
       },
-      "purpose": "Catalog-level metadata surfaced by `/metadata/*` and DCAT outputs.",
+      "purpose": "Stable deployment identity surfaced in redacted operations posture.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_catalog_internal",
+      "intent_profile": "relay_instance_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -107362,14 +110354,15 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/CatalogConfig",
+        "local_reference": "#/$defs/InstanceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107414,14 +110407,6 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "title",
-            "base_url",
-            "publisher"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -107429,19 +110414,19 @@
       ],
       "local_reference": {
         "schema": "relay",
-        "pointer": "/$defs/CatalogConfig"
+        "pointer": "/$defs/InstanceConfig"
       }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/config_trust",
-        "key_path": "config_trust",
+        "pointer": "/properties/metadata",
+        "key_path": "metadata",
         "path_kind": "property"
       },
-      "purpose": "Optional signed configuration bundle trust state.\n\nSimple local deployments omit this block. Bundle-aware deployments pin the\nlocal trust anchor, bundle, and anti-rollback state paths explicitly.",
+      "purpose": "Optional split metadata manifest loaded alongside the runtime config.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_config_trust_internal",
+      "intent_profile": "relay_metadata_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -107505,9 +110490,7 @@
         {
           "keyword": "required",
           "value": [
-            "trust_anchor_path",
-            "bundle_path",
-            "antirollback_state_path"
+            "source"
           ]
         },
         {
@@ -107522,29 +110505,28 @@
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/consultation",
-        "key_path": "consultation",
+        "pointer": "/properties/server",
+        "key_path": "server",
         "path_kind": "property"
       },
-      "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_consultation_internal",
+      "purpose": "HTTP listener and adjacent server-wide knobs.",
+      "purpose_source": "schema_description",
+      "intent_profile": "relay_server_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/ServerConfig",
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107586,51 +110568,51 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "authorized_workload",
-            "state_plane",
-            "audit_pseudonym_materials"
+            "bind"
           ]
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/ServerConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/datasets",
-        "key_path": "datasets",
+        "pointer": "/properties/standards",
+        "key_path": "standards",
         "path_kind": "property"
       },
-      "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.",
+      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_datasets_internal",
+      "intent_profile": "relay_standards_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/StandardsConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107678,20 +110660,24 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "relay",
+        "pointer": "/$defs/StandardsConfig"
+      }
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/datasets/items",
-        "key_path": "datasets[]",
-        "path_kind": "array_item"
+        "pointer": "/properties/vocabularies",
+        "key_path": "vocabularies",
+        "path_kind": "property"
       },
-      "purpose": "A single dataset declaration.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_datasets_internal",
+      "purpose": "Controls the reviewed vocabulary bindings Relay uses to interpret namespaced terms.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "relay_vocabularies_internal",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -107699,14 +110685,14 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/DatasetConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -107748,61 +110734,42 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "title",
-            "description",
-            "owner",
-            "sensitivity",
-            "access_rights",
-            "update_frequency"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DatasetConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "relay",
-        "pointer": "/properties/deployment",
-        "key_path": "deployment",
-        "path_kind": "property"
+        "pointer": "/properties/vocabularies/additionalProperties",
+        "key_path": "vocabularies.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Each reviewed key is a vocabulary prefix and each value binds that prefix to its operator-approved vocabulary identifier.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_deployment_internal",
+      "intent_profile": "relay_vocabularies_open_map",
       "semantic_owner": "relay_runtime",
       "human_owner": "relay_maintainers",
       "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DeploymentConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "relay",
@@ -107842,51 +110809,45 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/DeploymentConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/properties/instance",
-        "key_path": "instance",
-        "path_kind": "property"
+        "schema": "notary",
+        "pointer": "",
+        "key_path": "",
+        "path_kind": "root"
       },
-      "purpose": "Stable deployment identity surfaced in redacted operations posture.",
-      "purpose_source": "schema_description",
-      "intent_profile": "relay_instance_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Defines the complete Notary runtime configuration boundary consumed when a Notary instance starts.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_root_structural",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/InstanceConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
+      "requiredness": "not_applicable",
+      "null_behavior": "not_applicable",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
-        "relay",
+        "notary",
         "docs"
       ],
       "availability": "published",
@@ -107896,7 +110857,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -107906,18 +110867,18 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
       "consumers": [
-        "registry_relay",
+        "registry_notary",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "relay_config",
+        "notary_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "relay",
+        "notary",
         "documentation"
       ],
       "semantic_rules": [
@@ -107925,48 +110886,50 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "evidence",
+            "auth"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/InstanceConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/properties/metadata",
-        "key_path": "metadata",
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/access_token_ttl_seconds",
+        "key_path": "auth.access_token_signing.access_token_ttl_seconds",
         "path_kind": "property"
       },
-      "purpose": "Optional split metadata manifest loaded alongside the runtime config.",
+      "purpose": "Access-token lifetime in seconds.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_metadata_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "integer"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "relay",
+        "notary",
         "docs"
       ],
       "availability": "published",
@@ -107976,7 +110939,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -107986,71 +110949,74 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
       "consumers": [
-        "registry_relay",
+        "registry_notary",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "relay_config",
+        "notary_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "relay",
+        "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "source"
-          ]
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/properties/server",
-        "key_path": "server",
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms",
+        "key_path": "auth.access_token_signing.allowed_algorithms",
         "path_kind": "property"
       },
-      "purpose": "HTTP listener and adjacent server-wide knobs.",
+      "purpose": "Allowed signing algorithms. Only EdDSA is supported.",
       "purpose_source": "schema_description",
-      "intent_profile": "relay_server_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/ServerConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "relay",
+        "notary",
         "docs"
       ],
       "availability": "published",
@@ -108060,7 +111026,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -108070,73 +111036,65 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
       "consumers": [
-        "registry_relay",
+        "registry_notary",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "relay_config",
+        "notary_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "relay",
+        "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "bind"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/ServerConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/properties/standards",
-        "key_path": "standards",
-        "path_kind": "property"
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms/items",
+        "key_path": "auth.access_token_signing.allowed_algorithms[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_standards_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/StandardsConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "relay",
+        "notary",
         "docs"
       ],
       "availability": "published",
@@ -108146,7 +111104,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -108156,52 +111114,51 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
       "consumers": [
-        "registry_relay",
+        "registry_notary",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "relay_config",
+        "notary_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "relay",
+        "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "relay",
-        "pointer": "/$defs/StandardsConfig"
-      }
+      ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/properties/vocabularies",
-        "key_path": "vocabularies",
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences",
+        "key_path": "auth.access_token_signing.audiences",
         "path_kind": "property"
       },
-      "purpose": "Controls the reviewed vocabulary bindings Relay uses to interpret namespaced terms.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_vocabularies_internal",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "purpose": "Audiences (`aud`) accepted for Notary-minted access tokens.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -108212,11 +111169,11 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "relay",
+        "notary",
         "docs"
       ],
       "availability": "published",
@@ -108226,7 +111183,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -108236,44 +111193,48 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
       "consumers": [
-        "registry_relay",
+        "registry_notary",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "relay_config",
+        "notary_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "relay",
+        "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
-        "schema": "relay",
-        "pointer": "/properties/vocabularies/additionalProperties",
-        "key_path": "vocabularies.*",
-        "path_kind": "map_value"
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences/items",
+        "key_path": "auth.access_token_signing.audiences[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Each reviewed key is a vocabulary prefix and each value binds that prefix to its operator-approved vocabulary identifier.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "relay_vocabularies_open_map",
-      "semantic_owner": "relay_runtime",
-      "human_owner": "relay_maintainers",
-      "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "string"
@@ -108286,11 +111247,11 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
-        "relay",
+        "notary",
         "docs"
       ],
       "availability": "published",
@@ -108300,7 +111261,7 @@
         "rust_deserialization",
         "operator_preflight"
       ],
-      "diagnostic": "config.validation_error",
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
       "history_status": "not_verified",
       "introduced_in": null,
       "version_history": [],
@@ -108310,24 +111271,27 @@
         "contains_country_values": false
       },
       "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
       "consumers": [
-        "registry_relay",
+        "registry_notary",
         "docs_generator"
       ],
       "generated_artifacts": [
-        "relay_config",
+        "notary_config",
         "field_reference"
       ],
       "review_classes": [
         "contract",
-        "relay",
+        "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -108339,30 +111303,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "",
-        "key_path": "",
-        "path_kind": "root"
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/enabled",
+        "key_path": "auth.access_token_signing.enabled",
+        "path_kind": "property"
       },
-      "purpose": "Defines the complete Notary runtime configuration boundary consumed when a Notary instance starts.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_root_structural",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "not_applicable",
+      "requiredness": "optional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -108397,34 +111362,31 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "evidence",
-            "auth"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/access_token_ttl_seconds",
-        "key_path": "auth.access_token_signing.access_token_ttl_seconds",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/issuer",
+        "key_path": "auth.access_token_signing.issuer",
         "path_kind": "property"
       },
-      "purpose": "Access-token lifetime in seconds.",
+      "purpose": "Issuer (`iss`) the Notary stamps into its own access tokens.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
@@ -108432,13 +111394,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -108490,28 +111452,20 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms",
-        "key_path": "auth.access_token_signing.allowed_algorithms",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/signing_key_id",
+        "key_path": "auth.access_token_signing.signing_key_id",
         "path_kind": "property"
       },
-      "purpose": "Allowed signing algorithms. Only EdDSA is supported.",
+      "purpose": "`evidence.signing_keys` entry used to sign access tokens. Must be a\ndedicated key, never a credential-signing key.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
@@ -108519,13 +111473,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -108579,19 +111533,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms/items",
-        "key_path": "auth.access_token_signing.allowed_algorithms[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/token_typ",
+        "key_path": "auth.access_token_signing.token_typ",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Header `typ` stamped into Notary access tokens, distinct from the\ncredential `typ` so a token cannot be replayed as another class.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
@@ -108602,11 +111556,12 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -108664,11 +111619,11 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences",
-        "key_path": "auth.access_token_signing.audiences",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids",
+        "key_path": "auth.access_token_signing.verification_key_ids",
         "path_kind": "property"
       },
-      "purpose": "Audiences (`aud`) accepted for Notary-minted access tokens.",
+      "purpose": "Additional publish-only `evidence.signing_keys` entries accepted for\nverifying previously minted Notary access tokens and pre-authorized\ncodes during a governed key rotation.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
@@ -108684,8 +111639,86 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "security",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids/items",
+        "key_path": "auth.access_token_signing.verification_key_ids[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -108736,37 +111769,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences/items",
-        "key_path": "auth.access_token_signing.audiences[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/BatchOperationConfig/properties/enabled",
+        "key_path": "evidence.claims[].operations.batch_evaluate.enabled",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -108801,39 +111835,36 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/enabled",
-        "key_path": "auth.access_token_signing.enabled",
+        "pointer": "/$defs/BatchOperationConfig/properties/max_subjects",
+        "key_path": "evidence.claims[].operations.batch_evaluate.max_subjects",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
@@ -108891,40 +111922,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "maximum",
+          "value": 100
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/issuer",
-        "key_path": "auth.access_token_signing.issuer",
+        "pointer": "/$defs/CccevConfig/properties/evidence_type",
+        "key_path": "evidence.claims[].cccev.evidence_type",
         "path_kind": "property"
       },
-      "purpose": "Issuer (`iss`) the Notary stamps into its own access tokens.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -108959,51 +112003,52 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/signing_key_id",
-        "key_path": "auth.access_token_signing.signing_key_id",
+        "pointer": "/$defs/CccevConfig/properties/evidence_type_iri",
+        "key_path": "evidence.claims[].cccev.evidence_type_iri",
         "path_kind": "property"
       },
-      "purpose": "`evidence.signing_keys` entry used to sign access tokens. Must be a\ndedicated key, never a credential-signing key.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -109038,51 +112083,52 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/token_typ",
-        "key_path": "auth.access_token_signing.token_typ",
+        "pointer": "/$defs/CccevConfig/properties/requirement_type",
+        "key_path": "evidence.claims[].cccev.requirement_type",
         "path_kind": "property"
       },
-      "purpose": "Header `typ` stamped into Notary access tokens, distinct from the\ncredential `typ` so a token cannot be replayed as another class.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -109117,39 +112163,39 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids",
-        "key_path": "auth.access_token_signing.verification_key_ids",
+        "pointer": "/$defs/CelBindingsConfig/properties/claims",
+        "key_path": "evidence.claims[].rule.bindings.claims",
         "path_kind": "property"
       },
-      "purpose": "Additional publish-only `evidence.signing_keys` entries accepted for\nverifying previously minted Notary access tokens and pre-authorized\ncodes during a governed key rotation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
         "composed": false
       },
@@ -109157,11 +112203,11 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -109196,50 +112242,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids/items",
-        "key_path": "auth.access_token_signing.verification_key_ids[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/CelBindingsConfig/properties/claims/additionalProperties",
+        "key_path": "evidence.claims[].rule.bindings.claims.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Each reviewed key names a CEL claim binding and each value selects the approved evidence claim exposed to that binding.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_claims_rule_bindings_claims_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ClaimBindingConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "notary",
@@ -109274,28 +112318,35 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "claim"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimBindingConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/BatchOperationConfig/properties/enabled",
-        "key_path": "evidence.claims[].operations.batch_evaluate.enabled",
+        "pointer": "/$defs/CelBindingsConfig/properties/vars",
+        "key_path": "evidence.claims[].rule.bindings.vars",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -109306,7 +112357,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
         "composed": false
       },
@@ -109363,38 +112414,39 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/BatchOperationConfig/properties/max_subjects",
-        "key_path": "evidence.claims[].operations.batch_evaluate.max_subjects",
+        "pointer": "/$defs/ClaimBindingConfig/properties/binding_type",
+        "key_path": "evidence.claims[].rule.bindings.claims.*.binding_type",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -109429,40 +112481,28 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "maximum",
-          "value": 100
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CccevConfig/properties/evidence_type",
-        "key_path": "evidence.claims[].cccev.evidence_type",
+        "pointer": "/$defs/ClaimBindingConfig/properties/claim",
+        "key_path": "evidence.claims[].rule.bindings.claims.*.claim",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -109473,17 +112513,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109531,18 +112569,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CccevConfig/properties/evidence_type_iri",
-        "key_path": "evidence.claims[].cccev.evidence_type_iri",
+        "pointer": "/$defs/ClaimDefinition/properties/cccev",
+        "key_path": "evidence.claims[].cccev",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -109554,16 +112589,16 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109612,8 +112647,8 @@
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -109621,32 +112656,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CccevConfig/properties/requirement_type",
-        "key_path": "evidence.claims[].cccev.requirement_type",
+        "pointer": "/$defs/ClaimDefinition/properties/credential_profiles",
+        "key_path": "evidence.claims[].credential_profiles",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -109681,51 +112715,50 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CelBindingsConfig/properties/claims",
-        "key_path": "evidence.claims[].rule.bindings.claims",
-        "path_kind": "property"
+        "pointer": "/$defs/ClaimDefinition/properties/credential_profiles/items",
+        "key_path": "evidence.claims[].credential_profiles[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -109760,48 +112793,51 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CelBindingsConfig/properties/claims/additionalProperties",
-        "key_path": "evidence.claims[].rule.bindings.claims.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/ClaimDefinition/properties/depends_on",
+        "key_path": "evidence.claims[].depends_on",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a CEL claim binding and each value selects the approved evidence claim exposed to that binding.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_claims_rule_bindings_claims_open_map",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/ClaimBindingConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -109841,31 +112877,21 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "claim"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimBindingConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CelBindingsConfig/properties/vars",
-        "key_path": "evidence.claims[].rule.bindings.vars",
-        "path_kind": "property"
+        "pointer": "/$defs/ClaimDefinition/properties/depends_on/items",
+        "key_path": "evidence.claims[].depends_on[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -109875,16 +112901,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -109932,15 +112957,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimBindingConfig/properties/binding_type",
-        "key_path": "evidence.claims[].rule.bindings.claims.*.binding_type",
+        "pointer": "/$defs/ClaimDefinition/properties/disclosure",
+        "key_path": "evidence.claims[].disclosure",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -109951,14 +112976,14 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/DisclosureConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -110009,18 +113034,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/DisclosureConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimBindingConfig/properties/claim",
-        "key_path": "evidence.claims[].rule.bindings.claims.*.claim",
+        "pointer": "/$defs/ClaimDefinition/properties/evidence_mode",
+        "key_path": "evidence.claims[].evidence_mode",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110031,13 +113057,14 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ClaimEvidenceMode",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -110085,34 +113112,49 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "type",
+              "consultations"
+            ],
+            [
+              "type"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimEvidenceMode"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/cccev",
-        "key_path": "evidence.claims[].cccev",
+        "pointer": "/$defs/ClaimDefinition/properties/formats",
+        "key_path": "evidence.claims[].formats",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Omitting this field keeps existing authored claims renderable using the\ncanonical claim-result representation. An explicitly empty list is\nrejected during configuration validation.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -110164,41 +113206,37 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/credential_profiles",
-        "key_path": "evidence.claims[].credential_profiles",
-        "path_kind": "property"
+        "pointer": "/$defs/ClaimDefinition/properties/formats/items",
+        "key_path": "evidence.claims[].formats[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -110233,33 +113271,30 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/credential_profiles/items",
-        "key_path": "evidence.claims[].credential_profiles[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ClaimDefinition/properties/id",
+        "key_path": "evidence.claims[].id",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -110269,14 +113304,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -110311,14 +113346,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -110331,8 +113363,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/depends_on",
-        "key_path": "evidence.claims[].depends_on",
+        "pointer": "/$defs/ClaimDefinition/properties/inputs",
+        "key_path": "evidence.claims[].inputs",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110407,8 +113439,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/depends_on/items",
-        "key_path": "evidence.claims[].depends_on[]",
+        "pointer": "/$defs/ClaimDefinition/properties/inputs/items",
+        "key_path": "evidence.claims[].inputs[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110419,13 +113451,14 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ClaimInputConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "not_applicable"
       },
@@ -110473,17 +113506,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name",
+            "type"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimInputConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/disclosure",
-        "key_path": "evidence.claims[].disclosure",
+        "pointer": "/$defs/ClaimDefinition/properties/oots",
+        "key_path": "evidence.claims[].oots",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110494,13 +113538,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/DisclosureConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
@@ -110552,19 +113596,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/evidence_mode",
-        "key_path": "evidence.claims[].evidence_mode",
+        "pointer": "/$defs/ClaimDefinition/properties/operations",
+        "key_path": "evidence.claims[].operations",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110577,14 +113620,15 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ClaimEvidenceMode",
+        "local_reference": "#/$defs/ClaimOperationsConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110630,18 +113674,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "consultations"
-            ],
-            [
-              "type"
-            ]
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -110649,17 +113681,97 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimEvidenceMode"
+        "pointer": "/$defs/ClaimOperationsConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/formats",
-        "key_path": "evidence.claims[].formats",
+        "pointer": "/$defs/ClaimDefinition/properties/purpose",
+        "key_path": "evidence.claims[].purpose",
         "path_kind": "property"
       },
-      "purpose": "Omitting this field keeps existing authored claims renderable using the\ncanonical claim-result representation. An explicitly empty list is\nrejected during configuration validation.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": [
+            "string",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimDefinition/properties/required_scopes",
+        "key_path": "evidence.claims[].required_scopes",
+        "path_kind": "property"
+      },
+      "purpose": "Caller scopes checked before any registry consultation is dispatched.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
@@ -110731,8 +113843,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/formats/items",
-        "key_path": "evidence.claims[].formats[]",
+        "pointer": "/$defs/ClaimDefinition/properties/required_scopes/items",
+        "key_path": "evidence.claims[].required_scopes[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110806,8 +113918,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/id",
-        "key_path": "evidence.claims[].id",
+        "pointer": "/$defs/ClaimDefinition/properties/rule",
+        "key_path": "evidence.claims[].rule",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110818,13 +113930,14 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RuleConfig",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -110872,17 +113985,39 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "type",
+              "consultation",
+              "output"
+            ],
+            [
+              "type",
+              "consultation"
+            ],
+            [
+              "type",
+              "expression"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RuleConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/inputs",
-        "key_path": "evidence.claims[].inputs",
+        "pointer": "/$defs/ClaimDefinition/properties/semantics",
+        "key_path": "evidence.claims[].semantics",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -110893,16 +114028,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -110950,38 +114086,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/inputs/items",
-        "key_path": "evidence.claims[].inputs[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ClaimDefinition/properties/subject_type",
+        "key_path": "evidence.claims[].subject_type",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimInputConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -111016,36 +114154,28 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name",
-            "type"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimInputConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/oots",
-        "key_path": "evidence.claims[].oots",
+        "pointer": "/$defs/ClaimDefinition/properties/title",
+        "key_path": "evidence.claims[].title",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -111056,17 +114186,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111114,18 +114242,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/operations",
-        "key_path": "evidence.claims[].operations",
+        "pointer": "/$defs/ClaimDefinition/properties/value",
+        "key_path": "evidence.claims[].value",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -111138,7 +114263,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ClaimOperationsConfig",
+        "local_reference": "#/$defs/ClaimValueConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -111199,14 +114324,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimOperationsConfig"
+        "pointer": "/$defs/ClaimValueConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/purpose",
-        "key_path": "evidence.claims[].purpose",
+        "pointer": "/$defs/ClaimDefinition/properties/version",
+        "key_path": "evidence.claims[].version",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -111217,17 +114342,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111275,38 +114398,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/required_scopes",
-        "key_path": "evidence.claims[].required_scopes",
+        "pointer": "/$defs/ClaimInputConfig/properties/name",
+        "key_path": "evidence.claims[].inputs[].name",
         "path_kind": "property"
       },
-      "purpose": "Caller scopes checked before any registry consultation is dispatched.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111354,16 +114473,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/required_scopes/items",
-        "key_path": "evidence.claims[].required_scopes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ClaimInputConfig/properties/type",
+        "key_path": "evidence.claims[].inputs[].type",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -111377,11 +114496,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111436,8 +114555,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/rule",
-        "key_path": "evidence.claims[].rule",
+        "pointer": "/$defs/ClaimOperationsConfig/properties/batch_evaluate",
+        "key_path": "evidence.claims[].operations.batch_evaluate",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -111450,14 +114569,15 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/RuleConfig",
+        "local_reference": "#/$defs/BatchOperationConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111503,24 +114623,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "consultation",
-              "output"
-            ],
-            [
-              "type",
-              "consultation"
-            ],
-            [
-              "type",
-              "expression"
-            ]
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -111528,14 +114630,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/RuleConfig"
+        "pointer": "/$defs/BatchOperationConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/semantics",
-        "key_path": "evidence.claims[].semantics",
+        "pointer": "/$defs/ClaimOperationsConfig/properties/evaluate",
+        "key_path": "evidence.claims[].operations.evaluate",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -111546,17 +114648,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "object"
         ],
-        "composed": true
+        "local_reference": "#/$defs/OperationConfig",
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111604,23 +114706,24 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/OperationConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/subject_type",
-        "key_path": "evidence.claims[].subject_type",
+        "pointer": "/$defs/ClaimRefObject/properties/id",
+        "key_path": "auth.api_keys[].authorization_details.claims[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -111692,13 +114795,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/title",
-        "key_path": "evidence.claims[].title",
+        "pointer": "/$defs/ClaimRefObject/properties/id",
+        "key_path": "auth.bearer_tokens[].authorization_details.claims[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -111714,8 +114817,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -111750,11 +114853,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -111767,32 +114873,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/value",
-        "key_path": "evidence.claims[].value",
+        "pointer": "/$defs/ClaimRefObject/properties/version",
+        "key_path": "auth.api_keys[].authorization_details.claims[].version",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimValueConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -111827,51 +114933,55 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition/properties/version",
-        "key_path": "evidence.claims[].version",
+        "pointer": "/$defs/ClaimRefObject/properties/version",
+        "key_path": "auth.bearer_tokens[].authorization_details.claims[].version",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -111906,25 +115016,31 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimInputConfig/properties/name",
-        "key_path": "evidence.claims[].inputs[].name",
+        "pointer": "/$defs/ClaimSemanticConfig/properties/concept",
+        "key_path": "evidence.claims[].semantics.concept",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -111935,15 +115051,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -111991,15 +115109,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimInputConfig/properties/type",
-        "key_path": "evidence.claims[].inputs[].type",
+        "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from",
+        "key_path": "evidence.claims[].semantics.derived_from",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -112010,15 +115131,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112066,16 +115188,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimOperationsConfig/properties/batch_evaluate",
-        "key_path": "evidence.claims[].operations.batch_evaluate",
-        "path_kind": "property"
+        "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from/items",
+        "key_path": "evidence.claims[].semantics.derived_from[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -112085,17 +115207,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/BatchOperationConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112143,19 +115263,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/BatchOperationConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimOperationsConfig/properties/evaluate",
-        "key_path": "evidence.claims[].operations.evaluate",
+        "pointer": "/$defs/ClaimSemanticConfig/properties/predicate",
+        "key_path": "evidence.claims[].semantics.predicate",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -112166,17 +115282,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/OperationConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112224,41 +115340,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/OperationConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/id",
-        "key_path": "auth.api_keys[].authorization_details.claims[].id",
+        "pointer": "/$defs/ClaimSemanticConfig/properties/property",
+        "key_path": "evidence.claims[].semantics.property",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -112293,111 +115410,33 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/id",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims[].id",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/version",
-        "key_path": "auth.api_keys[].authorization_details.claims[].version",
+        "pointer": "/$defs/ClaimSemanticConfig/properties/value_mapping",
+        "key_path": "evidence.claims[].semantics.value_mapping",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -112412,11 +115451,11 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -112451,14 +115490,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -112474,13 +115510,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimRefObject/properties/version",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims[].version",
+        "pointer": "/$defs/ClaimSemanticConfig/properties/vocabulary",
+        "key_path": "evidence.claims[].semantics.vocabulary",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -112495,11 +115531,11 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -112534,14 +115570,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -112557,8 +115590,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/concept",
-        "key_path": "evidence.claims[].semantics.concept",
+        "pointer": "/$defs/ClaimValueConfig/properties/max_bytes",
+        "key_path": "evidence.claims[].value.max_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -112569,17 +115602,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a per-claim string byte ceiling."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112625,10 +115658,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "maximum",
+          "value": 65536
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
+            "integer",
             "null"
           ]
         }
@@ -112637,8 +115682,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from",
-        "key_path": "evidence.claims[].semantics.derived_from",
+        "pointer": "/$defs/ClaimValueConfig/properties/nullable",
+        "key_path": "evidence.claims[].value.nullable",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -112649,7 +115694,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -112658,7 +115703,7 @@
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112706,16 +115751,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from/items",
-        "key_path": "evidence.claims[].semantics.derived_from[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/ClaimValueConfig/properties/type",
+        "key_path": "evidence.claims[].value.type",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -112729,11 +115774,12 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112788,8 +115834,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/predicate",
-        "key_path": "evidence.claims[].semantics.predicate",
+        "pointer": "/$defs/ClaimValueConfig/properties/unit",
+        "key_path": "evidence.claims[].value.unit",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -112809,8 +115855,8 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -112868,32 +115914,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/property",
-        "key_path": "evidence.claims[].semantics.property",
+        "pointer": "/$defs/ConcurrencyConfig/properties/subjects",
+        "key_path": "evidence.concurrency.subjects",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -112928,52 +115973,58 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/value_mapping",
-        "key_path": "evidence.claims[].semantics.value_mapping",
+        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
+        "key_path": "config_trust.antirollback_state_path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_config_trust_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -113008,33 +116059,32 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimSemanticConfig/properties/vocabulary",
-        "key_path": "evidence.claims[].semantics.vocabulary",
+        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
+        "key_path": "config_trust.break_glass_override_path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_config_trust_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -113052,8 +116102,8 @@
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -113088,12 +116138,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -113108,32 +116160,30 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/max_bytes",
-        "key_path": "evidence.claims[].value.max_bytes",
+        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
+        "key_path": "config_trust.bundle_path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_config_trust_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a per-claim string byte ceiling."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -113168,63 +116218,49 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "maximum",
-          "value": 65536
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/nullable",
-        "key_path": "evidence.claims[].value.nullable",
+        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
+        "key_path": "config_trust.trust_anchor_path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_config_trust_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -113259,48 +116295,50 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/type",
-        "key_path": "evidence.claims[].value.type",
+        "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed",
+        "key_path": "evidence.credential_profiles.*.disclosure.allowed",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -113335,49 +116373,50 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ClaimValueConfig/properties/unit",
-        "key_path": "evidence.claims[].value.unit",
-        "path_kind": "property"
+        "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed/items",
+        "key_path": "evidence.credential_profiles.*.disclosure.allowed[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -113412,51 +116451,52 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ConcurrencyConfig/properties/subjects",
-        "key_path": "evidence.concurrency.subjects",
+        "pointer": "/$defs/CredentialFingerprintRef/properties/name",
+        "key_path": "auth.api_keys[].fingerprint.name",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_auth_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -113498,51 +116538,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path",
-        "key_path": "config_trust.antirollback_state_path",
+        "pointer": "/$defs/CredentialFingerprintRef/properties/name",
+        "key_path": "auth.bearer_tokens[].fingerprint.name",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
+      "intent_profile": "notary_auth_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -113584,25 +116620,28 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path",
-        "key_path": "config_trust.break_glass_override_path",
+        "pointer": "/$defs/CredentialFingerprintRef/properties/path",
+        "key_path": "auth.api_keys[].fingerprint.path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
+      "intent_profile": "notary_auth_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -113621,7 +116660,7 @@
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -113663,7 +116702,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
@@ -113678,30 +116717,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path",
-        "key_path": "config_trust.bundle_path",
+        "pointer": "/$defs/CredentialFingerprintRef/properties/path",
+        "key_path": "auth.bearer_tokens[].fingerprint.path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
+      "intent_profile": "notary_auth_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -113743,25 +116784,28 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path",
-        "key_path": "config_trust.trust_anchor_path",
+        "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
+        "key_path": "auth.api_keys[].fingerprint.provider",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_config_trust_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -113773,7 +116817,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -113820,9 +116864,17 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "env",
+            "file"
+          ]
+        },
         {
           "keyword": "type",
           "value": "string"
@@ -113832,28 +116884,27 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed",
-        "key_path": "evidence.credential_profiles.*.disclosure.allowed",
+        "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
+        "key_path": "auth.bearer_tokens[].fingerprint.provider",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -113902,18 +116953,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "env",
+            "file"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed/items",
-        "key_path": "evidence.credential_profiles.*.disclosure.allowed[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims",
+        "key_path": "evidence.credential_profiles.*.allowed_claims",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -113923,15 +116981,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -113982,39 +117041,37 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/name",
-        "key_path": "auth.api_keys[].fingerprint.name",
-        "path_kind": "property"
+        "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims/items",
+        "key_path": "evidence.credential_profiles.*.allowed_claims[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -114056,47 +117113,45 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/name",
-        "key_path": "auth.bearer_tokens[].fingerprint.name",
+        "pointer": "/$defs/CredentialProfileConfig/properties/disclosure",
+        "key_path": "evidence.credential_profiles.*.disclosure",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/CredentialDisclosureConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -114138,47 +117193,47 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/CredentialDisclosureConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/path",
-        "key_path": "auth.api_keys[].fingerprint.path",
+        "pointer": "/$defs/CredentialProfileConfig/properties/format",
+        "key_path": "evidence.credential_profiles.*.format",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -114220,47 +117275,45 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/path",
-        "key_path": "auth.bearer_tokens[].fingerprint.path",
+        "pointer": "/$defs/CredentialProfileConfig/properties/holder_binding",
+        "key_path": "evidence.credential_profiles.*.holder_binding",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_secret_reference",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/HolderBindingConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -114302,28 +117355,30 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/HolderBindingConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
-        "key_path": "auth.api_keys[].fingerprint.provider",
+        "pointer": "/$defs/CredentialProfileConfig/properties/issuer",
+        "key_path": "evidence.credential_profiles.*.issuer",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -114335,7 +117390,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -114386,13 +117441,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "env",
-            "file"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -114402,13 +117450,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef/properties/provider",
-        "key_path": "auth.bearer_tokens[].fingerprint.provider",
+        "pointer": "/$defs/CredentialProfileConfig/properties/signing_key",
+        "key_path": "evidence.credential_profiles.*.signing_key",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -114420,7 +117468,7 @@
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -114471,13 +117519,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "env",
-            "file"
-          ]
-        },
         {
           "keyword": "type",
           "value": "string"
@@ -114487,8 +117528,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims",
-        "key_path": "evidence.credential_profiles.*.allowed_claims",
+        "pointer": "/$defs/CredentialProfileConfig/properties/validity_seconds",
+        "key_path": "evidence.credential_profiles.*.validity_seconds",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -114499,7 +117540,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -114557,18 +117598,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int64"
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims/items",
-        "key_path": "evidence.credential_profiles.*.allowed_claims[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/CredentialProfileConfig/properties/vct",
+        "key_path": "evidence.credential_profiles.*.vct",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -114582,11 +117627,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -114644,26 +117689,25 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/disclosure",
-        "key_path": "evidence.credential_profiles.*.disclosure",
+        "pointer": "/$defs/CredentialStatusConfig/properties/base_url",
+        "key_path": "credential_status.base_url",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary credential-status publication and retention behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_credential_status_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/CredentialDisclosureConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -114711,44 +117755,40 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialDisclosureConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/format",
-        "key_path": "evidence.credential_profiles.*.format",
+        "pointer": "/$defs/CredentialStatusConfig/properties/enabled",
+        "key_path": "credential_status.enabled",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary credential-status publication and retention behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_credential_status_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -114793,34 +117833,32 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/holder_binding",
-        "key_path": "evidence.credential_profiles.*.holder_binding",
+        "pointer": "/$defs/CredentialStatusConfig/properties/retention_seconds",
+        "key_path": "credential_status.retention_seconds",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary credential-status publication and retention behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_credential_status_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/HolderBindingConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -114873,47 +117911,52 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/issuer",
-        "key_path": "evidence.credential_profiles.*.issuer",
+        "pointer": "/$defs/DeploymentConfig/properties/evidence",
+        "key_path": "deployment.evidence",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/DeploymentEvidenceConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -114948,50 +117991,52 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/DeploymentEvidenceConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/signing_key",
-        "key_path": "evidence.credential_profiles.*.signing_key",
+        "pointer": "/$defs/DeploymentConfig/properties/multi_instance",
+        "key_path": "deployment.multi_instance",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -115026,51 +118071,49 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/validity_seconds",
-        "key_path": "evidence.credential_profiles.*.validity_seconds",
+        "pointer": "/$defs/DeploymentConfig/properties/profile",
+        "key_path": "deployment.profile",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "purpose": "The set of deployment profiles an operator can declare.\n\nFrozen at introduction; new profiles may be added but existing ones never\nchange meaning. Deserialization is strict: an unknown profile string fails,\nwhich surfaces as a startup error.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -115105,54 +118148,60 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "int64"
+          "keyword": "enum",
+          "value": [
+            "local",
+            "hosted_lab",
+            "production",
+            "evidence_grade"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig/properties/vct",
-        "key_path": "evidence.credential_profiles.*.vct",
+        "pointer": "/$defs/DeploymentConfig/properties/waivers",
+        "key_path": "deployment.waivers",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -115187,51 +118236,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig/properties/base_url",
-        "key_path": "credential_status.base_url",
-        "path_kind": "property"
+        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
+        "key_path": "deployment.waivers[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
+      "purpose": "One operator-configured waiver.\n\nA waiver names exactly one finding id, a required operator reference, an\noptional summary, and a mandatory expiry date (`YYYY-MM-DD`). The shared\noperations contract validates metadata before it can reach posture or logs.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/DeploymentWaiverConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -115266,47 +118312,58 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "finding",
+            "reference",
+            "expires"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/DeploymentWaiverConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig/properties/enabled",
-        "key_path": "credential_status.enabled",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
+        "key_path": "deployment.evidence.audit_ack_cursor_path",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
+      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. Runtime health requires both a\nfresh timestamp and a watermark equal to the live keyed audit-chain tail.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_deployment_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -115356,38 +118413,42 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialStatusConfig/properties/retention_seconds",
-        "key_path": "credential_status.retention_seconds",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
+        "key_path": "deployment.evidence.audit_ack_max_age_secs",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary credential-status publication and retention behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_credential_status_sensitive",
+      "purpose": "Optional freshness window, in seconds, for the off-host ack cursor.\nUnset defaults to [`DEFAULT_AUDIT_ACK_MAX_AGE`] (900s). Meaningless\nwithout `audit_ack_cursor_path`; config load rejects that combination.\n\n[`DEFAULT_AUDIT_ACK_MAX_AGE`]: registry_platform_ops::DEFAULT_AUDIT_ACK_MAX_AGE",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "integer",
+          "null"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -115422,14 +118483,12 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -115442,28 +118501,30 @@
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/evidence",
-        "key_path": "deployment.evidence",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
+        "key_path": "deployment.evidence.audit_offhost_shipping",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Operator asserts audit log events are shipped off-host (for example to\na log aggregator or SIEM) so a local file sink does not cap retention.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/DeploymentEvidenceConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -115519,23 +118580,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/multi_instance",
-        "key_path": "deployment.multi_instance",
+        "pointer": "/$defs/DeploymentEvidenceConfig/properties/signer_custody_approved",
+        "key_path": "deployment.evidence.signer_custody_approved",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Operator asserts a production review has approved signer custody for\nthis deployment. Provider kind is not proof of custody: PKCS#11 modules\ncan be backed by either hardware or software tokens.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
@@ -115606,29 +118663,27 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/profile",
-        "key_path": "deployment.profile",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
+        "key_path": "deployment.waivers[].expires",
         "path_kind": "property"
       },
-      "purpose": "The set of deployment profiles an operator can declare.\n\nFrozen at introduction; new profiles may be added but existing ones never\nchange meaning. Deserialization is strict: an unknown profile string fails,\nwhich surfaces as a startup error.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -115674,29 +118729,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "local",
-            "hosted_lab",
-            "production",
-            "evidence_grade"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers",
-        "key_path": "deployment.waivers",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
+        "key_path": "deployment.waivers[].finding",
         "path_kind": "property"
       },
       "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
@@ -115707,16 +118750,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -115764,35 +118806,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentConfig/properties/waivers/items",
-        "key_path": "deployment.waivers[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
+        "key_path": "deployment.waivers[].reference",
+        "path_kind": "property"
       },
-      "purpose": "One operator-configured waiver.\n\nA waiver names exactly one finding id, a required operator reference, an\noptional summary, and a mandatory expiry date (`YYYY-MM-DD`). The shared\noperations contract validates metadata before it can reach posture or logs.",
-      "purpose_source": "schema_description",
+      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverConfig",
+        "local_reference": "#/$defs/DeploymentWaiverReference",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -115839,52 +118881,56 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "finding",
-            "reference",
-            "expires"
-          ]
+          "keyword": "maxLength",
+          "value": 128
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
+        {
+          "keyword": "pattern",
+          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig"
+        "pointer": "/$defs/DeploymentWaiverReference"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path",
-        "key_path": "deployment.evidence.audit_ack_cursor_path",
+        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
+        "key_path": "deployment.waivers[].summary",
         "path_kind": "property"
       },
-      "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. Runtime health requires both a\nfresh timestamp and a watermark equal to the live keyed audit-chain tail.",
+      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_sensitive",
+      "intent_profile": "notary_deployment_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/DeploymentWaiverSummary",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -115919,51 +118965,57 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "maxLength",
+          "value": 256
+        },
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/DeploymentWaiverSummary"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs",
-        "key_path": "deployment.evidence.audit_ack_max_age_secs",
+        "pointer": "/$defs/DisclosureConfig/properties/allowed",
+        "key_path": "evidence.claims[].disclosure.allowed",
         "path_kind": "property"
       },
-      "purpose": "Optional freshness window, in seconds, for the off-host ack cursor.\nUnset defaults to [`DEFAULT_AUDIT_ACK_MAX_AGE`] (900s). Meaningless\nwithout `audit_ack_cursor_path`; config load rejects that combination.\n\n[`DEFAULT_AUDIT_ACK_MAX_AGE`]: registry_platform_ops::DEFAULT_AUDIT_ACK_MAX_AGE",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -116010,44 +119062,108 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/DisclosureConfig/properties/allowed/items",
+        "key_path": "evidence.claims[].disclosure.allowed[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping",
-        "key_path": "deployment.evidence.audit_offhost_shipping",
+        "pointer": "/$defs/DisclosureConfig/properties/default",
+        "key_path": "evidence.claims[].disclosure.default",
         "path_kind": "property"
       },
-      "purpose": "Operator asserts audit log events are shipped off-host (for example to\na log aggregator or SIEM) so a local file sink does not cap retention.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -116098,32 +119214,32 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentEvidenceConfig/properties/signer_custody_approved",
-        "key_path": "deployment.evidence.signer_custody_approved",
+        "pointer": "/$defs/DisclosureConfig/properties/downgrade",
+        "key_path": "evidence.claims[].disclosure.downgrade",
         "path_kind": "property"
       },
-      "purpose": "Operator asserts a production review has approved signer custody for\nthis deployment. Provider kind is not proof of custody: PKCS#11 modules\ncan be backed by either hardware or software tokens.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -116174,20 +119290,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/expires",
-        "key_path": "deployment.waivers[].expires",
+        "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
+        "key_path": "auth.api_keys[].authorization_details.assisted_access_context.channel",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -116203,8 +119319,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -116239,11 +119355,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -116256,13 +119375,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/finding",
-        "key_path": "deployment.waivers[].finding",
+        "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
+        "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context.channel",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -116278,8 +119397,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -116314,11 +119433,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -116331,31 +119453,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/reference",
-        "key_path": "deployment.waivers[].reference",
+        "pointer": "/$defs/EvidenceAuditConfig/properties/hash_secret_env",
+        "key_path": "audit.hash_secret_env",
         "path_kind": "property"
       },
-      "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.",
+      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_deployment_internal",
+      "intent_profile": "notary_audit_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverReference",
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -116390,62 +119513,138 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 128
-        },
+          "keyword": "type",
+          "value": [
+            "string",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceAuditConfig/properties/max_files",
+        "key_path": "audit.max_files",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_audit_internal",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "integer",
+          "null"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values"
+      ],
+      "constraints": [
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "format",
+          "value": "uint32"
         },
         {
-          "keyword": "pattern",
-          "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$"
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverReference"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverConfig/properties/summary",
-        "key_path": "deployment.waivers[].summary",
+        "pointer": "/$defs/EvidenceAuditConfig/properties/max_size_mb",
+        "key_path": "audit.max_size_mb",
         "path_kind": "property"
       },
-      "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_deployment_internal",
+      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_audit_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
-        "local_reference": "#/$defs/DeploymentWaiverSummary",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -116487,56 +119686,55 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "maxLength",
-          "value": 256
+          "keyword": "format",
+          "value": "uint64"
         },
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/DeploymentWaiverSummary"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/allowed",
-        "key_path": "evidence.claims[].disclosure.allowed",
+        "pointer": "/$defs/EvidenceAuditConfig/properties/path",
+        "key_path": "audit.path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_audit_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -116571,30 +119769,35 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/allowed/items",
-        "key_path": "evidence.claims[].disclosure.allowed[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuditConfig/properties/sink",
+        "key_path": "audit.sink",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_audit_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -116604,11 +119807,12 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -116650,8 +119854,7 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -116663,31 +119866,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/default",
-        "key_path": "evidence.claims[].disclosure.default",
+        "pointer": "/$defs/EvidenceAuditConfig/properties/syslog_socket_path",
+        "key_path": "audit.syslog_socket_path",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_audit_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -116722,48 +119926,54 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/DisclosureConfig/properties/downgrade",
-        "key_path": "evidence.claims[].disclosure.downgrade",
+        "pointer": "/$defs/EvidenceAuthConfig/properties/access_token_signing",
+        "key_path": "auth.access_token_signing",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/AccessTokenSigningConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -116798,25 +120008,32 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/AccessTokenSigningConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
-        "key_path": "auth.api_keys[].authorization_details.assisted_access_context.channel",
+        "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys",
+        "key_path": "auth.api_keys",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -116827,15 +120044,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -116886,16 +120104,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel",
-        "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context.channel",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys/items",
+        "key_path": "auth.api_keys[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -116905,15 +120123,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/EvidenceCredentialConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -116962,41 +120181,51 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "fingerprint"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceCredentialConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/hash_secret_env",
-        "key_path": "audit.hash_secret_env",
+        "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens",
+        "key_path": "auth.bearer_tokens",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_secret_reference",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -117038,47 +120267,44 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/max_files",
-        "key_path": "audit.max_files",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens/items",
+        "key_path": "auth.bearer_tokens[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "object"
         ],
+        "local_reference": "#/$defs/EvidenceCredentialConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -117113,49 +120339,53 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "id",
+            "fingerprint"
+          ]
         },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceCredentialConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/max_size_mb",
-        "key_path": "audit.max_size_mb",
+        "pointer": "/$defs/EvidenceAuthConfig/properties/oidc",
+        "key_path": "auth.oidc",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
@@ -117204,22 +120434,22 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "issuer",
+            "jwks_url"
+          ]
         },
         {
           "keyword": "type",
           "value": [
-            "integer",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -117227,13 +120457,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/path",
-        "key_path": "audit.path",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
+        "key_path": "auth.api_keys[].authorization_details.access_mode",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -117242,14 +120472,14 @@
           "null",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -117294,14 +120524,24 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "unknown",
+            "machine_client",
+            "subject_bound",
+            "delegated_attestation"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "string"
           ]
         }
       ]
@@ -117309,31 +120549,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/sink",
-        "key_path": "audit.sink",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
+        "key_path": "auth.bearer_tokens[].authorization_details.access_mode",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -117368,45 +120609,60 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "enum",
+          "value": [
+            "unknown",
+            "machine_client",
+            "subject_bound",
+            "delegated_attestation"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "string"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuditConfig/properties/syslog_socket_path",
-        "key_path": "audit.syslog_socket_path",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
+        "key_path": "auth.api_keys[].authorization_details.actions",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_audit_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -117451,23 +120707,21 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/access_token_signing",
-        "key_path": "auth.access_token_signing",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
+        "key_path": "auth.bearer_tokens[].authorization_details.actions",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -117478,17 +120732,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/AccessTokenSigningConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -117539,20 +120792,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/AccessTokenSigningConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys",
-        "key_path": "auth.api_keys",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
+        "key_path": "auth.api_keys[].authorization_details.actions[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -117562,16 +120811,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -117622,15 +120870,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys/items",
-        "key_path": "auth.api_keys[]",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
+        "key_path": "auth.bearer_tokens[].authorization_details.actions[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -117641,14 +120889,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/EvidenceCredentialConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
@@ -117699,28 +120946,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "fingerprint"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens",
-        "key_path": "auth.bearer_tokens",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
+        "key_path": "auth.api_keys[].authorization_details.assisted_access_context",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -117731,16 +120967,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -117789,18 +121026,27 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "channel"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens/items",
-        "key_path": "auth.bearer_tokens[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
+        "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -117810,16 +121056,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/EvidenceCredentialConfig",
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -117871,49 +121118,47 @@
         {
           "keyword": "required",
           "value": [
-            "id",
-            "fingerprint"
+            "channel"
           ]
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthConfig/properties/oidc",
-        "key_path": "auth.oidc",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
+        "key_path": "auth.api_keys[].authorization_details.assurance_level",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -117948,26 +121193,22 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "issuer",
-            "jwks_url"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -117975,8 +121216,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
-        "key_path": "auth.api_keys[].authorization_details.access_mode",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
+        "key_path": "auth.bearer_tokens[].authorization_details.assurance_level",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -117990,11 +121231,11 @@
           "null",
           "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -118046,29 +121287,99 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "enum",
-          "value": [
-            "unknown",
-            "machine_client",
-            "subject_bound",
-            "delegated_attestation"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "string"
-          ]
+          "value": [
+            "string",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
+        "key_path": "auth.api_keys[].authorization_details.claims",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "array"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "security",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode",
-        "key_path": "auth.bearer_tokens[].authorization_details.access_mode",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
+        "key_path": "auth.bearer_tokens[].authorization_details.claims",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118079,17 +121390,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "rejected",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118139,29 +121449,110 @@
       ],
       "constraints": [
         {
-          "keyword": "enum",
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
+        "key_path": "auth.api_keys[].authorization_details.claims[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "object",
+          "string"
+        ],
+        "local_reference": "#/$defs/ClaimRef",
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "security",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "required",
           "value": [
-            "unknown",
-            "machine_client",
-            "subject_bound",
-            "delegated_attestation"
+            "id"
           ]
         },
         {
           "keyword": "type",
           "value": [
-            "null",
+            "object",
             "string"
           ]
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimRef"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
-        "key_path": "auth.api_keys[].authorization_details.actions",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
+        "key_path": "auth.bearer_tokens[].authorization_details.claims[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -118171,16 +121562,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object",
+          "string"
         ],
+        "local_reference": "#/$defs/ClaimRef",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118229,17 +121621,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "object",
+            "string"
+          ]
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimRef"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions",
-        "key_path": "auth.bearer_tokens[].authorization_details.actions",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
+        "key_path": "auth.api_keys[].authorization_details.consent_ref",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118250,16 +121655,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118310,16 +121716,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
-        "key_path": "auth.api_keys[].authorization_details.actions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
+        "key_path": "auth.bearer_tokens[].authorization_details.consent_ref",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -118329,15 +121738,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118388,16 +121799,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items",
-        "key_path": "auth.bearer_tokens[].authorization_details.actions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
+        "key_path": "auth.api_keys[].authorization_details.disclosure",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -118407,15 +121821,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118466,15 +121882,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
-        "key_path": "auth.api_keys[].authorization_details.assisted_access_context",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
+        "key_path": "auth.bearer_tokens[].authorization_details.disclosure",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118486,13 +121905,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -118544,17 +121963,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "channel"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -118562,8 +121975,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context",
-        "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
+        "key_path": "auth.api_keys[].authorization_details.format",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118575,13 +121988,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -118633,17 +122046,11 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "channel"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -118651,8 +122058,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
-        "key_path": "auth.api_keys[].authorization_details.assurance_level",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
+        "key_path": "auth.bearer_tokens[].authorization_details.format",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118734,8 +122141,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level",
-        "key_path": "auth.bearer_tokens[].authorization_details.assurance_level",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
+        "key_path": "auth.api_keys[].authorization_details.jurisdiction",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118817,8 +122224,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
-        "key_path": "auth.api_keys[].authorization_details.claims",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
+        "key_path": "auth.bearer_tokens[].authorization_details.jurisdiction",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118829,16 +122236,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118889,15 +122297,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
+        "key_path": "auth.api_keys[].authorization_details.legal_basis_ref",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -118908,16 +122319,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -118968,16 +122380,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
-        "key_path": "auth.api_keys[].authorization_details.claims[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
+        "key_path": "auth.bearer_tokens[].authorization_details.legal_basis_ref",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -118987,17 +122402,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object",
+          "null",
           "string"
         ],
-        "local_reference": "#/$defs/ClaimRef",
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -119046,31 +122461,21 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
-        },
         {
           "keyword": "type",
           "value": [
-            "object",
-            "string"
+            "string",
+            "null"
           ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRef"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items",
-        "key_path": "auth.bearer_tokens[].authorization_details.claims[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
+        "key_path": "auth.api_keys[].authorization_details.locations",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -119080,17 +122485,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object",
-          "string"
+          "array"
         ],
-        "local_reference": "#/$defs/ClaimRef",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -119139,30 +122543,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "object",
-            "string"
-          ]
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimRef"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
-        "key_path": "auth.api_keys[].authorization_details.consent_ref",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
+        "key_path": "auth.bearer_tokens[].authorization_details.locations",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119173,17 +122564,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -119234,19 +122624,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref",
-        "key_path": "auth.bearer_tokens[].authorization_details.consent_ref",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
+        "key_path": "auth.api_keys[].authorization_details.locations[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -119256,17 +122643,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -119317,18 +122702,93 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
-        "key_path": "auth.api_keys[].authorization_details.disclosure",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
+        "key_path": "auth.bearer_tokens[].authorization_details.locations[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "security",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
+        "key_path": "auth.api_keys[].authorization_details.purpose",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119410,8 +122870,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure",
-        "key_path": "auth.bearer_tokens[].authorization_details.disclosure",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
+        "key_path": "auth.bearer_tokens[].authorization_details.purpose",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119493,8 +122953,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
-        "key_path": "auth.api_keys[].authorization_details.format",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
+        "key_path": "auth.api_keys[].authorization_details.relationship",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119506,13 +122966,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -119564,11 +123024,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relationship_type",
+            "proof_claim"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -119576,8 +123043,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format",
-        "key_path": "auth.bearer_tokens[].authorization_details.format",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
+        "key_path": "auth.bearer_tokens[].authorization_details.relationship",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119589,13 +123056,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -119647,11 +123114,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "relationship_type",
+            "proof_claim"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -119659,8 +123133,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
-        "key_path": "auth.api_keys[].authorization_details.jurisdiction",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
+        "key_path": "auth.api_keys[].authorization_details.schema_version",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119671,17 +123145,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -119732,18 +123204,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction",
-        "key_path": "auth.bearer_tokens[].authorization_details.jurisdiction",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
+        "key_path": "auth.bearer_tokens[].authorization_details.schema_version",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119754,17 +123223,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -119815,18 +123282,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
-        "key_path": "auth.api_keys[].authorization_details.legal_basis_ref",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
+        "key_path": "auth.api_keys[].authorization_details.subject",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119838,13 +123302,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -119896,11 +123360,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "binding_claim",
+            "id_type"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -119908,8 +123379,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref",
-        "key_path": "auth.bearer_tokens[].authorization_details.legal_basis_ref",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
+        "key_path": "auth.bearer_tokens[].authorization_details.subject",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -119921,13 +123392,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "string"
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -119979,11 +123450,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "binding_claim",
+            "id_type"
+          ]
+        },
         {
           "keyword": "type",
           "value": [
-            "string",
-            "null"
+            "null",
+            "object"
           ]
         }
       ]
@@ -119991,8 +123469,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
-        "key_path": "auth.api_keys[].authorization_details.locations",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
+        "key_path": "auth.api_keys[].authorization_details.target",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120003,16 +123481,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120061,17 +123540,27 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id_type",
+            "id"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations",
-        "key_path": "auth.bearer_tokens[].authorization_details.locations",
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
+        "key_path": "auth.bearer_tokens[].authorization_details.target",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120082,16 +123571,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
         "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120140,18 +123630,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id_type",
+            "id"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
-        "key_path": "auth.api_keys[].authorization_details.locations[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
+        "key_path": "auth.api_keys[].authorization_details.type",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -120165,11 +123665,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120227,9 +123727,9 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items",
-        "key_path": "auth.bearer_tokens[].authorization_details.locations[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
+        "key_path": "auth.bearer_tokens[].authorization_details.type",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -120243,11 +123743,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120305,8 +123805,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
-        "key_path": "auth.api_keys[].authorization_details.purpose",
+        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
+        "key_path": "auth.api_keys[].authorization_details.relationship.proof_claim",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120317,17 +123817,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120378,18 +123876,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose",
-        "key_path": "auth.bearer_tokens[].authorization_details.purpose",
+        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
+        "key_path": "auth.bearer_tokens[].authorization_details.relationship.proof_claim",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120400,100 +123895,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
-        "key_path": "auth.api_keys[].authorization_details.relationship",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "null",
-          "object"
-        ],
-        "composed": true
-      },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120542,27 +123952,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship_type",
-            "proof_claim"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship",
-        "key_path": "auth.bearer_tokens[].authorization_details.relationship",
+        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
+        "key_path": "auth.api_keys[].authorization_details.relationship.relationship_type",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120573,17 +123973,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120632,27 +124030,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "relationship_type",
-            "proof_claim"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
-        "key_path": "auth.api_keys[].authorization_details.schema_version",
+        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
+        "key_path": "auth.bearer_tokens[].authorization_details.relationship.relationship_type",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120729,8 +124117,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version",
-        "key_path": "auth.bearer_tokens[].authorization_details.schema_version",
+        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
+        "key_path": "auth.api_keys[].authorization_details.subject.binding_claim",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120807,8 +124195,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
-        "key_path": "auth.api_keys[].authorization_details.subject",
+        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
+        "key_path": "auth.bearer_tokens[].authorization_details.subject.binding_claim",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120819,17 +124207,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120878,27 +124264,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "binding_claim",
-            "id_type"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject",
-        "key_path": "auth.bearer_tokens[].authorization_details.subject",
+        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
+        "key_path": "auth.api_keys[].authorization_details.subject.id_type",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120909,17 +124285,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -120968,27 +124342,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "binding_claim",
-            "id_type"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
-        "key_path": "auth.api_keys[].authorization_details.target",
+        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
+        "key_path": "auth.bearer_tokens[].authorization_details.subject.id_type",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -120999,17 +124363,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -121058,27 +124420,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id_type",
-            "id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target",
-        "key_path": "auth.bearer_tokens[].authorization_details.target",
+        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
+        "key_path": "auth.api_keys[].authorization_details.target.id",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -121089,17 +124441,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -121148,27 +124498,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id_type",
-            "id"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
-        "key_path": "auth.api_keys[].authorization_details.type",
+        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
+        "key_path": "auth.bearer_tokens[].authorization_details.target.id",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -121245,8 +124585,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type",
-        "key_path": "auth.bearer_tokens[].authorization_details.type",
+        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
+        "key_path": "auth.api_keys[].authorization_details.target.id_type",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -121323,8 +124663,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
-        "key_path": "auth.api_keys[].authorization_details.relationship.proof_claim",
+        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
+        "key_path": "auth.bearer_tokens[].authorization_details.target.id_type",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -121401,30 +124741,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim",
-        "key_path": "auth.bearer_tokens[].authorization_details.relationship.proof_claim",
+        "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes",
+        "key_path": "evidence.allowed_purposes",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -121459,33 +124800,30 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
-        "key_path": "auth.api_keys[].authorization_details.relationship.relationship_type",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes/items",
+        "key_path": "evidence.allowed_purposes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -121495,14 +124833,14 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -121537,14 +124875,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -121557,13 +124892,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type",
-        "key_path": "auth.bearer_tokens[].authorization_details.relationship.relationship_type",
+        "pointer": "/$defs/EvidenceConfig/properties/api_base_url",
+        "key_path": "evidence.api_base_url",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -121573,11 +124908,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -121635,13 +124971,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
-        "key_path": "auth.api_keys[].authorization_details.subject.binding_claim",
+        "pointer": "/$defs/EvidenceConfig/properties/api_version",
+        "key_path": "evidence.api_version",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -121651,14 +124987,15 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -121693,14 +125030,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -121713,30 +125047,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim",
-        "key_path": "auth.bearer_tokens[].authorization_details.subject.binding_claim",
+        "pointer": "/$defs/EvidenceConfig/properties/claims",
+        "key_path": "evidence.claims",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -121771,50 +125106,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
-        "key_path": "auth.api_keys[].authorization_details.subject.id_type",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceConfig/properties/claims/items",
+        "key_path": "evidence.claims[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ClaimDefinition",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -121849,33 +125182,45 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "title",
+            "version",
+            "subject_type",
+            "evidence_mode",
+            "rule"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ClaimDefinition"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type",
-        "key_path": "auth.bearer_tokens[].authorization_details.subject.id_type",
+        "pointer": "/$defs/EvidenceConfig/properties/claims_url",
+        "key_path": "evidence.claims_url",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -121885,11 +125230,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -121947,30 +125293,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
-        "key_path": "auth.api_keys[].authorization_details.target.id",
+        "pointer": "/$defs/EvidenceConfig/properties/concurrency",
+        "key_path": "evidence.concurrency",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/ConcurrencyConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -122005,47 +125353,49 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/ConcurrencyConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id",
-        "key_path": "auth.bearer_tokens[].authorization_details.target.id",
+        "pointer": "/$defs/EvidenceConfig/properties/credential_profiles",
+        "key_path": "evidence.credential_profiles",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -122096,34 +125446,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
-        "key_path": "auth.api_keys[].authorization_details.target.id_type",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceConfig/properties/credential_profiles/additionalProperties",
+        "key_path": "evidence.credential_profiles.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Each reviewed key names a credential profile and each value defines its exact claims, format, and issuance contract.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_credential_profiles_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/CredentialProfileConfig",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -122169,42 +125520,56 @@
         "knowledge_only",
         "generated_docs_never_load_country_values",
         "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "format",
+            "issuer",
+            "signing_key",
+            "vct"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/CredentialProfileConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type",
-        "key_path": "auth.bearer_tokens[].authorization_details.target.id_type",
+        "pointer": "/$defs/EvidenceConfig/properties/enabled",
+        "key_path": "evidence.enabled",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -122239,51 +125604,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes",
-        "key_path": "evidence.allowed_purposes",
+        "pointer": "/$defs/EvidenceConfig/properties/formats_url",
+        "key_path": "evidence.formats_url",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -122318,26 +125680,29 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes/items",
-        "key_path": "evidence.allowed_purposes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceConfig/properties/inline_batch_limit",
+        "key_path": "evidence.inline_batch_limit",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -122347,15 +125712,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -122401,40 +125767,53 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "maximum",
+          "value": 100
+        },
+        {
+          "keyword": "minimum",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/api_base_url",
-        "key_path": "evidence.api_base_url",
+        "pointer": "/$defs/EvidenceConfig/properties/machine_quota",
+        "key_path": "evidence.machine_quota",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/MachineQuotaConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -122469,51 +125848,52 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/MachineQuotaConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/api_version",
-        "key_path": "evidence.api_version",
+        "pointer": "/$defs/EvidenceConfig/properties/max_credential_validity_seconds",
+        "key_path": "evidence.max_credential_validity_seconds",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -122548,45 +125928,57 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/claims",
-        "key_path": "evidence.claims",
+        "pointer": "/$defs/EvidenceConfig/properties/relay",
+        "key_path": "evidence.relay",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "The one Registry Relay connection available to registry-backed claims.\nAuthentication remains a reloadable local file reference; core never\nloads the bearer token value.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -122632,18 +126024,29 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "base_url",
+            "workload_client_id",
+            "token_file"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/claims/items",
-        "key_path": "evidence.claims[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceConfig/properties/service_id",
+        "key_path": "evidence.service_id",
+        "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
@@ -122653,16 +126056,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/ClaimDefinition",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -122708,32 +126111,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "title",
-            "version",
-            "subject_type",
-            "evidence_mode",
-            "rule"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/ClaimDefinition"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/claims_url",
-        "key_path": "evidence.claims_url",
+        "pointer": "/$defs/EvidenceConfig/properties/signing_keys",
+        "key_path": "evidence.signing_keys",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -122744,13 +126132,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -122804,20 +126192,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/concurrency",
-        "key_path": "evidence.concurrency",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceConfig/properties/signing_keys/additionalProperties",
+        "key_path": "evidence.signing_keys.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Each reviewed key names a signing-key binding and each value references the operator-managed signing material and lifecycle metadata.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_signing_keys_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -122825,18 +126213,17 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/ConcurrencyConfig",
+        "local_reference": "#/$defs/SigningKeyConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -122871,14 +126258,26 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "provider",
+            "alg",
+            "kid",
+            "status"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
@@ -122886,19 +126285,19 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/ConcurrencyConfig"
+        "pointer": "/$defs/SigningKeyConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/credential_profiles",
-        "key_path": "evidence.credential_profiles",
+        "pointer": "/$defs/EvidenceConfig/properties/variables",
+        "key_path": "evidence.variables",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "purpose": "Closed union of request variables declared by authored services.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -122915,8 +126314,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -122951,14 +126350,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -122971,13 +126367,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/credential_profiles/additionalProperties",
-        "key_path": "evidence.credential_profiles.*",
+        "pointer": "/$defs/EvidenceConfig/properties/variables/additionalProperties",
+        "key_path": "evidence.variables.*",
         "path_kind": "map_value"
       },
-      "purpose": "Each reviewed key names a credential profile and each value defines its exact claims, format, and issuance contract.",
+      "purpose": "Each reviewed key names a Notary evidence variable and each value defines its bounded source and evaluation contract.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_credential_profiles_open_map",
+      "intent_profile": "notary_evidence_variables_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -122985,7 +126381,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/CredentialProfileConfig",
+        "local_reference": "#/$defs/RequestVariableConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
@@ -122994,8 +126390,8 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "notary",
@@ -123030,24 +126426,19 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
           "keyword": "required",
           "value": [
-            "format",
-            "issuer",
-            "signing_key",
-            "vct"
+            "from",
+            "type"
           ]
         },
         {
@@ -123057,37 +126448,38 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/CredentialProfileConfig"
+        "pointer": "/$defs/RequestVariableConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/enabled",
-        "key_path": "evidence.enabled",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
+        "key_path": "auth.api_keys[].authorization_details",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -123122,45 +126514,59 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "type",
+            "schema_version"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/formats_url",
-        "key_path": "evidence.formats_url",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
+        "key_path": "auth.bearer_tokens[].authorization_details",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -123209,40 +126615,50 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "type",
+            "schema_version"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/inline_batch_limit",
-        "key_path": "evidence.inline_batch_limit",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
+        "key_path": "auth.api_keys[].fingerprint",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/CredentialFingerprintRef",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -123277,42 +126693,43 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "maximum",
-          "value": 100
-        },
-        {
-          "keyword": "minimum",
-          "value": 1
+          "keyword": "required",
+          "value": [
+            "provider"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/CredentialFingerprintRef"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/machine_quota",
-        "key_path": "evidence.machine_quota",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
+        "key_path": "auth.bearer_tokens[].fingerprint",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -123320,18 +126737,17 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/MachineQuotaConfig",
+        "local_reference": "#/$defs/CredentialFingerprintRef",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -123366,14 +126782,23 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "provider"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
@@ -123381,34 +126806,33 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/MachineQuotaConfig"
+        "pointer": "/$defs/CredentialFingerprintRef"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/max_credential_validity_seconds",
-        "key_path": "evidence.max_credential_validity_seconds",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
+        "key_path": "auth.api_keys[].id",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -123457,49 +126881,39 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/relay",
-        "key_path": "evidence.relay",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
+        "key_path": "auth.bearer_tokens[].id",
         "path_kind": "property"
       },
-      "purpose": "The one Registry Relay connection available to registry-backed claims.\nAuthentication remains a reloadable local file reference; core never\nloads the bearer token value.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -123534,59 +126948,51 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "base_url",
-            "workload_client_id",
-            "token_file"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/service_id",
-        "key_path": "evidence.service_id",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
+        "key_path": "auth.api_keys[].scopes",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -123621,36 +127027,39 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/signing_keys",
-        "key_path": "evidence.signing_keys",
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
+        "key_path": "auth.bearer_tokens[].scopes",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
         "composed": false
       },
@@ -123710,33 +127119,32 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/signing_keys/additionalProperties",
-        "key_path": "evidence.signing_keys.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
+        "key_path": "auth.api_keys[].scopes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Each reviewed key names a signing-key binding and each value references the operator-managed signing material and lifecycle metadata.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_signing_keys_open_map",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/SigningKeyConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
@@ -123784,56 +127192,42 @@
         "knowledge_only",
         "generated_docs_never_load_country_values",
         "sensitive_operational_metadata",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "provider",
-            "alg",
-            "kid",
-            "status"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SigningKeyConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/variables",
-        "key_path": "evidence.variables",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
+        "key_path": "auth.bearer_tokens[].scopes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Closed union of request variables declared by authored services.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_internal",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -123868,48 +127262,51 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceConfig/properties/variables/additionalProperties",
-        "key_path": "evidence.variables.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allow_insecure_localhost",
+        "key_path": "auth.oidc.allow_insecure_localhost",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a Notary evidence variable and each value defines its bounded source and evaluation contract.",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_variables_open_map",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/RequestVariableConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -123949,55 +127346,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "from",
-            "type"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RequestVariableConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
-        "key_path": "auth.api_keys[].authorization_details",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms",
+        "key_path": "auth.oidc.allowed_algorithms",
         "path_kind": "property"
       },
-      "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -124032,62 +127417,123 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "type",
-            "schema_version"
-          ]
-        },
+          "keyword": "type",
+          "value": "array"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms/items",
+        "key_path": "auth.oidc.allowed_algorithms[]",
+        "path_kind": "array_item"
+      },
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_internal",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "not_applicable"
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details",
-        "key_path": "auth.bearer_tokens[].authorization_details",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients",
+        "key_path": "auth.oidc.allowed_clients",
         "path_kind": "property"
       },
-      "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "array"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -124122,61 +127568,47 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "type",
-            "schema_version"
-          ]
-        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
-        "key_path": "auth.api_keys[].fingerprint",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients/items",
+        "key_path": "auth.oidc.allowed_clients[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/CredentialFingerprintRef",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -124211,38 +127643,25 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "provider"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint",
-        "key_path": "auth.bearer_tokens[].fingerprint",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types",
+        "key_path": "auth.oidc.allowed_token_types",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -124253,16 +127672,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/CredentialFingerprintRef",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -124311,28 +127730,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "provider"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/CredentialFingerprintRef"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
-        "key_path": "auth.api_keys[].id",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types/items",
+        "key_path": "auth.oidc.allowed_token_types[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -124346,11 +127755,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -124408,8 +127817,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/id",
-        "key_path": "auth.bearer_tokens[].id",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences",
+        "key_path": "auth.oidc.audiences",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -124420,15 +127829,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -124479,16 +127889,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
-        "key_path": "auth.api_keys[].scopes",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences/items",
+        "key_path": "auth.oidc.audiences[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -124498,16 +127908,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -124558,15 +127967,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes",
-        "key_path": "auth.bearer_tokens[].scopes",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/issuer",
+        "key_path": "auth.oidc.issuer",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -124577,16 +127986,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -124637,16 +128045,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
-        "key_path": "auth.api_keys[].scopes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/jwks_url",
+        "key_path": "auth.oidc.jwks_url",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -124660,11 +128068,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -124722,13 +128130,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items",
-        "key_path": "auth.bearer_tokens[].scopes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/leeway",
+        "key_path": "auth.oidc.leeway",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -124736,16 +128144,18 @@
         "schema_types": [
           "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -124780,14 +128190,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -124795,13 +128202,17 @@
           "keyword": "type",
           "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allow_insecure_localhost",
-        "key_path": "auth.oidc.allow_insecure_localhost",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/principal_claim",
+        "key_path": "auth.oidc.principal_claim",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -124812,13 +128223,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -124869,15 +128280,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms",
-        "key_path": "auth.oidc.allowed_algorithms",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_claim",
+        "key_path": "auth.oidc.scope_claim",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -124888,13 +128299,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -124945,16 +128356,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms/items",
-        "key_path": "auth.oidc.allowed_algorithms[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map",
+        "key_path": "auth.oidc.scope_map",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -124964,15 +128375,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -125020,20 +128432,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients",
-        "key_path": "auth.oidc.allowed_clients",
-        "path_kind": "property"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties",
+        "key_path": "auth.oidc.scope_map.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Each reviewed key is an external token scope and each value is the bounded Notary scope mapping granted for that exact token scope.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_auth_oidc_scope_map_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -125043,15 +128455,14 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "notary",
@@ -125091,7 +128502,7 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
@@ -125103,8 +128514,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients/items",
-        "key_path": "auth.oidc.allowed_clients[]",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties/items",
+        "key_path": "auth.oidc.scope_map.*[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -125178,31 +128589,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types",
-        "key_path": "auth.oidc.allowed_token_types",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_separator",
+        "key_path": "auth.oidc.scope_separator",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_auth_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -125237,29 +128648,26 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types/items",
-        "key_path": "auth.oidc.allowed_token_types[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_endpoint",
+        "key_path": "auth.oidc.userinfo_endpoint",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
       "purpose_source": "reviewed_profile",
@@ -125269,15 +128677,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -125328,15 +128738,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences",
-        "key_path": "auth.oidc.audiences",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers",
+        "key_path": "auth.oidc.userinfo_issuers",
         "path_kind": "property"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -125414,8 +128827,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences/items",
-        "key_path": "auth.oidc.audiences[]",
+        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers/items",
+        "key_path": "auth.oidc.userinfo_issuers[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
@@ -125492,108 +128905,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/issuer",
-        "key_path": "auth.oidc.issuer",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/jwks_url",
-        "key_path": "auth.oidc.jwks_url",
+        "pointer": "/$defs/FederationConfig/properties/clock_leeway_seconds",
+        "key_path": "federation.clock_leeway_seconds",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -125628,46 +128964,51 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/leeway",
-        "key_path": "auth.oidc.leeway",
+        "pointer": "/$defs/FederationConfig/properties/emergency_denylist",
+        "key_path": "federation.emergency_denylist",
         "path_kind": "property"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_auth_internal",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
+        "local_reference": "#/$defs/FederationEmergencyDenylistConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -125718,36 +129059,36 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
+        "pointer": "/$defs/FederationEmergencyDenylistConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/principal_claim",
-        "key_path": "auth.oidc.principal_claim",
+        "pointer": "/$defs/FederationConfig/properties/enabled",
+        "key_path": "federation.enabled",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -125798,32 +129139,32 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_claim",
-        "key_path": "auth.oidc.scope_claim",
+        "pointer": "/$defs/FederationConfig/properties/evaluation_profiles",
+        "key_path": "federation.evaluation_profiles",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -125874,20 +129215,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map",
-        "key_path": "auth.oidc.scope_map",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationConfig/properties/evaluation_profiles/items",
+        "key_path": "federation.evaluation_profiles[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -125895,14 +129236,14 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/FederationEvaluationProfileConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -125948,97 +129289,35 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "id",
+            "ruleset",
+            "claim_id",
+            "subject_id_type"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
         }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties",
-        "key_path": "auth.oidc.scope_map.*",
-        "path_kind": "map_value"
-      },
-      "purpose": "Each reviewed key is an external token scope and each value is the bounded Notary scope mapping granted for that exact token scope.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_oidc_scope_map_open_map",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "array"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
       ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "array"
-        }
-      ]
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/FederationEvaluationProfileConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties/items",
-        "key_path": "auth.oidc.scope_map.*[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationConfig/properties/federation_api",
+        "key_path": "federation.federation_api",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -126048,11 +129327,12 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -126107,25 +129387,25 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_separator",
-        "key_path": "auth.oidc.scope_separator",
+        "pointer": "/$defs/FederationConfig/properties/inbound_body_limit_bytes",
+        "key_path": "federation.inbound_body_limit_bytes",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_internal",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -126174,34 +129454,41 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_endpoint",
-        "key_path": "auth.oidc.userinfo_endpoint",
+        "pointer": "/$defs/FederationConfig/properties/issuer",
+        "key_path": "federation.issuer",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_federation_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
@@ -126250,47 +129537,43 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers",
-        "key_path": "auth.oidc.userinfo_issuers",
+        "pointer": "/$defs/FederationConfig/properties/jwks_uri",
+        "key_path": "federation.jwks_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -126325,50 +129608,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers/items",
-        "key_path": "auth.oidc.userinfo_issuers[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationConfig/properties/max_request_lifetime_seconds",
+        "key_path": "federation.max_request_lifetime_seconds",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.",
+      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_auth_sensitive",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -126403,28 +129684,33 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/clock_leeway_seconds",
-        "key_path": "federation.clock_leeway_seconds",
+        "pointer": "/$defs/FederationConfig/properties/node_id",
+        "key_path": "federation.node_id",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -126435,13 +129721,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -126490,30 +129776,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/emergency_denylist",
-        "key_path": "federation.emergency_denylist",
+        "pointer": "/$defs/FederationConfig/properties/pairwise_subject_hash",
+        "key_path": "federation.pairwise_subject_hash",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_federation_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -126521,7 +129799,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/FederationEmergencyDenylistConfig",
+        "local_reference": "#/$defs/FederationPairwiseSubjectHashConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -126531,8 +129809,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -126567,12 +129845,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -126582,14 +129862,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig"
+        "pointer": "/$defs/FederationPairwiseSubjectHashConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/enabled",
-        "key_path": "federation.enabled",
+        "pointer": "/$defs/FederationConfig/properties/peers",
+        "key_path": "federation.peers",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -126600,7 +129880,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
@@ -126657,16 +129937,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/evaluation_profiles",
-        "key_path": "federation.evaluation_profiles",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationConfig/properties/peers/items",
+        "key_path": "federation.peers[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -126676,16 +129956,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/FederationPeerConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -126731,18 +130011,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "node_id",
+            "issuer",
+            "jwks_uri"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/FederationPeerConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/evaluation_profiles/items",
-        "key_path": "federation.evaluation_profiles[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationConfig/properties/response_shaping",
+        "key_path": "federation.response_shaping",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -126754,14 +130046,15 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/FederationEvaluationProfileConfig",
+        "local_reference": "#/$defs/FederationResponseShapingConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -126807,15 +130100,6 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "ruleset",
-            "claim_id",
-            "subject_id_type"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -126823,14 +130107,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig"
+        "pointer": "/$defs/FederationResponseShapingConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/federation_api",
-        "key_path": "federation.federation_api",
+        "pointer": "/$defs/FederationConfig/properties/signing",
+        "key_path": "federation.signing",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -126841,13 +130125,14 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/FederationSigningConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -126896,17 +130181,27 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "signing_key"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/FederationSigningConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/inbound_body_limit_bytes",
-        "key_path": "federation.inbound_body_limit_bytes",
+        "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions",
+        "key_path": "federation.supported_protocol_versions",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -126917,7 +130212,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -126972,30 +130267,22 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/issuer",
-        "key_path": "federation.issuer",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions/items",
+        "key_path": "federation.supported_protocol_versions[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -127005,15 +130292,14 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -127048,14 +130334,12 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -127067,8 +130351,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/jwks_uri",
-        "key_path": "federation.jwks_uri",
+        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids",
+        "key_path": "federation.emergency_denylist.kids",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127079,13 +130363,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -127136,16 +130420,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/max_request_lifetime_seconds",
-        "key_path": "federation.max_request_lifetime_seconds",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids/items",
+        "key_path": "federation.emergency_denylist.kids[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -127155,16 +130439,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127210,25 +130493,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/node_id",
-        "key_path": "federation.node_id",
+        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids",
+        "key_path": "federation.emergency_denylist.node_ids",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127239,13 +130514,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -127296,39 +130571,37 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/pairwise_subject_hash",
-        "key_path": "federation.pairwise_subject_hash",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids/items",
+        "key_path": "federation.emergency_denylist.node_ids[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/FederationPairwiseSubjectHashConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -127363,31 +130636,25 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPairwiseSubjectHashConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/peers",
-        "key_path": "federation.peers",
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/assurance_level",
+        "key_path": "federation.evaluation_profiles[].assurance_level",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127398,16 +130665,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127455,16 +130723,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/peers/items",
-        "key_path": "federation.peers[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/claim_id",
+        "key_path": "federation.evaluation_profiles[].claim_id",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -127474,16 +130745,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/FederationPeerConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127529,29 +130799,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "node_id",
-            "issuer",
-            "jwks_uri"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/response_shaping",
-        "key_path": "federation.response_shaping",
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/consent_ref",
+        "key_path": "federation.evaluation_profiles[].consent_ref",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127562,17 +130820,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/FederationResponseShapingConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127620,19 +130878,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "string",
+            "null"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationResponseShapingConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/signing",
-        "key_path": "federation.signing",
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/disclosure",
+        "key_path": "federation.evaluation_profiles[].disclosure",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127643,17 +130900,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "null",
+          "string"
         ],
-        "local_reference": "#/$defs/FederationSigningConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127700,26 +130957,19 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
+          "keyword": "type",
           "value": [
-            "signing_key"
+            "string",
+            "null"
           ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationSigningConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions",
-        "key_path": "federation.supported_protocol_versions",
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/id",
+        "key_path": "federation.evaluation_profiles[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127730,16 +130980,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127787,16 +131036,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions/items",
-        "key_path": "federation.supported_protocol_versions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/jurisdiction",
+        "key_path": "federation.evaluation_profiles[].jurisdiction",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -127806,15 +131055,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127862,15 +131113,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids",
-        "key_path": "federation.emergency_denylist.kids",
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/legal_basis_ref",
+        "key_path": "federation.evaluation_profiles[].legal_basis_ref",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -127881,16 +131135,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -127938,16 +131193,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids/items",
-        "key_path": "federation.emergency_denylist.kids[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/max_claim_result_age_seconds",
+        "key_path": "federation.evaluation_profiles[].max_claim_result_age_seconds",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -127957,15 +131215,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer",
+          "null"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128011,17 +131271,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "integer",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids",
-        "key_path": "federation.emergency_denylist.node_ids",
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/ruleset",
+        "key_path": "federation.evaluation_profiles[].ruleset",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -128032,16 +131303,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128089,20 +131359,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids/items",
-        "key_path": "federation.emergency_denylist.node_ids[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/subject_id_type",
+        "key_path": "federation.evaluation_profiles[].subject_id_type",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_federation_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -128112,14 +131382,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -128154,12 +131424,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -128171,32 +131443,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/assurance_level",
-        "key_path": "federation.evaluation_profiles[].assurance_level",
+        "pointer": "/$defs/FederationPairwiseSubjectHashConfig/properties/secret_env",
+        "key_path": "federation.pairwise_subject_hash.secret_env",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_federation_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -128231,28 +131502,27 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/claim_id",
-        "key_path": "federation.evaluation_profiles[].claim_id",
+        "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_localhost",
+        "key_path": "federation.peers[].allow_insecure_localhost",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -128263,15 +131533,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128319,15 +131590,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/consent_ref",
-        "key_path": "federation.evaluation_profiles[].consent_ref",
+        "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_private_network",
+        "key_path": "federation.peers[].allow_insecure_private_network",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -128338,17 +131609,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128396,18 +131666,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/disclosure",
-        "key_path": "federation.evaluation_profiles[].disclosure",
+        "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles",
+        "key_path": "federation.peers[].allowed_profiles",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -128418,17 +131685,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128476,19 +131742,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/id",
-        "key_path": "federation.evaluation_profiles[].id",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles/items",
+        "key_path": "federation.peers[].allowed_profiles[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -128502,11 +131765,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128561,8 +131824,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/jurisdiction",
-        "key_path": "federation.evaluation_profiles[].jurisdiction",
+        "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions",
+        "key_path": "federation.peers[].allowed_protocol_versions",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -128573,17 +131836,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128631,19 +131893,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/legal_basis_ref",
-        "key_path": "federation.evaluation_profiles[].legal_basis_ref",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions/items",
+        "key_path": "federation.peers[].allowed_protocol_versions[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -128653,17 +131912,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128711,18 +131968,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/max_claim_result_age_seconds",
-        "key_path": "federation.evaluation_profiles[].max_claim_result_age_seconds",
+        "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes",
+        "key_path": "federation.peers[].allowed_purposes",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -128733,17 +131987,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer",
-          "null"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128789,29 +132042,18 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": [
-            "integer",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/ruleset",
-        "key_path": "federation.evaluation_profiles[].ruleset",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes/items",
+        "key_path": "federation.peers[].allowed_purposes[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -128825,11 +132067,11 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -128884,108 +132126,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationEvaluationProfileConfig/properties/subject_id_type",
-        "key_path": "federation.evaluation_profiles[].subject_id_type",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/FederationPairwiseSubjectHashConfig/properties/secret_env",
-        "key_path": "federation.pairwise_subject_hash.secret_env",
+        "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes",
+        "key_path": "federation.peers[].evaluation_scopes",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_secret_reference",
+      "intent_profile": "notary_federation_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -129020,28 +132185,26 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_localhost",
-        "key_path": "federation.peers[].allow_insecure_localhost",
-        "path_kind": "property"
+        "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes/items",
+        "key_path": "federation.peers[].evaluation_scopes[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -129051,16 +132214,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -129108,38 +132270,37 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_private_network",
-        "key_path": "federation.peers[].allow_insecure_private_network",
+        "pointer": "/$defs/FederationPeerConfig/properties/issuer",
+        "key_path": "federation.peers[].issuer",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_federation_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -129174,25 +132335,27 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles",
-        "key_path": "federation.peers[].allowed_profiles",
+        "pointer": "/$defs/FederationPeerConfig/properties/jwks_uri",
+        "key_path": "federation.peers[].jwks_uri",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -129203,16 +132366,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -129260,16 +132422,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles/items",
-        "key_path": "federation.peers[].allowed_profiles[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationPeerConfig/properties/node_id",
+        "key_path": "federation.peers[].node_id",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
@@ -129283,11 +132445,11 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -129342,8 +132504,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions",
-        "key_path": "federation.peers[].allowed_protocol_versions",
+        "pointer": "/$defs/FederationResponseShapingConfig/properties/minimum_denial_latency_ms",
+        "key_path": "federation.response_shaping.minimum_denial_latency_ms",
         "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
@@ -129354,7 +132516,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -129409,22 +132571,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions/items",
-        "key_path": "federation.peers[].allowed_protocol_versions[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/FederationSigningConfig/properties/signing_key",
+        "key_path": "federation.signing.signing_key",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_federation_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -129434,14 +132604,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -129476,12 +132646,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
@@ -129493,13 +132665,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes",
-        "key_path": "federation.peers[].allowed_purposes",
+        "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods",
+        "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -129516,8 +132688,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -129552,11 +132724,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -129569,13 +132744,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes/items",
-        "key_path": "federation.peers[].allowed_purposes[]",
+        "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods/items",
+        "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods[]",
         "path_kind": "array_item"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -129591,8 +132766,8 @@
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -129627,11 +132802,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -129644,31 +132822,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes",
-        "key_path": "federation.peers[].evaluation_scopes",
+        "pointer": "/$defs/HolderBindingConfig/properties/mode",
+        "key_path": "evidence.credential_profiles.*.holder_binding.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -129703,44 +132881,131 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes/items",
-        "key_path": "federation.peers[].evaluation_scopes[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/HolderBindingConfig/properties/proof_of_possession",
+        "key_path": "evidence.credential_profiles.*.holder_binding.proof_of_possession",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "security",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": [
+            "string",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/MachineQuotaConfig/properties/enabled",
+        "key_path": "evidence.machine_quota.enabled",
+        "path_kind": "property"
+      },
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "boolean"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
+      "default": {
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -129788,34 +133053,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/issuer",
-        "key_path": "federation.peers[].issuer",
+        "pointer": "/$defs/MachineQuotaConfig/properties/subjects_per_minute",
+        "key_path": "evidence.machine_quota.subjects_per_minute",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -129860,25 +133126,34 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint32"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/jwks_uri",
-        "key_path": "federation.peers[].jwks_uri",
+        "pointer": "/$defs/NotaryInstanceConfig/properties/environment",
+        "key_path": "instance.environment",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_instance_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -129888,11 +133163,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -129934,8 +133210,7 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -129947,13 +133222,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationPeerConfig/properties/node_id",
-        "key_path": "federation.peers[].node_id",
+        "pointer": "/$defs/NotaryInstanceConfig/properties/id",
+        "key_path": "instance.id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_instance_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -129963,11 +133238,12 @@
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -130009,8 +133285,7 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
@@ -130022,28 +133297,29 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationResponseShapingConfig/properties/minimum_denial_latency_ms",
-        "key_path": "federation.response_shaping.minimum_denial_latency_ms",
+        "pointer": "/$defs/NotaryInstanceConfig/properties/jurisdiction",
+        "key_path": "instance.jurisdiction",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_internal",
+      "intent_profile": "notary_instance_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -130085,51 +133361,47 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/FederationSigningConfig/properties/signing_key",
-        "key_path": "federation.signing.signing_key",
+        "pointer": "/$defs/NotaryInstanceConfig/properties/owner",
+        "key_path": "instance.owner",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.",
+      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_federation_sensitive",
+      "intent_profile": "notary_instance_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -130164,47 +133436,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods",
-        "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods",
+        "pointer": "/$defs/NotaryInstanceConfig/properties/public_base_url",
+        "key_path": "instance.public_base_url",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_instance_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -130249,26 +133522,28 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "sensitive_operational_metadata"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods/items",
-        "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/Oid4vciAuthorizationConfig/properties/require_pkce_method",
+        "key_path": "oid4vci.authorization.require_pkce_method",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -130278,14 +133553,15 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -130320,14 +133596,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -130340,25 +133613,25 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/mode",
-        "key_path": "evidence.credential_profiles.*.holder_binding.mode",
+        "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences",
+        "key_path": "oid4vci.accepted_token_audiences",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -130412,36 +133685,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/HolderBindingConfig/properties/proof_of_possession",
-        "key_path": "evidence.credential_profiles.*.holder_binding.proof_of_possession",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences/items",
+        "key_path": "oid4vci.accepted_token_audiences[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -130492,30 +133763,28 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/MachineQuotaConfig/properties/enabled",
-        "key_path": "evidence.machine_quota.enabled",
+        "pointer": "/$defs/Oid4vciConfig/properties/authorization",
+        "key_path": "oid4vci.authorization",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
+        "local_reference": "#/$defs/Oid4vciAuthorizationConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -130571,26 +133840,30 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciAuthorizationConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/MachineQuotaConfig/properties/subjects_per_minute",
-        "key_path": "evidence.machine_quota.subjects_per_minute",
+        "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers",
+        "key_path": "oid4vci.authorization_servers",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -130601,8 +133874,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -130637,41 +133910,30 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/environment",
-        "key_path": "instance.environment",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers/items",
+        "key_path": "oid4vci.authorization_servers[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -130681,12 +133943,11 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -130728,7 +133989,8 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -130740,31 +134002,31 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/id",
-        "key_path": "instance.id",
+        "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations",
+        "key_path": "oid4vci.credential_configurations",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -130799,48 +134061,51 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/jurisdiction",
-        "key_path": "instance.jurisdiction",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations/additionalProperties",
+        "key_path": "oid4vci.credential_configurations.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Each reviewed key names an OpenID4VCI credential configuration and each value defines the advertised and issued credential contract.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
+      "intent_profile": "notary_oid4vci_credential_configurations_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/Oid4vciCredentialConfigurationConfig",
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "requiredness": "not_applicable",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -130875,51 +134140,65 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "required",
           "value": [
-            "string",
-            "null"
+            "credential_profile",
+            "format",
+            "scope",
+            "vct",
+            "display_name"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/owner",
-        "key_path": "instance.owner",
+        "pointer": "/$defs/Oid4vciConfig/properties/credential_endpoint",
+        "key_path": "oid4vci.credential_endpoint",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -130954,48 +134233,48 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/NotaryInstanceConfig/properties/public_base_url",
-        "key_path": "instance.public_base_url",
+        "pointer": "/$defs/Oid4vciConfig/properties/credential_issuer",
+        "key_path": "oid4vci.credential_issuer",
         "path_kind": "property"
       },
-      "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_instance_sensitive",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -131040,23 +134319,21 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciAuthorizationConfig/properties/require_pkce_method",
-        "key_path": "oid4vci.authorization.require_pkce_method",
+        "pointer": "/$defs/Oid4vciConfig/properties/display",
+        "key_path": "oid4vci.display",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -131067,13 +134344,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -131124,38 +134401,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences",
-        "key_path": "oid4vci.accepted_token_audiences",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciConfig/properties/display/items",
+        "key_path": "oid4vci.display[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "object"
         ],
+        "local_reference": "#/$defs/Oid4vciIssuerDisplayConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -131190,50 +134467,58 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "name"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciIssuerDisplayConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences/items",
-        "key_path": "oid4vci.accepted_token_audiences[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/Oid4vciConfig/properties/enabled",
+        "key_path": "oid4vci.enabled",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -131268,28 +134553,25 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/authorization",
-        "key_path": "oid4vci.authorization",
+        "pointer": "/$defs/Oid4vciConfig/properties/nonce",
+        "key_path": "oid4vci.nonce",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -131302,7 +134584,7 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciAuthorizationConfig",
+        "local_reference": "#/$defs/Oid4vciNonceConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -131363,37 +134645,38 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciAuthorizationConfig"
+        "pointer": "/$defs/Oid4vciNonceConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers",
-        "key_path": "oid4vci.authorization_servers",
+        "pointer": "/$defs/Oid4vciConfig/properties/nonce_endpoint",
+        "key_path": "oid4vci.nonce_endpoint",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -131428,30 +134711,36 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers/items",
-        "key_path": "oid4vci.authorization_servers[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/Oid4vciConfig/properties/offer_endpoint",
+        "key_path": "oid4vci.offer_endpoint",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -131461,14 +134750,15 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -131503,11 +134793,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -131520,13 +134813,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations",
-        "key_path": "oid4vci.credential_configurations",
+        "pointer": "/$defs/Oid4vciConfig/properties/pre_authorized_code",
+        "key_path": "oid4vci.pre_authorized_code",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -131534,6 +134827,7 @@
         "schema_types": [
           "object"
         ],
+        "local_reference": "#/$defs/Oid4vciPreAuthorizedCodeConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -131543,8 +134837,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -131579,14 +134873,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -131594,18 +134885,22 @@
           "keyword": "type",
           "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations/additionalProperties",
-        "key_path": "oid4vci.credential_configurations.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/Oid4vciConfig/properties/proof",
+        "key_path": "oid4vci.proof",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names an OpenID4VCI credential configuration and each value defines the advertised and issued credential contract.",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_credential_configurations_open_map",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -131613,17 +134908,18 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciCredentialConfigurationConfig",
+        "local_reference": "#/$defs/Oid4vciProofConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -131658,27 +134954,14 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "credential_profile",
-            "format",
-            "scope",
-            "vct",
-            "display_name"
-          ]
-        },
         {
           "keyword": "type",
           "value": "object"
@@ -131686,14 +134969,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig"
+        "pointer": "/$defs/Oid4vciProofConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_endpoint",
-        "key_path": "oid4vci.credential_endpoint",
+        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/display_name",
+        "key_path": "oid4vci.credential_configurations.*.claims[].display_name",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -131708,12 +134991,11 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -131771,8 +135053,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/credential_issuer",
-        "key_path": "oid4vci.credential_issuer",
+        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/id",
+        "key_path": "oid4vci.credential_configurations.*.claims[].id",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -131787,12 +135069,11 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -131850,13 +135131,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/display",
-        "key_path": "oid4vci.display",
+        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path",
+        "key_path": "oid4vci.credential_configurations.*.claims[].output_path",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -131866,15 +135147,14 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -131909,11 +135189,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -131926,117 +135209,30 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/display/items",
-        "key_path": "oid4vci.display[]",
+        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path/items",
+        "key_path": "oid4vci.credential_configurations.*.claims[].output_path[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciIssuerDisplayConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "name"
-          ]
-        },
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/enabled",
-        "key_path": "oid4vci.enabled",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "boolean"
-        ],
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -132071,49 +135267,50 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/nonce",
-        "key_path": "oid4vci.nonce",
+        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/sd",
+        "key_path": "oid4vci.credential_configurations.*.claims[].sd",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciNonceConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -132148,29 +135345,28 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciNonceConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/nonce_endpoint",
-        "key_path": "oid4vci.nonce_endpoint",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claim_id",
+        "key_path": "oid4vci.credential_configurations.*.claim_id",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132190,8 +135386,8 @@
       "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -132252,8 +135448,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/offer_endpoint",
-        "key_path": "oid4vci.offer_endpoint",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims",
+        "key_path": "oid4vci.credential_configurations.*.claims",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132264,16 +135460,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -132324,20 +135520,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/pre_authorized_code",
-        "key_path": "oid4vci.pre_authorized_code",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims/items",
+        "key_path": "oid4vci.credential_configurations.*.claims[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -132345,18 +135541,17 @@
         "schema_types": [
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciPreAuthorizedCodeConfig",
+        "local_reference": "#/$defs/Oid4vciCredentialClaimConfig",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -132391,95 +135586,26 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciConfig/properties/proof",
-        "key_path": "oid4vci.proof",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/Oid4vciProofConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
+          "keyword": "required",
+          "value": [
+            "id",
+            "output_path",
+            "display_name",
+            "sd"
+          ]
+        },
         {
           "keyword": "type",
           "value": "object"
@@ -132487,14 +135613,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciProofConfig"
+        "pointer": "/$defs/Oid4vciCredentialClaimConfig"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/display_name",
-        "key_path": "oid4vci.credential_configurations.*.claims[].display_name",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/credential_profile",
+        "key_path": "oid4vci.credential_configurations.*.credential_profile",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132571,8 +135697,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/id",
-        "key_path": "oid4vci.credential_configurations.*.claims[].id",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported",
+        "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132583,15 +135709,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -132642,16 +135769,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path",
-        "key_path": "oid4vci.credential_configurations.*.claims[].output_path",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported/items",
+        "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported[]",
+        "path_kind": "array_item"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
@@ -132661,15 +135788,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -132720,16 +135847,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path/items",
-        "key_path": "oid4vci.credential_configurations.*.claims[].output_path[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display",
+        "key_path": "oid4vci.credential_configurations.*.display",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
@@ -132739,15 +135866,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/Oid4vciCredentialDisplayConfig",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -132798,15 +135927,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/sd",
-        "key_path": "oid4vci.credential_configurations.*.claims[].sd",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display_name",
+        "key_path": "oid4vci.credential_configurations.*.display_name",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132883,8 +136016,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claim_id",
-        "key_path": "oid4vci.credential_configurations.*.claim_id",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/format",
+        "key_path": "oid4vci.credential_configurations.*.format",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132895,17 +136028,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
-      "null_behavior": "conditional",
+      "requiredness": "required",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -132956,18 +136087,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims",
-        "key_path": "oid4vci.credential_configurations.*.claims",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported",
+        "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -132986,8 +136114,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133045,8 +136173,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims/items",
-        "key_path": "oid4vci.credential_configurations.*.claims[]",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported/items",
+        "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported[]",
         "path_kind": "array_item"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133057,14 +136185,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/Oid4vciCredentialClaimConfig",
         "composed": false
       },
       "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "not_applicable"
       },
@@ -133115,30 +136242,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "required",
-          "value": [
-            "id",
-            "output_path",
-            "display_name",
-            "sd"
-          ]
-        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialClaimConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/credential_profile",
-        "key_path": "oid4vci.credential_configurations.*.credential_profile",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/scope",
+        "key_path": "oid4vci.credential_configurations.*.scope",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133215,8 +136329,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported",
-        "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported",
+        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/vct",
+        "key_path": "oid4vci.credential_configurations.*.vct",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133227,16 +136341,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133287,16 +136400,16 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported/items",
-        "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_color",
+        "key_path": "oid4vci.credential_configurations.*.display.background_color",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
@@ -133306,15 +136419,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133365,15 +136480,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display",
-        "key_path": "oid4vci.credential_configurations.*.display",
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_image",
+        "key_path": "oid4vci.credential_configurations.*.display.background_image",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133384,17 +136502,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "object"
         ],
-        "local_reference": "#/$defs/Oid4vciCredentialDisplayConfig",
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133445,19 +136563,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": [
+            "null",
+            "object"
+          ]
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display_name",
-        "key_path": "oid4vci.credential_configurations.*.display_name",
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/description",
+        "key_path": "oid4vci.credential_configurations.*.display.description",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133468,15 +136585,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133527,15 +136646,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/format",
-        "key_path": "oid4vci.credential_configurations.*.format",
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/locale",
+        "key_path": "oid4vci.credential_configurations.*.display.locale",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133546,15 +136668,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133605,15 +136729,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported",
-        "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported",
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/logo",
+        "key_path": "oid4vci.credential_configurations.*.display.logo",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133624,16 +136751,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133684,16 +136812,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported/items",
-        "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/secondary_image",
+        "key_path": "oid4vci.credential_configurations.*.display.secondary_image",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
@@ -133703,15 +136834,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133762,15 +136895,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/scope",
-        "key_path": "oid4vci.credential_configurations.*.scope",
+        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/text_color",
+        "key_path": "oid4vci.credential_configurations.*.display.text_color",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133781,15 +136917,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133840,15 +136978,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/vct",
-        "key_path": "oid4vci.credential_configurations.*.vct",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
+        "key_path": "oid4vci.credential_configurations.*.display.background_image.alt_text",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -133859,15 +137000,17 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
-      "requiredness": "required",
-      "null_behavior": "rejected",
+      "requiredness": "optional",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -133918,15 +137061,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_color",
-        "key_path": "oid4vci.credential_configurations.*.display.background_color",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
+        "key_path": "oid4vci.credential_configurations.*.display.logo.alt_text",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134008,8 +137154,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_image",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
+        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.alt_text",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134021,13 +137167,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -134082,8 +137228,8 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -134091,8 +137237,88 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/description",
-        "key_path": "oid4vci.credential_configurations.*.display.description",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
+        "key_path": "oid4vci.display[].logo.alt_text",
+        "path_kind": "property"
+      },
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_oid4vci_internal",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "null",
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "optional",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+      },
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
+        {
+          "keyword": "type",
+          "value": [
+            "string",
+            "null"
+          ]
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
+        "key_path": "oid4vci.credential_configurations.*.display.background_image.uri",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134174,8 +137400,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/locale",
-        "key_path": "oid4vci.credential_configurations.*.display.locale",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
+        "key_path": "oid4vci.credential_configurations.*.display.logo.uri",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134257,8 +137483,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/logo",
-        "key_path": "oid4vci.credential_configurations.*.display.logo",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
+        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.uri",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134270,13 +137496,13 @@
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
@@ -134331,8 +137557,8 @@
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -134340,32 +137566,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/secondary_image",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
+        "key_path": "oid4vci.display[].logo.uri",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
           "null",
-          "object"
+          "string"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "conditional",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "reviewed_runtime_default",
         "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -134400,22 +137626,19 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
           "value": [
-            "null",
-            "object"
+            "string",
+            "null"
           ]
         }
       ]
@@ -134423,8 +137646,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/text_color",
-        "key_path": "oid4vci.credential_configurations.*.display.text_color",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
+        "key_path": "oid4vci.credential_configurations.*.display.background_image.url",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134506,8 +137729,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image.alt_text",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
+        "key_path": "oid4vci.credential_configurations.*.display.logo.url",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134589,8 +137812,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.credential_configurations.*.display.logo.alt_text",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
+        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.url",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134672,8 +137895,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.alt_text",
+        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
+        "key_path": "oid4vci.display[].logo.url",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -134755,29 +137978,28 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text",
-        "key_path": "oid4vci.display[].logo.alt_text",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/allow_insecure_localhost",
+        "key_path": "oid4vci.pre_authorized_code.esignet.allow_insecure_localhost",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Allow `http` loopback URLs for the eSignet endpoints and JWKS transport.\nFor local development and tests only.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "boolean"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -134825,39 +138047,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image.uri",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/authorize_url",
+        "key_path": "oid4vci.pre_authorized_code.esignet.authorize_url",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "eSignet authorize endpoint.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -134908,39 +138126,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.credential_configurations.*.display.logo.uri",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_id",
+        "key_path": "oid4vci.pre_authorized_code.esignet.client_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "Confidential client id the Notary presents to eSignet.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -134991,39 +138205,35 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.uri",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_signing_key_id",
+        "key_path": "oid4vci.pre_authorized_code.esignet.client_signing_key_id",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "`evidence.signing_keys` entry used to sign the eSignet\n`private_key_jwt` client assertion.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "narrows_reviewed_authority",
       "sensitivity": "sensitive",
@@ -135074,42 +138284,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri",
-        "key_path": "oid4vci.display[].logo.uri",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/issuer",
+        "key_path": "oid4vci.pre_authorized_code.esignet.issuer",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "purpose": "eSignet OIDC issuer, pinned when validating the returned `id_token`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -135144,52 +138350,51 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.credential_configurations.*.display.background_image.url",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/jwks_uri",
+        "key_path": "oid4vci.pre_authorized_code.esignet.jwks_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "purpose": "eSignet JWKS URI, used to resolve the `id_token` signing key by `kid`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -135224,55 +138429,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.credential_configurations.*.display.logo.url",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/login_state_ttl_seconds",
+        "key_path": "oid4vci.pre_authorized_code.esignet.login_state_ttl_seconds",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "purpose": "Lifetime of the short-lived login state (PKCE verifier + nonce +\nselection) reserved between `offer/start` and `offer/callback`.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -135307,55 +138505,56 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.credential_configurations.*.display.secondary_image.url",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/redirect_uri",
+        "key_path": "oid4vci.pre_authorized_code.esignet.redirect_uri",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "purpose": "Notary callback the citizen browser is redirected back to.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -135390,55 +138589,48 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url",
-        "key_path": "oid4vci.display[].logo.url",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes",
+        "key_path": "oid4vci.pre_authorized_code.esignet.scopes",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "purpose": "OAuth scopes requested at eSignet.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -135473,51 +138665,44 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/allow_insecure_localhost",
-        "key_path": "oid4vci.pre_authorized_code.esignet.allow_insecure_localhost",
-        "path_kind": "property"
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes/items",
+        "key_path": "oid4vci.pre_authorized_code.esignet.scopes[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Allow `http` loopback URLs for the eSignet endpoints and JWKS transport.\nFor local development and tests only.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -135565,19 +138750,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/authorize_url",
-        "key_path": "oid4vci.pre_authorized_code.esignet.authorize_url",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/token_url",
+        "key_path": "oid4vci.pre_authorized_code.esignet.token_url",
         "path_kind": "property"
       },
-      "purpose": "eSignet authorize endpoint.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
@@ -135651,11 +138836,11 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_id",
-        "key_path": "oid4vci.pre_authorized_code.esignet.client_id",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/userinfo_url",
+        "key_path": "oid4vci.pre_authorized_code.esignet.userinfo_url",
         "path_kind": "property"
       },
-      "purpose": "Confidential client id the Notary presents to eSignet.",
+      "purpose": "eSignet userinfo endpoint. Required when the subject-binding claim is\nsourced from userinfo rather than the `id_token`; the callback fetches\nthe userinfo JWS with the eSignet access token and reads the binding\nclaim from it.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_oid4vci_sensitive",
       "semantic_owner": "notary_runtime",
@@ -135730,31 +138915,32 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_signing_key_id",
-        "key_path": "oid4vci.pre_authorized_code.esignet.client_signing_key_id",
+        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/locale",
+        "key_path": "oid4vci.display[].locale",
         "path_kind": "property"
       },
-      "purpose": "`evidence.signing_keys` entry used to sign the eSignet\n`private_key_jwt` client assertion.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
+          "null",
           "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
+      "null_behavior": "conditional",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -135789,51 +138975,52 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/issuer",
-        "key_path": "oid4vci.pre_authorized_code.esignet.issuer",
+        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/logo",
+        "key_path": "oid4vci.display[].logo",
         "path_kind": "property"
       },
-      "purpose": "eSignet OIDC issuer, pinned when validating the returned `id_token`.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "null",
+          "object"
         ],
-        "composed": false
+        "composed": true
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "null_behavior": "conditional",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -135868,32 +139055,32 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": [
+            "null",
+            "object"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/jwks_uri",
-        "key_path": "oid4vci.pre_authorized_code.esignet.jwks_uri",
+        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/name",
+        "key_path": "oid4vci.display[].name",
         "path_kind": "property"
       },
-      "purpose": "eSignet JWKS URI, used to resolve the `id_token` signing key by `kid`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
@@ -135904,12 +139091,11 @@
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -135964,19 +139150,19 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/login_state_ttl_seconds",
-        "key_path": "oid4vci.pre_authorized_code.esignet.login_state_ttl_seconds",
+        "pointer": "/$defs/Oid4vciNonceConfig/properties/enabled",
+        "key_path": "oid4vci.nonce.enabled",
         "path_kind": "property"
       },
-      "purpose": "Lifetime of the short-lived login state (PKCE verifier + nonce +\nselection) reserved between `offer/start` and `offer/callback`.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -136031,42 +139217,34 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/redirect_uri",
-        "key_path": "oid4vci.pre_authorized_code.esignet.redirect_uri",
+        "pointer": "/$defs/Oid4vciNonceConfig/properties/ttl_seconds",
+        "key_path": "oid4vci.nonce.ttl_seconds",
         "path_kind": "property"
       },
-      "purpose": "Notary callback the citizen browser is redirected back to.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -136115,28 +139293,36 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes",
-        "key_path": "oid4vci.pre_authorized_code.esignet.scopes",
+        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/enabled",
+        "key_path": "oid4vci.pre_authorized_code.enabled",
         "path_kind": "property"
       },
-      "purpose": "OAuth scopes requested at eSignet.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -136193,113 +139379,39 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
-        }
-      ]
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes/items",
-        "key_path": "oid4vci.pre_authorized_code.esignet.scopes[]",
-        "path_kind": "array_item"
-      },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "not_applicable",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "not_applicable"
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/token_url",
-        "key_path": "oid4vci.pre_authorized_code.esignet.token_url",
+        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/esignet",
+        "key_path": "oid4vci.pre_authorized_code.esignet",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/Oid4vciEsignetRpConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -136334,51 +139446,52 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciEsignetRpConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/userinfo_url",
-        "key_path": "oid4vci.pre_authorized_code.esignet.userinfo_url",
+        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/pre_authorized_code_ttl_seconds",
+        "key_path": "oid4vci.pre_authorized_code.pre_authorized_code_ttl_seconds",
         "path_kind": "property"
       },
-      "purpose": "eSignet userinfo endpoint. Required when the subject-binding claim is\nsourced from userinfo rather than the `id_token`; the callback fetches\nthe userinfo JWS with the eSignet access token and reads the binding\nclaim from it.",
+      "purpose": "Pre-authorized-code lifetime in seconds.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_sensitive",
+      "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -136413,49 +139526,54 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/locale",
-        "key_path": "oid4vci.display[].locale",
+        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/tx_code",
+        "key_path": "oid4vci.pre_authorized_code.tx_code",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "`tx_code` (PIN) policy for the pre-authorized-code grant. A `tx_code` is\nrequired by default because a code without a PIN is a bearer credential.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_oid4vci_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/Oid4vciTxCodeConfig",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -136503,18 +139621,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/Oid4vciTxCodeConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/logo",
-        "key_path": "oid4vci.display[].logo",
+        "pointer": "/$defs/Oid4vciProofConfig/properties/max_age_seconds",
+        "key_path": "oid4vci.proof.max_age_seconds",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -136525,17 +139644,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "object"
+          "integer"
         ],
-        "composed": true
+        "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -136581,20 +139699,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "null",
-            "object"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/name",
-        "key_path": "oid4vci.display[].name",
+        "pointer": "/$defs/Oid4vciProofConfig/properties/max_clock_skew_seconds",
+        "key_path": "oid4vci.proof.max_clock_skew_seconds",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -136605,15 +139728,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -136659,17 +139783,25 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciNonceConfig/properties/enabled",
-        "key_path": "oid4vci.nonce.enabled",
+        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/input_mode",
+        "key_path": "oid4vci.pre_authorized_code.tx_code.input_mode",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -136680,13 +139812,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -136737,15 +139869,15 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciNonceConfig/properties/ttl_seconds",
-        "key_path": "oid4vci.nonce.ttl_seconds",
+        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/length",
+        "key_path": "oid4vci.pre_authorized_code.tx_code.length",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -136828,8 +139960,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/enabled",
-        "key_path": "oid4vci.pre_authorized_code.enabled",
+        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/required",
+        "key_path": "oid4vci.pre_authorized_code.tx_code.required",
         "path_kind": "property"
       },
       "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
@@ -136904,106 +140036,26 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/esignet",
-        "key_path": "oid4vci.pre_authorized_code.esignet",
+        "pointer": "/$defs/OotsConfig/properties/authentication_level_of_assurance",
+        "key_path": "evidence.claims[].oots.authentication_level_of_assurance",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "object"
-        ],
-        "local_reference": "#/$defs/Oid4vciEsignetRpConfig",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
-      "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
-        {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciEsignetRpConfig"
-      }
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/pre_authorized_code_ttl_seconds",
-        "key_path": "oid4vci.pre_authorized_code.pre_authorized_code_ttl_seconds",
-        "path_kind": "property"
-      },
-      "purpose": "Pre-authorized-code lifetime in seconds.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -137052,38 +140104,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/tx_code",
-        "key_path": "oid4vci.pre_authorized_code.tx_code",
+        "pointer": "/$defs/OotsConfig/properties/enabled",
+        "key_path": "evidence.claims[].oots.enabled",
         "path_kind": "property"
       },
-      "purpose": "`tx_code` (PIN) policy for the pre-authorized-code grant. A `tx_code` is\nrequired by default because a code without a PIN is a bearer credential.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_oid4vci_internal",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
-        "local_reference": "#/$defs/Oid4vciTxCodeConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -137139,36 +140185,33 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciProofConfig/properties/max_age_seconds",
-        "key_path": "oid4vci.proof.max_age_seconds",
+        "pointer": "/$defs/OotsConfig/properties/evidence_type_classification",
+        "key_path": "evidence.claims[].oots.evidence_type_classification",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -137217,42 +140260,38 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciProofConfig/properties/max_clock_skew_seconds",
-        "key_path": "oid4vci.proof.max_clock_skew_seconds",
+        "pointer": "/$defs/OotsConfig/properties/evidence_type_list",
+        "key_path": "evidence.claims[].oots.evidence_type_list",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -137301,42 +140340,37 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/input_mode",
-        "key_path": "oid4vci.pre_authorized_code.tx_code.input_mode",
+        "pointer": "/$defs/OotsConfig/properties/languages",
+        "key_path": "evidence.claims[].oots.languages",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "array"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -137387,35 +140421,34 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/length",
-        "key_path": "oid4vci.pre_authorized_code.tx_code.length",
-        "path_kind": "property"
+        "pointer": "/$defs/OotsConfig/properties/languages/items",
+        "key_path": "evidence.claims[].oots.languages[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -137461,42 +140494,35 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/Oid4vciTxCodeConfig/properties/required",
-        "key_path": "oid4vci.pre_authorized_code.tx_code.required",
+        "pointer": "/$defs/OotsConfig/properties/reference_framework",
+        "key_path": "evidence.claims[].oots.reference_framework",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_oid4vci_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "null",
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "null_behavior": "conditional",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -137547,15 +140573,18 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": [
+            "string",
+            "null"
+          ]
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/authentication_level_of_assurance",
-        "key_path": "evidence.claims[].oots.authentication_level_of_assurance",
+        "pointer": "/$defs/OotsConfig/properties/requirement",
+        "key_path": "evidence.claims[].oots.requirement",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -137634,8 +140663,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/enabled",
-        "key_path": "evidence.claims[].oots.enabled",
+        "pointer": "/$defs/OperationConfig/properties/enabled",
+        "key_path": "evidence.claims[].operations.evaluate.enabled",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -137710,25 +140739,25 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/evidence_type_classification",
-        "key_path": "evidence.claims[].oots.evidence_type_classification",
+        "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/bind",
+        "key_path": "server.admin_listener.bind",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/SocketAddr",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
+      "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
@@ -137780,39 +140809,40 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/SocketAddr"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/evidence_type_list",
-        "key_path": "evidence.claims[].oots.evidence_type_list",
+        "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/mode",
+        "key_path": "server.admin_listener.mode",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
           "string"
         ],
+        "local_reference": "#/$defs/RegistryNotaryAdminListenerMode",
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -137859,30 +140889,39 @@
       ],
       "constraints": [
         {
-          "keyword": "type",
+          "keyword": "enum",
           "value": [
-            "string",
-            "null"
+            "shared_with_public",
+            "dedicated",
+            "disabled"
           ]
+        },
+        {
+          "keyword": "type",
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RegistryNotaryAdminListenerMode"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/languages",
-        "key_path": "evidence.claims[].oots.languages",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/allow_regex",
+        "key_path": "cel.allow_regex",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_cel_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "boolean"
         ],
         "composed": false
       },
@@ -137933,40 +140972,40 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "array"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/languages/items",
-        "key_path": "evidence.claims[].oots.languages[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/eval_timeout_ms",
+        "key_path": "cel.eval_timeout_ms",
+        "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_cel_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -138008,39 +141047,45 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint64"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/reference_framework",
-        "key_path": "evidence.claims[].oots.reference_framework",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_binding_json_bytes",
+        "key_path": "cel.max_binding_json_bytes",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_cel_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -138085,42 +141130,45 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OotsConfig/properties/requirement",
-        "key_path": "evidence.claims[].oots.requirement",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_expression_bytes",
+        "key_path": "cel.max_expression_bytes",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_cel_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "null",
-          "string"
+          "integer"
         ],
         "composed": false
       },
       "requiredness": "optional",
-      "null_behavior": "conditional",
-      "empty_behavior": "allowed",
+      "null_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -138165,35 +141213,39 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": [
-            "string",
-            "null"
-          ]
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/OperationConfig/properties/enabled",
-        "key_path": "evidence.claims[].operations.evaluate.enabled",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_list_items",
+        "key_path": "cel.max_list_items",
         "path_kind": "property"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_cel_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
@@ -138244,39 +141296,45 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/bind",
-        "key_path": "server.admin_listener.bind",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_depth",
+        "key_path": "cel.max_object_depth",
         "path_kind": "property"
       },
-      "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
+      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_cel_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "integer"
         ],
-        "local_reference": "#/$defs/SocketAddr",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -138321,114 +141379,28 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "generated_docs_never_load_country_values"
       ],
       "constraints": [
         {
-          "keyword": "type",
-          "value": "string"
-        }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/SocketAddr"
-      }
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/mode",
-        "key_path": "server.admin_listener.mode",
-        "path_kind": "property"
-      },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "local_reference": "#/$defs/RegistryNotaryAdminListenerMode",
-        "composed": false
-      },
-      "requiredness": "optional",
-      "null_behavior": "rejected",
-      "empty_behavior": "rejected",
-      "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
-      },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
+          "keyword": "format",
+          "value": "uint"
+        },
         {
-          "keyword": "enum",
-          "value": [
-            "shared_with_public",
-            "dedicated",
-            "disabled"
-          ]
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerMode"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/allow_regex",
-        "key_path": "cel.allow_regex",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_keys",
+        "key_path": "cel.max_object_keys",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -138439,7 +141411,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "integer"
         ],
         "composed": false
       },
@@ -138493,17 +141465,25 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/eval_timeout_ms",
-        "key_path": "cel.eval_timeout_ms",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_result_json_bytes",
+        "key_path": "cel.max_result_json_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -138570,7 +141550,7 @@
       "constraints": [
         {
           "keyword": "format",
-          "value": "uint64"
+          "value": "uint"
         },
         {
           "keyword": "minimum",
@@ -138585,8 +141565,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_binding_json_bytes",
-        "key_path": "cel.max_binding_json_bytes",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_string_bytes",
+        "key_path": "cel.max_string_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -138668,8 +141648,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_expression_bytes",
-        "key_path": "cel.max_expression_bytes",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/mode",
+        "key_path": "cel.mode",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -138680,13 +141660,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -138734,25 +141714,17 @@
         "generated_docs_never_load_country_values"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_list_items",
-        "key_path": "cel.max_list_items",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_count",
+        "key_path": "cel.worker_count",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -138834,8 +141806,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_depth",
-        "key_path": "cel.max_object_depth",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_memory_bytes",
+        "key_path": "cel.worker_memory_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -138902,7 +141874,7 @@
       "constraints": [
         {
           "keyword": "format",
-          "value": "uint"
+          "value": "uint64"
         },
         {
           "keyword": "minimum",
@@ -138917,8 +141889,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_keys",
-        "key_path": "cel.max_object_keys",
+        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_stderr_bytes",
+        "key_path": "cel.worker_stderr_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
@@ -139000,19 +141972,19 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_result_json_bytes",
-        "key_path": "cel.max_result_json_bytes",
+        "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins",
+        "key_path": "server.cors.allowed_origins",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
+      "intent_profile": "notary_server_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "array"
         ],
         "composed": false
       },
@@ -139023,8 +141995,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -139059,55 +142031,50 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_string_bytes",
-        "key_path": "cel.max_string_bytes",
-        "path_kind": "property"
+        "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins/items",
+        "key_path": "server.cors.allowed_origins[]",
+        "path_kind": "array_item"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
+      "intent_profile": "notary_server_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -139142,52 +142109,49 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/mode",
-        "key_path": "cel.mode",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/admin_listener",
+        "key_path": "server.admin_listener",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RegistryNotaryAdminListenerConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -139229,37 +142193,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RegistryNotaryAdminListenerConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_count",
-        "key_path": "cel.worker_count",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/bind",
+        "key_path": "server.bind",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
+      "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/SocketAddr",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -139304,40 +142274,38 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/SocketAddr"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_memory_bytes",
-        "key_path": "cel.worker_memory_bytes",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/cors",
+        "key_path": "server.cors",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
+      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/RegistryNotaryCorsConfig",
         "composed": false
       },
       "requiredness": "optional",
@@ -139387,45 +142355,43 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint64"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RegistryNotaryCorsConfig"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_stderr_bytes",
-        "key_path": "cel.worker_stderr_bytes",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/http1_header_read_timeout",
+        "key_path": "server.http1_header_read_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_cel_internal",
+      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "string"
         ],
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
@@ -139470,39 +142436,36 @@
       ],
       "semantic_rules": [
         "knowledge_only",
-        "generated_docs_never_load_country_values"
+        "generated_docs_never_load_country_values",
+        "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/HumantimeDuration"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins",
-        "key_path": "server.cors.allowed_origins",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/max_connections",
+        "key_path": "server.max_connections",
         "path_kind": "property"
       },
       "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_sensitive",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -139513,8 +142476,8 @@
         "behavior": "schema_default",
         "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -139549,50 +142512,56 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins/items",
-        "key_path": "server.cors.allowed_origins[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/openapi_requires_auth",
+        "key_path": "server.openapi_requires_auth",
+        "path_kind": "property"
       },
       "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_sensitive",
+      "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -139627,49 +142596,46 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/admin_listener",
-        "key_path": "server.admin_listener",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_body_timeout",
+        "key_path": "server.request_body_timeout",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
-      "purpose_source": "reviewed_profile",
+      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
+      "purpose_source": "schema_description",
       "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "string"
         ],
-        "local_reference": "#/$defs/RegistryNotaryAdminListenerConfig",
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "allowed",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -139717,22 +142683,22 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "string"
         }
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryAdminListenerConfig"
+        "pointer": "/$defs/HumantimeDuration"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/bind",
-        "key_path": "server.bind",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_timeout",
+        "key_path": "server.request_timeout",
         "path_kind": "property"
       },
-      "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.",
+      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
@@ -139742,7 +142708,7 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/SocketAddr",
+        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
       "requiredness": "optional",
@@ -139803,14 +142769,14 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/SocketAddr"
+        "pointer": "/$defs/HumantimeDuration"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/cors",
-        "key_path": "server.cors",
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips",
+        "key_path": "server.trusted_proxy_ips",
         "path_kind": "property"
       },
       "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
@@ -139821,17 +142787,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "array"
         ],
-        "local_reference": "#/$defs/RegistryNotaryCorsConfig",
         "composed": false
       },
       "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "reviewed_runtime_default",
+        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -139879,23 +142844,19 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "array"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryCorsConfig"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/http1_header_read_timeout",
-        "key_path": "server.http1_header_read_timeout",
-        "path_kind": "property"
+        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips/items",
+        "key_path": "server.trusted_proxy_ips[]",
+        "path_kind": "array_item"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_server_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
@@ -139904,15 +142865,13 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -139958,32 +142917,32 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "ip"
+        },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/max_connections",
-        "key_path": "server.max_connections",
+        "pointer": "/$defs/RelayConnectionConfig/properties/allow_insecure_localhost",
+        "key_path": "evidence.relay.allow_insecure_localhost",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -140038,36 +142997,28 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/openapi_requires_auth",
-        "key_path": "server.openapi_requires_auth",
+        "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs",
+        "key_path": "evidence.relay.allowed_private_cidrs",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "array"
         ],
         "composed": false
       },
@@ -140075,8 +143026,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -140124,20 +143075,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "array"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_body_timeout",
-        "key_path": "server.request_body_timeout",
-        "path_kind": "property"
+        "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs/items",
+        "key_path": "evidence.relay.allowed_private_cidrs[]",
+        "path_kind": "array_item"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
+      "purpose": "An IP network CIDR string. The runtime parser remains authoritative for address and prefix validity.",
       "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -140145,15 +143096,14 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
+        "local_reference": "#/$defs/IpNet",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -140206,19 +143156,19 @@
       ],
       "local_reference": {
         "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
+        "pointer": "/$defs/IpNet"
       }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_timeout",
-        "key_path": "server.request_timeout",
+        "pointer": "/$defs/RelayConnectionConfig/properties/base_url",
+        "key_path": "evidence.relay.base_url",
         "path_kind": "property"
       },
-      "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_server_internal",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -140226,18 +143176,16 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/HumantimeDuration",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -140272,11 +143220,14 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -140284,28 +143235,24 @@
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/HumantimeDuration"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips",
-        "key_path": "server.trusted_proxy_ips",
+        "pointer": "/$defs/RelayConnectionConfig/properties/max_in_flight",
+        "key_path": "evidence.relay.max_in_flight",
         "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "integer"
         ],
         "composed": false
       },
@@ -140313,8 +143260,8 @@
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "reviewed_runtime_default",
-        "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract."
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -140360,22 +143307,30 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "uint"
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips/items",
-        "key_path": "server.trusted_proxy_ips[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/RelayConnectionConfig/properties/token_file",
+        "key_path": "evidence.relay.token_file",
+        "path_kind": "property"
       },
-      "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_server_internal",
+      "intent_profile": "notary_evidence_secret_reference",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -140385,14 +143340,14 @@
         ],
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "allowed",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
-      "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "secret_reference",
       "state": "runtime",
       "products": [
         "notary",
@@ -140427,18 +143382,94 @@
       "review_classes": [
         "contract",
         "notary",
+        "security",
+        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "secret_never_reportable"
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "ip"
-        },
+          "keyword": "type",
+          "value": "string"
+        }
+      ]
+    },
+    {
+      "address": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayConnectionConfig/properties/workload_client_id",
+        "key_path": "evidence.relay.workload_client_id",
+        "path_kind": "property"
+      },
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_sensitive",
+      "semantic_owner": "notary_runtime",
+      "human_owner": "notary_maintainers",
+      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
+      "field_type": {
+        "schema_types": [
+          "string"
+        ],
+        "composed": false
+      },
+      "requiredness": "required",
+      "null_behavior": "rejected",
+      "empty_behavior": "allowed",
+      "default": {
+        "behavior": "no_schema_default"
+      },
+      "environment_behavior": "narrows_reviewed_authority",
+      "sensitivity": "sensitive",
+      "state": "runtime",
+      "products": [
+        "notary",
+        "docs"
+      ],
+      "availability": "published",
+      "stability": "experimental",
+      "validation_stages": [
+        "json_schema",
+        "rust_deserialization",
+        "operator_preflight"
+      ],
+      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
+      "history_status": "not_verified",
+      "introduced_in": null,
+      "version_history": [],
+      "example": {
+        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
+        "schema_examples_available": false,
+        "contains_country_values": false
+      },
+      "migration": "coordinate_deployment",
+      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
+      "consumers": [
+        "registry_notary",
+        "docs_generator"
+      ],
+      "generated_artifacts": [
+        "notary_config",
+        "field_reference"
+      ],
+      "review_classes": [
+        "contract",
+        "notary",
+        "security",
+        "privacy",
+        "documentation"
+      ],
+      "semantic_rules": [
+        "knowledge_only",
+        "generated_docs_never_load_country_values",
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
+      ],
+      "constraints": [
         {
           "keyword": "type",
           "value": "string"
@@ -140448,8 +143479,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allow_insecure_localhost",
-        "key_path": "evidence.relay.allow_insecure_localhost",
+        "pointer": "/$defs/RelayConsultationConfig/properties/inputs",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -140460,16 +143491,15 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -140517,38 +143547,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs",
-        "key_path": "evidence.relay.allowed_private_cidrs",
-        "path_kind": "property"
+        "pointer": "/$defs/RelayConsultationConfig/properties/inputs/additionalProperties",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "purpose": "A supported consultation input path. The runtime parser remains authoritative for exact stable-name bounds.",
+      "purpose_source": "schema_description",
+      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_inputs_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "array"
+          "string"
         ],
+        "local_reference": "#/$defs/RelayConsultationInput",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "not_applicable",
+      "empty_behavior": "rejected",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "notary",
@@ -140588,23 +143618,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "minLength",
+          "value": 1
+        },
         {
           "keyword": "type",
-          "value": "array"
+          "value": "string"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayConsultationInput"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs/items",
-        "key_path": "evidence.relay.allowed_private_cidrs[]",
-        "path_kind": "array_item"
+        "pointer": "/$defs/RelayConsultationConfig/properties/outputs",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs",
+        "path_kind": "property"
       },
-      "purpose": "An IP network CIDR string. The runtime parser remains authoritative for address and prefix validity.",
+      "purpose": "Complete closed public output schema expected from the pinned profile.",
       "purpose_source": "schema_description",
       "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
@@ -140612,16 +143650,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
-        "local_reference": "#/$defs/IpNet",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "optional",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -140669,41 +143707,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/IpNet"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/base_url",
-        "key_path": "evidence.relay.base_url",
-        "path_kind": "property"
+        "pointer": "/$defs/RelayConsultationConfig/properties/outputs/additionalProperties",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Each reviewed key names a consultation output and each value defines its bounded evidence-result interpretation.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_outputs_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RelayOutputContract",
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "not_applicable"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "notary",
@@ -140738,28 +143773,57 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            [
+              "type",
+              "max_bytes",
+              "fields"
+            ],
+            [
+              "type",
+              "max_bytes",
+              "max_items",
+              "items"
+            ],
+            [
+              "type",
+              "max_bytes"
+            ],
+            [
+              "type",
+              "minimum",
+              "maximum"
+            ],
+            [
+              "type"
+            ]
+          ]
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayOutputContract"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/max_in_flight",
-        "key_path": "evidence.relay.max_in_flight",
+        "pointer": "/$defs/RelayConsultationConfig/properties/profile",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -140770,16 +143834,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/RelayConsultationProfileRef",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -140826,29 +143890,32 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            "id",
+            "contract_hash"
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayConsultationProfileRef"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/token_file",
-        "key_path": "evidence.relay.token_file",
+        "pointer": "/$defs/RelayConsultationProfileRef/properties/contract_hash",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.contract_hash",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_secret_reference",
+      "intent_profile": "notary_evidence_sensitive",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -140865,7 +143932,7 @@
         "behavior": "no_schema_default"
       },
       "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "secret_reference",
+      "sensitivity": "sensitive",
       "state": "runtime",
       "products": [
         "notary",
@@ -140907,7 +143974,8 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "secret_never_reportable"
+        "sensitive_operational_metadata",
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
@@ -140919,13 +143987,13 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConnectionConfig/properties/workload_client_id",
-        "key_path": "evidence.relay.workload_client_id",
+        "pointer": "/$defs/RelayConsultationProfileRef/properties/id",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.id",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -140941,8 +144009,8 @@
       "default": {
         "behavior": "no_schema_default"
       },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
+      "environment_behavior": "bound_by_environment",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -140977,14 +144045,11 @@
       "review_classes": [
         "contract",
         "notary",
-        "security",
-        "privacy",
         "documentation"
       ],
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
         "array_items_share_element_contract"
       ],
       "constraints": [
@@ -140997,8 +144062,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/inputs",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs",
+        "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/nullable",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.nullable",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141009,15 +144074,16 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "boolean"
         ],
         "composed": false
       },
-      "requiredness": "required",
+      "requiredness": "optional",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "no_schema_default"
+        "behavior": "schema_default",
+        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -141065,20 +144131,20 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "object"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/inputs/additionalProperties",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/type",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.type",
+        "path_kind": "property"
       },
-      "purpose": "A supported consultation input path. The runtime parser remains authoritative for exact stable-name bounds.",
-      "purpose_source": "schema_description",
-      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_inputs_open_map",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
@@ -141086,17 +144152,16 @@
         "schema_types": [
           "string"
         ],
-        "local_reference": "#/$defs/RelayConsultationInput",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "rejected",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -141136,48 +144201,50 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "minLength",
-          "value": 1
+          "keyword": "const",
+          "value": [
+            "array",
+            "boolean",
+            "date",
+            "integer",
+            "object",
+            "string"
+          ]
         },
         {
           "keyword": "type",
           "value": "string"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationInput"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/outputs",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs",
+        "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/maximum",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.maximum",
         "path_kind": "property"
       },
-      "purpose": "Complete closed public output schema expected from the pinned profile.",
-      "purpose_source": "schema_description",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose_source": "reviewed_profile",
       "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
       "sensitivity": "internal",
@@ -141223,40 +144290,43 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
+        {
+          "keyword": "format",
+          "value": "int64"
+        },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/outputs/additionalProperties",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*",
-        "path_kind": "map_value"
+        "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/minimum",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.minimum",
+        "path_kind": "property"
       },
-      "purpose": "Each reviewed key names a consultation output and each value defines its bounded evidence-result interpretation.",
+      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_outputs_open_map",
+      "intent_profile": "notary_evidence_internal",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/RelayOutputContract",
         "composed": false
       },
-      "requiredness": "not_applicable",
+      "requiredness": "required",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "not_applicable"
+        "behavior": "no_schema_default"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "structural",
+      "sensitivity": "internal",
       "state": "runtime",
       "products": [
         "notary",
@@ -141296,41 +144366,24 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "arbitrary_map_keys_not_fixed_properties"
+        "array_items_share_element_contract"
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            [
-              "type",
-              "max_bytes"
-            ],
-            [
-              "type",
-              "minimum",
-              "maximum"
-            ],
-            [
-              "type"
-            ]
-          ]
+          "keyword": "format",
+          "value": "int64"
         },
         {
           "keyword": "type",
-          "value": "object"
+          "value": "integer"
         }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract"
-      }
+      ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConsultationConfig/properties/profile",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile",
+        "pointer": "/$defs/RelayOutputContract/oneOf/2/properties/max_bytes",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_bytes",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141341,9 +144394,8 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "object"
+          "integer"
         ],
-        "local_reference": "#/$defs/RelayConsultationProfileRef",
         "composed": false
       },
       "requiredness": "required",
@@ -141397,105 +144449,24 @@
       ],
       "constraints": [
         {
-          "keyword": "required",
-          "value": [
-            "id",
-            "contract_hash"
-          ]
+          "keyword": "format",
+          "value": "uint32"
         },
         {
-          "keyword": "type",
-          "value": "object"
-        }
-      ],
-      "local_reference": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationProfileRef"
-      }
-    },
-    {
-      "address": {
-        "schema": "notary",
-        "pointer": "/$defs/RelayConsultationProfileRef/properties/contract_hash",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.contract_hash",
-        "path_kind": "property"
-      },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
-      "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_sensitive",
-      "semantic_owner": "notary_runtime",
-      "human_owner": "notary_maintainers",
-      "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
-      "field_type": {
-        "schema_types": [
-          "string"
-        ],
-        "composed": false
-      },
-      "requiredness": "required",
-      "null_behavior": "rejected",
-      "empty_behavior": "allowed",
-      "default": {
-        "behavior": "no_schema_default"
-      },
-      "environment_behavior": "narrows_reviewed_authority",
-      "sensitivity": "sensitive",
-      "state": "runtime",
-      "products": [
-        "notary",
-        "docs"
-      ],
-      "availability": "published",
-      "stability": "experimental",
-      "validation_stages": [
-        "json_schema",
-        "rust_deserialization",
-        "operator_preflight"
-      ],
-      "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.",
-      "history_status": "not_verified",
-      "introduced_in": null,
-      "version_history": [],
-      "example": {
-        "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.",
-        "schema_examples_available": false,
-        "contains_country_values": false
-      },
-      "migration": "coordinate_deployment",
-      "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.",
-      "consumers": [
-        "registry_notary",
-        "docs_generator"
-      ],
-      "generated_artifacts": [
-        "notary_config",
-        "field_reference"
-      ],
-      "review_classes": [
-        "contract",
-        "notary",
-        "security",
-        "privacy",
-        "documentation"
-      ],
-      "semantic_rules": [
-        "knowledge_only",
-        "generated_docs_never_load_country_values",
-        "sensitive_operational_metadata",
-        "array_items_share_element_contract"
-      ],
-      "constraints": [
+          "keyword": "minimum",
+          "value": 0
+        },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "integer"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayConsultationProfileRef/properties/id",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.id",
+        "pointer": "/$defs/RelayOutputContract/oneOf/4/properties/fields",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141506,13 +144477,13 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "allowed",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -141562,38 +144533,38 @@
       "constraints": [
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/nullable",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.nullable",
-        "path_kind": "property"
+        "pointer": "/$defs/RelayOutputContract/oneOf/4/properties/fields/additionalProperties",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*",
+        "path_kind": "map_value"
       },
-      "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
+      "purpose": "Each reviewed key names a closed structured output field and each value defines its requiredness and bounded recursive schema.",
       "purpose_source": "reviewed_profile",
-      "intent_profile": "notary_evidence_internal",
+      "intent_profile": "notary_evidence_claims_evidence_mode_consultations_output_fields_open_map",
       "semantic_owner": "notary_runtime",
       "human_owner": "notary_maintainers",
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "boolean"
+          "object"
         ],
+        "local_reference": "#/$defs/RelayOutputObjectFieldContract",
         "composed": false
       },
-      "requiredness": "optional",
+      "requiredness": "not_applicable",
       "null_behavior": "rejected",
       "empty_behavior": "not_applicable",
       "default": {
-        "behavior": "schema_default",
-        "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference."
+        "behavior": "not_applicable"
       },
       "environment_behavior": "bound_by_environment",
-      "sensitivity": "internal",
+      "sensitivity": "structural",
       "state": "runtime",
       "products": [
         "notary",
@@ -141633,20 +144604,31 @@
       "semantic_rules": [
         "knowledge_only",
         "generated_docs_never_load_country_values",
-        "array_items_share_element_contract"
+        "arbitrary_map_keys_not_fixed_properties"
       ],
       "constraints": [
+        {
+          "keyword": "required",
+          "value": [
+            "required",
+            "schema"
+          ]
+        },
         {
           "keyword": "type",
-          "value": "boolean"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayOutputObjectFieldContract"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/type",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.type",
+        "pointer": "/$defs/RelayOutputContract/oneOf/5/properties/items",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.items",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141657,13 +144639,14 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "string"
+          "object"
         ],
+        "local_reference": "#/$defs/RelayOutputContract",
         "composed": false
       },
       "requiredness": "required",
       "null_behavior": "rejected",
-      "empty_behavior": "rejected",
+      "empty_behavior": "not_applicable",
       "default": {
         "behavior": "no_schema_default"
       },
@@ -141712,25 +144695,48 @@
       ],
       "constraints": [
         {
-          "keyword": "const",
+          "keyword": "required",
           "value": [
-            "boolean",
-            "date",
-            "integer",
-            "string"
+            [
+              "type",
+              "max_bytes",
+              "fields"
+            ],
+            [
+              "type",
+              "max_bytes",
+              "max_items",
+              "items"
+            ],
+            [
+              "type",
+              "max_bytes"
+            ],
+            [
+              "type",
+              "minimum",
+              "maximum"
+            ],
+            [
+              "type"
+            ]
           ]
         },
         {
           "keyword": "type",
-          "value": "string"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayOutputContract"
+      }
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/maximum",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.maximum",
+        "pointer": "/$defs/RelayOutputContract/oneOf/5/properties/max_items",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_items",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141797,7 +144803,15 @@
       "constraints": [
         {
           "keyword": "format",
-          "value": "int64"
+          "value": "uint16"
+        },
+        {
+          "keyword": "maximum",
+          "value": 65535
+        },
+        {
+          "keyword": "minimum",
+          "value": 0
         },
         {
           "keyword": "type",
@@ -141808,8 +144822,8 @@
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/minimum",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.minimum",
+        "pointer": "/$defs/RelayOutputObjectFieldContract/properties/required",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.required",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141820,7 +144834,7 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "boolean"
         ],
         "composed": false
       },
@@ -141874,21 +144888,17 @@
         "array_items_share_element_contract"
       ],
       "constraints": [
-        {
-          "keyword": "format",
-          "value": "int64"
-        },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "boolean"
         }
       ]
     },
     {
       "address": {
         "schema": "notary",
-        "pointer": "/$defs/RelayOutputContract/oneOf/2/properties/max_bytes",
-        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_bytes",
+        "pointer": "/$defs/RelayOutputObjectFieldContract/properties/schema",
+        "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.schema",
         "path_kind": "property"
       },
       "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.",
@@ -141899,8 +144909,9 @@
       "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.",
       "field_type": {
         "schema_types": [
-          "integer"
+          "object"
         ],
+        "local_reference": "#/$defs/RelayOutputContract",
         "composed": false
       },
       "requiredness": "required",
@@ -141954,18 +144965,42 @@
       ],
       "constraints": [
         {
-          "keyword": "format",
-          "value": "uint32"
-        },
-        {
-          "keyword": "minimum",
-          "value": 0
+          "keyword": "required",
+          "value": [
+            [
+              "type",
+              "max_bytes",
+              "fields"
+            ],
+            [
+              "type",
+              "max_bytes",
+              "max_items",
+              "items"
+            ],
+            [
+              "type",
+              "max_bytes"
+            ],
+            [
+              "type",
+              "minimum",
+              "maximum"
+            ],
+            [
+              "type"
+            ]
+          ]
         },
         {
           "keyword": "type",
-          "value": "integer"
+          "value": "object"
         }
-      ]
+      ],
+      "local_reference": {
+        "schema": "notary",
+        "pointer": "/$defs/RelayOutputContract"
+      }
     },
     {
       "address": {
diff --git a/products/notary/CHANGELOG.md b/products/notary/CHANGELOG.md
index f83ae4a053..0350816280 100644
--- a/products/notary/CHANGELOG.md
+++ b/products/notary/CHANGELOG.md
@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Registry-backed direct Relay claims can now carry bounded closed object and
+  array values through evaluation storage, OID4VCI Type Metadata, SD-JWT
+  issuance, and verification. Top-level structured claims remain one selective
+  disclosure; nested disclosure is not supported.
+- Authenticated registry clients can create a short-lived pre-authorized
+  OID4VCI offer from a fresh caller-owned stored evaluation through
+  `POST /oid4vci/offers`. Exact retries return one stored response, the
+  required transaction-code value remains outside the offer URI, and the
+  wallet ceremony remains bound to one immutable transaction.
+- This release advances the PostgreSQL state-plane catalog. Stop all Notary
+  writers, take a verified backup, then run the target release's `state
+  install` and `state doctor` commands before admitting traffic. The installer
+  upgrades only the immediately preceding attested v1 catalog; older or
+  drifted schemas require a sequential upgrade, a matching backup and binary,
+  or a fresh installation.
+
 ## [0.15.2] - 2026-07-28
 
 - No user-visible Registry Notary changes. This release fixes forward from the
diff --git a/products/notary/docs/identity-and-record-matching.md b/products/notary/docs/identity-and-record-matching.md
index f638eead26..65626d5404 100644
--- a/products/notary/docs/identity-and-record-matching.md
+++ b/products/notary/docs/identity-and-record-matching.md
@@ -36,6 +36,67 @@ declared output. A CEL claim may combine the consultation's outcome and
 allowed outputs with request-bound variables. CEL cannot acquire source data,
 change the consultation, or inspect raw Relay errors.
 
+## Structured direct outputs
+
+A direct output claim may preserve one schema-declared object or array value.
+The Relay public contract and the matching Notary consultation expectation use
+the same recursive tagged shape. Objects declare every field as
+`{ required, schema }`; arrays declare one `items` schema and `max_items`.
+Each object and array also declares `max_bytes`, the maximum canonical
+serialized size of that value.
+
+The recursive contract is closed and bounded:
+
+- No more than 32 top-level outputs or fields in one object
+- No more than 256 items in one array
+- No more than 8 schema levels, 256 schema nodes, or 4,096 expanded nodes
+- No more than 128 UTF-8 bytes in one output or field name
+- No more than 65,536 canonical serialized bytes in one structured value
+
+Unknown object keys, missing required fields, wrong nested types, excessive
+arrays, and values over a serialized-size bound fail without becoming claim
+values. CEL claim rules remain scalar-only. Use a direct output rule when the
+credential must preserve a structured Relay output.
+
+For example, the synthetic OpenCRVS fixture releases this minimized value:
+
+```json
+{
+  "parents": [
+    {
+      "type": "mother",
+      "name": "Mira Example",
+      "identifier": "PARENT-0001"
+    },
+    {
+      "type": "father",
+      "name": "Noah Example",
+      "identifier": "PARENT-0002"
+    }
+  ]
+}
+```
+
+The source fixture also contains a source-only parent reference. The reviewed
+adapter constructs each output object field by field, so that reference is not
+released.
+
+Registry Notary stores the exact validated result and binds its canonical
+content into issuance provenance. Issuance reloads and revalidates that stored
+value against the active compiler-pinned contract. A request cannot provide or
+replace an object field or array item.
+
+In a Selective Disclosure JSON Web Token (SD-JWT) credential, `parents` is one
+top-level disclosure. A holder can disclose or withhold the complete array.
+Nested fields and individual array items are not independently disclosable.
+Type Metadata publishes `registry_notary_value_schema` for a direct Relay
+output so wallets and verifiers can understand the closed value shape without
+implying nested disclosure.
+
+Diagnostics, logs, metrics, and audit events may record bounded claim names,
+outcome classes, and commitments. They must not record the structured value,
+source record, civil identifier, or disclosure content.
+
 For delegated requests, relationship authorization remains Notary policy. A
 configured Relay proof consultation can prove exactly the delegated edge it
 was compiled for, but it does not expand the caller's scopes or source
diff --git a/products/notary/docs/oid4vci-wallet-interop.md b/products/notary/docs/oid4vci-wallet-interop.md
index 772f6a242e..23d6367d1a 100644
--- a/products/notary/docs/oid4vci-wallet-interop.md
+++ b/products/notary/docs/oid4vci-wallet-interop.md
@@ -13,6 +13,7 @@ The wallet facade supports:
 
 - registry-backed claims whose exact compiler-pinned Relay execution is stored
   in a Notary transaction;
+- bounded closed object and array claims from direct Relay outputs;
 - `dc+sd-jwt` credentials;
 - EdDSA or ES256 issuer signing, selected by the credential profile;
 - EdDSA JWT holder proof with `did:jwk` binding;
@@ -47,7 +48,97 @@ Before enabling the wallet facade:
 See the [operator configuration reference](operator-config-reference.md) and
 [credential issuance migration](credential-issuance-migration.md).
 
-## End-to-end developer check
+## Create an offer from a registrar evaluation
+
+An authorized registry client can create an offer after it evaluates the
+authoritative record through `POST /v1/evaluations`. This path does not use the
+citizen browser or identity-provider callback.
+
+Generated projects admit registrar OIDC clients explicitly:
+
+```yaml
+oid4vci:
+  public_base_url: https://notary.example.gov
+  registrar_clients: [opencrvs-registrar]
+```
+
+Registryctl keeps these clients on the same pinned authorization server and
+JWKS as the citizen client, but requires the Notary `public_base_url` as the
+machine resource audience. The signed `JWT` access token needs a stable `sub`
+that matches the evaluation owner, an admitted `azp` or `client_id`,
+`registry_notary:credential_offer_create`, the selected credential
+configuration's scope, and exact Registry Notary `authorization_details`.
+Those details must permit `create_credential_offer` for the target, complete
+claim set, value disclosure, claim-result format, purpose, service, and
+machine access mode. Identify the target with the evaluated primary
+identifier's scheme and value. When an entity has only a top-level
+`target.id`, use the reserved authorization `id_type` value `id`; this keeps
+typed identifiers distinct from the untyped top-level ID.
+
+An admitted registrar client with the machine resource audience needs only
+the access token; citizen userinfo and ID-token assurance are not required.
+Any citizen client or citizen audience signal still selects the citizen path,
+so mixed client/audience tokens cannot retain machine authority. A
+Notary-issued wallet access token is not accepted.
+
+Send only the stored evaluation identifier and configured credential type:
+
+```http
+POST /oid4vci/offers HTTP/1.1
+Host: notary.example.gov
+Authorization: Bearer <machine-client-token>
+Idempotency-Key: <stable-retry-key>
+Content-Type: application/json
+
+{
+  "evaluation_id": "<evaluation-id>",
+  "credential_configuration_id": "birth_certificate_sd_jwt"
+}
+```
+
+The request cannot contain a target, purpose, claim value, Relay result, or
+provenance. Registry Notary reloads those values from the fresh caller-owned
+evaluation and active reviewed configuration. It rejects denied, stale,
+source-free, mismatched, foreign, or already consumed evaluations before
+creating an issuance transaction.
+
+A successful response is:
+
+```json
+{
+  "credential_offer_uri": "<sensitive-openid-credential-offer-uri>",
+  "tx_code": "<separate-numeric-pin>",
+  "expires_at": "2026-07-29T12:05:00Z"
+}
+```
+
+Registrar-created offers always require `tx_code`, independent of the citizen
+self-service transaction-code setting. The offer URI describes that
+requirement but never contains the numeric PIN. The API separates the two
+values but does not create a second communications channel. The registrar
+integration must deliver the PIN separately from the QR code, link, message,
+or device that carries the offer URI.
+
+Treat the complete response as secret-adjacent. Every response uses
+`Cache-Control: no-store` and `Pragma: no-cache`. Do not log the response,
+offer URI, transaction code, target, raw evaluation values, or holder
+identifiers.
+
+Use the same `Idempotency-Key` only for an exact retry of the same request.
+An exact retry returns the stored response and does not mint a second
+transaction. Reusing the key for another request, using another key for an
+evaluation already reserved for issuance, or racing two requests returns
+`409`. A client-scoped quota can return `429`. Retry a lost response with the
+original key; do not start another evaluation or invent a second key.
+Exact replays, known idempotency conflicts, and consumed-evaluation preflights
+do not call the signer. A genuinely new attempt consumes client quota before
+signer work, so signer failures still count toward abuse protection.
+
+The wallet then redeems the offer through `/oid4vci/token` and
+`/oid4vci/credential`. The pre-authorized code, access token, proof nonce,
+holder proof, and credential remain bound to the same immutable transaction.
+
+## Check the citizen browser flow
 
 1. Open this URL in the citizen's browser:
 
@@ -163,6 +254,13 @@ Notary serves Type Metadata at both the configured `vct` URL and the
 claim and its selective-disclosure behavior. `status` is a reserved top-level
 claim and cannot be projected as a selectively disclosable value.
 
+For a direct structured Relay output, each claim also includes the namespaced
+`registry_notary_value_schema` member. The member publishes the exact closed
+recursive value contract, including required object fields, item schemas, and
+byte and item bounds. It does not define nested disclosure. A top-level object
+or array claim is one SD-JWT disclosure: the holder discloses or withholds the
+complete value.
+
 ## Credential request and response
 
 The wallet sends one proof using either the supported single-proof shape or the
@@ -188,7 +286,8 @@ origin.
 ## Security invariants
 
 - Notary creates the offer only after the identity binding and registry-backed
-  evaluation succeed.
+  evaluation succeed, or after an authorized registrar selects an existing
+  fresh caller-owned registry-backed evaluation.
 - The credential endpoint reloads the stored transaction and verifies the
   active claim, profile, purpose, contract hash, Relay ULID, acquisition time,
   and claim provenance before signer access.
diff --git a/products/notary/docs/operator-config-reference.md b/products/notary/docs/operator-config-reference.md
index 02073ac7f5..e95ae5988a 100644
--- a/products/notary/docs/operator-config-reference.md
+++ b/products/notary/docs/operator-config-reference.md
@@ -285,7 +285,13 @@ evidence.claims[].evidence_mode.consultations.*.inputs
 evidence.claims[].evidence_mode.consultations.*.inputs.*
 evidence.claims[].evidence_mode.consultations.*.outputs
 evidence.claims[].evidence_mode.consultations.*.outputs.*
+evidence.claims[].evidence_mode.consultations.*.outputs.*.fields
+evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*
+evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.required
+evidence.claims[].evidence_mode.consultations.*.outputs.*.fields.*.schema
+evidence.claims[].evidence_mode.consultations.*.outputs.*.items
 evidence.claims[].evidence_mode.consultations.*.outputs.*.max_bytes
+evidence.claims[].evidence_mode.consultations.*.outputs.*.max_items
 evidence.claims[].evidence_mode.consultations.*.outputs.*.maximum
 evidence.claims[].evidence_mode.consultations.*.outputs.*.minimum
 evidence.claims[].evidence_mode.consultations.*.outputs.*.nullable
@@ -707,6 +713,53 @@ claims become null on `no_match` in the evaluation view and are not issuable
 as null credential claims. Ambiguity or failure evaluates no claims from that
 consultation.
 
+Consultation outputs use a closed tagged schema. Scalar output variants are
+`boolean`, `integer`, `string`, and `date`. Direct output claims also accept
+recursive `object` and `array` variants:
+
+```yaml
+outputs:
+  parents:
+    type: array
+    nullable: false
+    max_bytes: 1024
+    max_items: 2
+    items:
+      type: object
+      nullable: false
+      max_bytes: 384
+      fields:
+        type:
+          required: true
+          schema:
+            type: string
+            nullable: false
+            max_bytes: 16
+        name:
+          required: true
+          schema:
+            type: string
+            nullable: false
+            max_bytes: 160
+        identifier:
+          required: false
+          schema:
+            type: string
+            nullable: true
+            max_bytes: 64
+```
+
+Objects must declare 1 to 32 fields. Unknown keys are rejected. Arrays must
+declare one item schema and a `max_items` value from 1 through 256. Object and
+array `max_bytes` values are canonical serialized-value limits from 1 through
+65,536 bytes. The complete expected output map permits at most 32 outputs,
+schema depth is at most 8, schema node count is at most 256, expanded node
+count is at most 4,096, and each field name is at most 128 UTF-8 bytes.
+
+Notary requires exact schema agreement with the compiler-pinned Relay public
+contract. A direct structured claim is stored and issued as the exact validated
+JSON value. CEL rules remain scalar-only.
+
 `value.max_bytes` is an optional UTF-8 byte ceiling for a string claim result.
 When present, it must be between 1 and 65536 and `value.type` must be `string`.
 Notary accepts a result exactly at the bound, rejects an over-bound result as a
@@ -719,6 +772,8 @@ string claims.
 Disclosure remains a Notary decision. Credential profiles own ordered claim
 membership, issuance format, holder binding, validity, and allowed disclosure.
 Relay outputs are never credentials or public claims by themselves.
+A top-level structured SD-JWT claim is disclosed or withheld as one unit.
+Nested object fields and individual array items are not separate disclosures.
 
 `formats` is optional for each claim. When omitted, Notary uses
 `application/vnd.registry-notary.claim-result+json`, the canonical evaluation
diff --git a/products/notary/docs/release-notes.md b/products/notary/docs/release-notes.md
index 64d1940767..dbc4ab628c 100644
--- a/products/notary/docs/release-notes.md
+++ b/products/notary/docs/release-notes.md
@@ -2,6 +2,22 @@
 
 ## Unreleased
 
+- Registry-backed direct Relay claims can preserve bounded closed objects and
+  arrays through stored evaluation and SD-JWT issuance. Type Metadata publishes
+  the namespaced recursive value contract. Each top-level structured claim is
+  disclosed or withheld as one unit.
+- An authenticated registry client can create a pre-authorized OID4VCI offer
+  from a fresh caller-owned evaluation at `POST /oid4vci/offers`. The endpoint
+  accepts no credential facts or target input, requires an idempotency key,
+  returns the exact stored response for an exact retry, and keeps the
+  required transaction-code value outside the offer URI.
+- This release advances the PostgreSQL state-plane catalog. Stop all Notary
+  writers, take a verified backup, then run the target release's `state
+  install` and `state doctor` commands before admitting traffic. The installer
+  upgrades only the immediately preceding attested v1 catalog; older or
+  drifted schemas require a sequential upgrade, a matching backup and binary,
+  or a fresh installation.
+
 ## 0.15.2
 
 - Registry Notary has no user-visible changes. This release fixes forward from
diff --git a/products/notary/openapi/registry-notary.openapi.json b/products/notary/openapi/registry-notary.openapi.json
index 50659118b2..c33c141e76 100644
--- a/products/notary/openapi/registry-notary.openapi.json
+++ b/products/notary/openapi/registry-notary.openapi.json
@@ -1459,6 +1459,232 @@
         ],
         "type": "object"
       },
+      "RegistryClientOfferRequest": {
+        "additionalProperties": false,
+        "properties": {
+          "credential_configuration_id": {
+            "description": "Configured credential type authorized for the evaluation's exact claim set, purpose, and target.",
+            "type": "string"
+          },
+          "evaluation_id": {
+            "description": "Identifier of the fresh registry-backed evaluation owned by the authenticated machine client.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "evaluation_id",
+          "credential_configuration_id"
+        ],
+        "type": "object"
+      },
+      "RegistryClientOfferResponse": {
+        "additionalProperties": false,
+        "properties": {
+          "credential_offer_uri": {
+            "description": "Sensitive standard credential offer URI. It contains the pre-authorized code and describes the tx_code requirement, but never contains the numeric tx_code value.",
+            "format": "uri",
+            "type": "string"
+          },
+          "expires_at": {
+            "description": "Expiry of the pre-authorized code, capped by the stored evaluation expiry.",
+            "format": "date-time",
+            "type": "string"
+          },
+          "tx_code": {
+            "description": "Required sensitive numeric transaction code. Deliver it to the holder through a channel separate from the credential_offer_uri.",
+            "pattern": "^[0-9]+$",
+            "type": "string"
+          }
+        },
+        "required": [
+          "credential_offer_uri",
+          "tx_code",
+          "expires_at"
+        ],
+        "type": "object"
+      },
+      "RelayOutputContract": {
+        "description": "Recursive, closed compiler-pinned Relay output contract. Runtime validation also enforces maximum depth 8, 256 schema nodes, 4096 expanded nodes, and 128-byte field names.",
+        "oneOf": [
+          {
+            "additionalProperties": false,
+            "properties": {
+              "nullable": {
+                "default": false,
+                "type": "boolean"
+              },
+              "type": {
+                "enum": [
+                  "boolean"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "type"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "maximum": {
+                "format": "int64",
+                "type": "integer"
+              },
+              "minimum": {
+                "format": "int64",
+                "type": "integer"
+              },
+              "nullable": {
+                "default": false,
+                "type": "boolean"
+              },
+              "type": {
+                "enum": [
+                  "integer"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "minimum",
+              "maximum"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "max_bytes": {
+                "maximum": 65536,
+                "minimum": 1,
+                "type": "integer"
+              },
+              "nullable": {
+                "default": false,
+                "type": "boolean"
+              },
+              "type": {
+                "enum": [
+                  "string"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "max_bytes"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "nullable": {
+                "default": false,
+                "type": "boolean"
+              },
+              "type": {
+                "enum": [
+                  "date"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "type"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "fields": {
+                "additionalProperties": {
+                  "$ref": "#/components/schemas/RelayOutputObjectFieldContract"
+                },
+                "maxProperties": 32,
+                "minProperties": 1,
+                "type": "object"
+              },
+              "max_bytes": {
+                "maximum": 65536,
+                "minimum": 1,
+                "type": "integer"
+              },
+              "nullable": {
+                "default": false,
+                "type": "boolean"
+              },
+              "type": {
+                "enum": [
+                  "object"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "max_bytes",
+              "fields"
+            ],
+            "type": "object"
+          },
+          {
+            "additionalProperties": false,
+            "properties": {
+              "items": {
+                "$ref": "#/components/schemas/RelayOutputContract"
+              },
+              "max_bytes": {
+                "maximum": 65536,
+                "minimum": 1,
+                "type": "integer"
+              },
+              "max_items": {
+                "maximum": 256,
+                "minimum": 1,
+                "type": "integer"
+              },
+              "nullable": {
+                "default": false,
+                "type": "boolean"
+              },
+              "type": {
+                "enum": [
+                  "array"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "max_bytes",
+              "max_items",
+              "items"
+            ],
+            "type": "object"
+          }
+        ]
+      },
+      "RelayOutputObjectFieldContract": {
+        "additionalProperties": false,
+        "properties": {
+          "required": {
+            "type": "boolean"
+          },
+          "schema": {
+            "$ref": "#/components/schemas/RelayOutputContract"
+          }
+        },
+        "required": [
+          "required",
+          "schema"
+        ],
+        "type": "object"
+      },
       "RenderEvaluationRequest": {
         "additionalProperties": false,
         "properties": {
@@ -1530,7 +1756,11 @@
                 "registry_notary_semantics": {
                   "$ref": "#/components/schemas/ClaimSemantics"
                 },
+                "registry_notary_value_schema": {
+                  "$ref": "#/components/schemas/RelayOutputContract"
+                },
                 "sd": {
+                  "description": "The complete top-level claim is selectively disclosed as one unit. Nested object fields and array items are not independently disclosable.",
                   "enum": [
                     "always"
                   ],
@@ -2090,6 +2320,10 @@
                         ],
                         "predicate": "urn:registry-notary:predicate:person-is-alive"
                       },
+                      "registry_notary_value_schema": {
+                        "nullable": false,
+                        "type": "boolean"
+                      },
                       "sd": "always"
                     }
                   ],
@@ -2743,6 +2977,10 @@
                         ],
                         "predicate": "urn:registry-notary:predicate:person-is-alive"
                       },
+                      "registry_notary_value_schema": {
+                        "nullable": false,
+                        "type": "boolean"
+                      },
                       "sd": "always"
                     }
                   ],
@@ -3095,6 +3333,348 @@
         "summary": "Begin an authenticated pre-authorized-code offer"
       }
     },
+    "/oid4vci/offers": {
+      "post": {
+        "description": "Creates one short-lived pre-authorized OID4VCI offer from an existing fresh registry-backed evaluation owned by the authenticated machine client. The client supplies only the evaluation id and credential configuration id. Registry Notary reloads the exact stored values, target, purpose, compiler-pinned Relay provenance, credential profile, and configuration fingerprint. The caller must present an external API-key or OIDC machine credential with registry_notary:credential_offer_create, the selected configuration scope, and exact target-scoped authorization_details for create_credential_offer; a Notary-issued wallet access token is not accepted. Idempotency-Key is required. Reusing one key with the same request returns the exact stored response, while changing the request or attempting to create another offer from the consumed evaluation returns 409. The credential_offer_uri describes the required tx_code but never contains its numeric value. The registrar must deliver that value to the holder through a separate channel. Every response is non-storable.",
+        "operationId": "createOid4vciRegistryOffer",
+        "parameters": [
+          {
+            "description": "Caller-generated retry key. Use the same key only for an exact retry of the same request.",
+            "in": "header",
+            "name": "Idempotency-Key",
+            "required": true,
+            "schema": {
+              "maxLength": 256,
+              "minLength": 1,
+              "pattern": "^[\\x21\\x23-\\x5B\\x5D-\\x7E]{1,256}$",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RegistryClientOfferRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "example": {
+                  "credential_offer_uri": "openid-credential-offer://?credential_offer=%7B%22credential_issuer%22%3A%22https%3A%2F%2Fissuer.example.gov%22%2C%22credential_configuration_ids%22%3A%5B%22birth_certificate_sd_jwt%22%5D%2C%22grants%22%3A%7B%22urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Apre-authorized_code%22%3A%7B%22pre-authorized_code%22%3A%22fake-example-code%22%2C%22tx_code%22%3A%7B%22input_mode%22%3A%22numeric%22%2C%22length%22%3A6%7D%7D%7D%7D",
+                  "expires_at": "2026-07-29T12:05:00Z",
+                  "tx_code": "123456"
+                },
+                "schema": {
+                  "$ref": "#/components/schemas/RegistryClientOfferResponse"
+                }
+              }
+            },
+            "description": "New or exactly replayed credential offer response",
+            "headers": {
+              "Cache-Control": {
+                "description": "Prevents storage of offer, code, and transaction material.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Pragma": {
+                "description": "Compatibility cache directive for sensitive offer responses.",
+                "schema": {
+                  "enum": [
+                    "no-cache"
+                  ],
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "example": {
+                  "code": "request.invalid",
+                  "detail": "the offer request or Idempotency-Key is invalid",
+                  "request_id": "01J00000000000000000000000",
+                  "status": 400,
+                  "title": "Invalid evidence request",
+                  "type": "https://id.registrystack.org/problems/registry-notary/request/invalid"
+                },
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            },
+            "description": "Invalid request or idempotency key",
+            "headers": {
+              "Cache-Control": {
+                "description": "Prevents storage of offer, code, and transaction material.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Pragma": {
+                "description": "Compatibility cache directive for sensitive offer responses.",
+                "schema": {
+                  "enum": [
+                    "no-cache"
+                  ],
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "example": {
+                  "code": "auth.missing_credential",
+                  "detail": "missing authentication credential",
+                  "request_id": "01J00000000000000000000000",
+                  "status": 401,
+                  "title": "Missing credential",
+                  "type": "https://id.registrystack.org/problems/registry-notary/auth/missing_credential"
+                },
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            },
+            "description": "Missing or invalid machine credential",
+            "headers": {
+              "Cache-Control": {
+                "description": "Prevents storage of offer, code, and transaction material.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Pragma": {
+                "description": "Compatibility cache directive for sensitive offer responses.",
+                "schema": {
+                  "enum": [
+                    "no-cache"
+                  ],
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "example": {
+                  "code": "auth.scope_denied",
+                  "detail": "missing the offer-create or credential-configuration scope",
+                  "request_id": "01J00000000000000000000000",
+                  "status": 403,
+                  "title": "Scope denied",
+                  "type": "https://id.registrystack.org/problems/registry-notary/auth/scope_denied"
+                },
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            },
+            "description": "Caller lacks a required scope or exact target-scoped authorization",
+            "headers": {
+              "Cache-Control": {
+                "description": "Prevents storage of offer, code, and transaction material.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Pragma": {
+                "description": "Compatibility cache directive for sensitive offer responses.",
+                "schema": {
+                  "enum": [
+                    "no-cache"
+                  ],
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "example": {
+                  "code": "evaluation.not_found",
+                  "detail": "the evaluation is unknown, expired, or not owned by this client",
+                  "request_id": "01J00000000000000000000000",
+                  "status": 404,
+                  "title": "Evaluation not found",
+                  "type": "https://id.registrystack.org/problems/registry-notary/evaluation/not_found"
+                },
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            },
+            "description": "Flow is disabled or the evaluation is unavailable to this caller",
+            "headers": {
+              "Cache-Control": {
+                "description": "Prevents storage of offer, code, and transaction material.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Pragma": {
+                "description": "Compatibility cache directive for sensitive offer responses.",
+                "schema": {
+                  "enum": [
+                    "no-cache"
+                  ],
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "example": {
+                  "code": "offer_conflict",
+                  "detail": "the idempotency key conflicts or the evaluation was already consumed",
+                  "request_id": "01J00000000000000000000000",
+                  "status": 409,
+                  "title": "Credential offer was not created",
+                  "type": "https://id.registrystack.org/problems/registry-notary/offer_conflict"
+                },
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            },
+            "description": "Idempotency conflict or evaluation already consumed",
+            "headers": {
+              "Cache-Control": {
+                "description": "Prevents storage of offer, code, and transaction material.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Pragma": {
+                "description": "Compatibility cache directive for sensitive offer responses.",
+                "schema": {
+                  "enum": [
+                    "no-cache"
+                  ],
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "example": {
+                  "code": "evaluation.quota_exceeded",
+                  "detail": "the machine offer quota was exceeded for this principal",
+                  "request_id": "01J00000000000000000000000",
+                  "status": 429,
+                  "title": "Machine quota exceeded",
+                  "type": "https://id.registrystack.org/problems/registry-notary/evaluation/quota_exceeded"
+                },
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            },
+            "description": "Offer creation is rate limited",
+            "headers": {
+              "Cache-Control": {
+                "description": "Prevents storage of offer, code, and transaction material.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Pragma": {
+                "description": "Compatibility cache directive for sensitive offer responses.",
+                "schema": {
+                  "enum": [
+                    "no-cache"
+                  ],
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "example": {
+                  "code": "offer_unavailable",
+                  "detail": "the offer correctness state is unavailable",
+                  "request_id": "01J00000000000000000000000",
+                  "status": 503,
+                  "title": "Credential offer was not created",
+                  "type": "https://id.registrystack.org/problems/registry-notary/offer_unavailable"
+                },
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            },
+            "description": "Offer correctness state or another required dependency is unavailable",
+            "headers": {
+              "Cache-Control": {
+                "description": "Prevents storage of offer, code, and transaction material.",
+                "schema": {
+                  "enum": [
+                    "no-store"
+                  ],
+                  "type": "string"
+                }
+              },
+              "Pragma": {
+                "description": "Compatibility cache directive for sensitive offer responses.",
+                "schema": {
+                  "enum": [
+                    "no-cache"
+                  ],
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "apiKeyAuth": []
+          },
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Create a registrar-initiated pre-authorized offer"
+      }
+    },
     "/oid4vci/token": {
       "post": {
         "description": "Public and unauthenticated OID4VCI token endpoint for the pre-authorized-code grant. Accepts only grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code with a valid, unexpired, single-use pre-authorized_code. A matching tx_code is required when the credential offer includes a tx_code object. Mints a short-TTL Notary-signed access token plus a c_nonce. Returns 404 when the pre-authorized-code flow is disabled. Error responses use the OpenID4VCI error envelope, not RFC 9457 Problem Details.",
diff --git a/products/notary/security/exposure-manifest.json b/products/notary/security/exposure-manifest.json
index c6bfe38b89..c88111ae77 100644
--- a/products/notary/security/exposure-manifest.json
+++ b/products/notary/security/exposure-manifest.json
@@ -320,6 +320,31 @@
       ],
       "waiver": null
     },
+    {
+      "service": "registry-notary",
+      "listener": "public",
+      "method": "POST",
+      "path": "/oid4vci/offers",
+      "feature": null,
+      "audience": "external",
+      "auth": "api_key_or_oidc",
+      "scopes": [
+        "registry_notary:credential_offer_create"
+      ],
+      "rate_limit": "machine_client_offer",
+      "audit": "required",
+      "openapi": true,
+      "stability": "beta",
+      "data_classification": "secret-adjacent",
+      "notes": "Protected registrar integration route. It also requires the selected credential-configuration scope, exact target-scoped authorization_details, a caller-owned fresh registry-backed evaluation, current exact Relay provenance and configuration, and Idempotency-Key. Atomic correctness state binds one evaluation to one transaction, charges the client-scoped quota, and returns the exact stored response for an exact retry. Registrar-created offers always require a separately delivered numeric tx_code. The response is non-storable, and the numeric value is never embedded in the credential_offer_uri.",
+      "source": "manual",
+      "enforcement_tests": [
+        "crates/registry-notary-server/src/standalone/tests/auth.inc::registrar_offer_creation_is_not_auth_exempt",
+        "crates/registry-notary-server/src/preauth_state.rs::registry_client_offer_exact_replay_returns_the_cached_response",
+        "crates/registry-notary-server/src/preauth_state.rs::concurrent_idempotency_keys_consume_an_evaluation_once"
+      ],
+      "waiver": null
+    },
     {
       "service": "registry-notary",
       "listener": "public",
diff --git a/products/notary/security/route-inventory.json b/products/notary/security/route-inventory.json
index 2c8e5eec7c..a3f9351f00 100644
--- a/products/notary/security/route-inventory.json
+++ b/products/notary/security/route-inventory.json
@@ -123,6 +123,15 @@
       ],
       "source": "crates/registry-notary-server/src/api.rs"
     },
+    {
+      "listener": "public",
+      "path": "/oid4vci/offers",
+      "methods": [
+        "POST"
+      ],
+      "source": "crates/registry-notary-server/src/api.rs",
+      "notes": "Machine-authenticated registrar integration route. Requires registry_notary:credential_offer_create, the selected credential-configuration scope, exact target-scoped authorization_details, an existing caller-owned registry-backed evaluation, and Idempotency-Key."
+    },
     {
       "listener": "public",
       "path": "/oid4vci/token",
diff --git a/schemas/registry-notary.config.schema.json b/schemas/registry-notary.config.schema.json
index db654c6870..c195f9f1f9 100644
--- a/schemas/registry-notary.config.schema.json
+++ b/schemas/registry-notary.config.schema.json
@@ -2454,9 +2454,89 @@
             "type"
           ],
           "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "fields": {
+              "additionalProperties": {
+                "$ref": "#/$defs/RelayOutputObjectFieldContract"
+              },
+              "type": "object"
+            },
+            "max_bytes": {
+              "format": "uint32",
+              "minimum": 0,
+              "type": "integer"
+            },
+            "nullable": {
+              "default": false,
+              "type": "boolean"
+            },
+            "type": {
+              "const": "object",
+              "type": "string"
+            }
+          },
+          "required": [
+            "type",
+            "max_bytes",
+            "fields"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "items": {
+              "$ref": "#/$defs/RelayOutputContract"
+            },
+            "max_bytes": {
+              "format": "uint32",
+              "minimum": 0,
+              "type": "integer"
+            },
+            "max_items": {
+              "format": "uint16",
+              "maximum": 65535,
+              "minimum": 0,
+              "type": "integer"
+            },
+            "nullable": {
+              "default": false,
+              "type": "boolean"
+            },
+            "type": {
+              "const": "array",
+              "type": "string"
+            }
+          },
+          "required": [
+            "type",
+            "max_bytes",
+            "max_items",
+            "items"
+          ],
+          "type": "object"
         }
       ]
     },
+    "RelayOutputObjectFieldContract": {
+      "additionalProperties": false,
+      "properties": {
+        "required": {
+          "type": "boolean"
+        },
+        "schema": {
+          "$ref": "#/$defs/RelayOutputContract"
+        }
+      },
+      "required": [
+        "required",
+        "schema"
+      ],
+      "type": "object"
+    },
     "RequestVariableConfig": {
       "additionalProperties": false,
       "properties": {