Current limitations

• Subscription restrictions remain deferred. Credential grants are the workspace catalog intersected with the human issuer's Academy permissions. Package, status, module, rate and free-form subscription flags are not entitlement. Five sensitive club scopes are now supported only for the exact target club's active OWNER; ADMIN, cross-club ownership and permission wildcards do not qualify. Federation staff-only scopes remain refused by the admin-only credential control plane.
• No runtime mock API. The obsolete seed/rehearsal demo and alpha/beta/gamma operations are not published. Historical fixed cryptographic vectors may retain mock.* payloads only when explicitly labelled non-subscribable test data.
• Webhooks need polling reconciliation. A permanent post-commit capture gap exists; a sweep cannot recover an outbox row that was never persisted.
• P6 isolates delivery but does not add durability before capture. The standalone health-only Partner worker now owns queue consumption and recovery; the API and all Academy modes are producer-only. The permanent post-commit capture gap above remains.
• No external acceptance claim. This contract is statically generated and tested from source. No external mock repository or real deployed environment was available for this P5 verification.
• OpenAPI describes the four signing headers but cannot calculate a valid signature; interactive try-it-out calls fail unless an external signer supplies them.