The readiness taxonomy contains no attestation codes, so the blocking predicate answers false for the one failure class meaning the confidential processing environment could not be verified -- while a missing provider key answers true. The contract now classifies that family as blocking explicitly rather than resting on a lookup that returns not-found, and an unknown or absent reason code resolves to the preserving direction rather than the consuming one. Session framing was described without saying how it is entered or bounded, which is unresolvable rather than merely unstated: one-shot reads stdin to EOF, so a child that guessed wrong would hang. The caller declares both. Its two new failure classes -- a desynchronised stream and a dead child -- carry the same two classifications a refusal does, the caller must drain stderr or the child blocks writing a log line, and a declared request field is honoured or refused but never silently dropped. Reader tolerance is bounded: it covers vocabulary members and degrades to the safe classification; it never covers the schema identifier.