Add fenced SPP prerequisite renewal through journal brain and Cortex, including expected active-fingerprint/absence fences for fallback refreshes. Rotate stale process-local RA-TLS transport inline without forwarding bytes on failed replacement, and bound nvattest appraisal with redacted timeout handling.