Narrow the shared SegmentFile.status component to the enum [present, relocated, missing] and enrich three observer operation descriptions with the transfer contract's client obligations: - ingestSegments: proven-held iff status is present OR relocated AND sha256 matches the local file; missing/unaccounted is needs-upload and the local copy must never be deleted against it; relocated is a held state (re-upload only returns duplicate); confirm-before-delete matches per (filename via submitted_name-else-name, sha256). - ingestUpload 200: duplicate -> existing_segment authoritative; collision -> remapped segment authoritative. - ingestUpload: registry-derived media container list (from solstone.think.media FORMATS), headerless-raw rejected / raw PCM WAV-wrapped, video timestamps are boundary-relative real capture offsets. Description prose only; no ingest enforcement added. NOTE: the SegmentFile.status enum narrowing is a client-facing semantic narrowing that the OpenAPI breaking tripwire does NOT auto-catch (diff.py does not walk components.schemas / oneOf), so native-client owners must be notified out-of-band. Added conformance tests: declared-enum pin + live-listing membership, and the submitted_name-absent day-listing case. Regenerated convey-clients.json. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>