Audit Chain 1.1.0 - Request-scoped collector (dedupe, write at kernel.terminate) - Unresolvable signing keys fail loud; verify distinguishes written_unkeyed - key_id per row; previous_hash_keys for rotation - Encryption-profile rotation warning on the status report - UTF-8 substitute so malformed metadata cannot destroy a row hash