v0.16.0: OpenRe.Stream is alpha — openre.stream.read|write, openre.key.rotate, openre.session.read|end, openre.output.read|write

ddiff --git a/manifests/capabilities/openre.key.rotate.json b/manifests/capabilities/openre.key.rotate.json
nnew file mode 100644
iindex 00000000..80119b05
---- /dev/null
++++ b/manifests/capabilities/openre.key.rotate.json
@@@ -0,0 +1,21 @@
++{
++  "id": "openre.key.rotate",
++  "version": "1.0",
++  "owner": "openre",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Rotate a stream's ingest key: a new key is issued and returned once; the old one is revoked immediately or after a grace period, and running sessions can optionally be ended.",
++  "permissions": [
++    "openre:keys"
++  ],
++  "resourceConstraints": [
++    "owner"
++  ],
++  "quotaClass": "openre-write",
++  "events": [
++    "openre.key.rotated"
++  ],
++  "implementedBy": [
++    "POST /api/v1/streams/:id/keys/rotate"
++  ]
++}
ddiff --git a/manifests/capabilities/openre.output.read.json b/manifests/capabilities/openre.output.read.json
nnew file mode 100644
iindex 00000000..1a7ffd96
---- /dev/null
++++ b/manifests/capabilities/openre.output.read.json
@@@ -0,0 +1,22 @@
++{
++  "id": "openre.output.read",
++  "version": "1.0",
++  "owner": "openre",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Read restream destinations (keys masked to their last four characters), outputs with health and progress, and bounded logs.",
++  "permissions": [
++    "openre:read"
++  ],
++  "resourceConstraints": [
++    "owner"
++  ],
++  "quotaClass": "openre-read",
++  "events": [],
++  "implementedBy": [
++    "GET /api/v1/streams/:id/destinations",
++    "GET /api/v1/sessions/:id/outputs",
++    "GET /api/v1/destinations/:id/logs",
++    "GET /api/v1/outputs/:id/logs"
++  ]
++}
ddiff --git a/manifests/capabilities/openre.output.write.json b/manifests/capabilities/openre.output.write.json
nnew file mode 100644
iindex 00000000..facbdfa9
---- /dev/null
++++ b/manifests/capabilities/openre.output.write.json
@@@ -0,0 +1,27 @@
++{
++  "id": "openre.output.write",
++  "version": "1.0",
++  "owner": "openre",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Create, update, delete and test restream destinations (stream keys are write-only and sealed at rest; URLs must be rtmp/rtmps/srt with public hosts), and start or stop an output for the live session.",
++  "permissions": [
++    "openre:outputs"
++  ],
++  "resourceConstraints": [
++    "owner"
++  ],
++  "quotaClass": "openre-write",
++  "events": [
++    "openre.output.healthy",
++    "openre.output.failed"
++  ],
++  "implementedBy": [
++    "POST /api/v1/streams/:id/destinations",
++    "PATCH /api/v1/destinations/:id",
++    "DELETE /api/v1/destinations/:id",
++    "POST /api/v1/destinations/:id/test",
++    "POST /api/v1/destinations/:id/start",
++    "POST /api/v1/destinations/:id/stop"
++  ]
++}
ddiff --git a/manifests/capabilities/openre.session.end.json b/manifests/capabilities/openre.session.end.json
nnew file mode 100644
iindex 00000000..cb4fe944
---- /dev/null
++++ b/manifests/capabilities/openre.session.end.json
@@@ -0,0 +1,21 @@
++{
++  "id": "openre.session.end",
++  "version": "1.0",
++  "owner": "openre",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Ask the worker that owns a session to disconnect its encoder (the session then ends normally).",
++  "permissions": [
++    "openre:sessions"
++  ],
++  "resourceConstraints": [
++    "owner"
++  ],
++  "quotaClass": "openre-write",
++  "events": [
++    "openre.session.ended"
++  ],
++  "implementedBy": [
++    "POST /api/v1/sessions/:id/end"
++  ]
++}
ddiff --git a/manifests/capabilities/openre.session.read.json b/manifests/capabilities/openre.session.read.json
nnew file mode 100644
iindex 00000000..c9ae19e3
---- /dev/null
++++ b/manifests/capabilities/openre.session.read.json
@@@ -0,0 +1,22 @@
++{
++  "id": "openre.session.read",
++  "version": "1.0",
++  "owner": "openre",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Read ingest sessions: lifecycle and transitions, worker and generation, media info, recording state and the playback descriptor; list worker generations.",
++  "permissions": [
++    "openre:read"
++  ],
++  "resourceConstraints": [
++    "owner"
++  ],
++  "quotaClass": "openre-read",
++  "events": [],
++  "implementedBy": [
++    "GET /api/v1/sessions",
++    "GET /api/v1/sessions/:id",
++    "GET /api/v1/sessions/:id/playback",
++    "GET /api/v1/workers"
++  ]
++}
ddiff --git a/manifests/capabilities/openre.stream.read.json b/manifests/capabilities/openre.stream.read.json
nnew file mode 100644
iindex 00000000..7d9336ba
---- /dev/null
++++ b/manifests/capabilities/openre.stream.read.json
@@@ -0,0 +1,21 @@
++{
++  "id": "openre.stream.read",
++  "version": "1.0",
++  "owner": "openre",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Read stream definitions: ingest URLs, key metadata (hint, status; never a key), settings and external references. Owners read their own; a service reads every stream, or the streams of the X-OV-Subject it acts for.",
++  "permissions": [
++    "openre:read"
++  ],
++  "resourceConstraints": [
++    "owner"
++  ],
++  "quotaClass": "openre-read",
++  "events": [],
++  "implementedBy": [
++    "GET /api/v1/streams",
++    "GET /api/v1/streams/:id",
++    "GET /api/v1/streams/:id/keys"
++  ]
++}
ddiff --git a/manifests/capabilities/openre.stream.write.json b/manifests/capabilities/openre.stream.write.json
nnew file mode 100644
iindex 00000000..51d14e6b
---- /dev/null
++++ b/manifests/capabilities/openre.stream.write.json
@@@ -0,0 +1,21 @@
++{
++  "id": "openre.stream.write",
++  "version": "1.0",
++  "owner": "openre",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Create, update and archive stream definitions (creation issues the first ingest key, returned once). Archiving is refused while a session is open.",
++  "permissions": [
++    "openre:write"
++  ],
++  "resourceConstraints": [
++    "owner"
++  ],
++  "quotaClass": "openre-write",
++  "events": [],
++  "implementedBy": [
++    "POST /api/v1/streams",
++    "PATCH /api/v1/streams/:id",
++    "DELETE /api/v1/streams/:id"
++  ]
++}
ddiff --git a/manifests/services/openre.json b/manifests/services/openre.json
iindex 10cd1d3a..070d0cc0 100644
---- a/manifests/services/openre.json
++++ b/manifests/services/openre.json
@@@ -1,16 +1,40 @@
  {
    "version": "0.1.0",
    "contractRanges": {
--    "openvibe-contracts": "^0.1.0"
++    "openvibe-contracts": ">=0.13.0 <1.0.0"
    },
    "id": "openre",
    "name": "OpenRe.Stream",
--  "status": "placeholder",
++  "status": "alpha",
    "repository": "OpenVibers/OpenRe.Stream",
--  "domains": [],
--  "capabilities": [],
--  "eventsProduced": [],
++  "domains": [
++    "openre.stream",
++    "ingest.openre.stream"
++  ],
++  "publicOrigin": "https://openre.stream",
++  "health": "/api/health",
++  "ready": "/api/ready",
++  "capabilities": [
++    "openre.stream.read",
++    "openre.stream.write",
++    "openre.key.rotate",
++    "openre.session.read",
++    "openre.session.end",
++    "openre.output.read",
++    "openre.output.write"
++  ],
++  "eventsProduced": [
++    "openre.session.started",
++    "openre.session.ended",
++    "openre.session.failed",
++    "openre.output.healthy",
++    "openre.output.failed",
++    "openre.recording.requested",
++    "openre.key.rotated"
++  ],
    "eventsConsumed": [],
--  "namespacesOwned": [],
--  "notes": "Ingest and restream: stream definitions, keys, sessions, transport workers, outputs and output health. Charter only; no runtime."
++  "namespacesOwned": [
++    "openre.*"
++  ],
++  "notes": "Ingest and restream authority (ADR-009). Alpha: RTMP ingest and RTMP/SRT restream run in transport workers with generations and leases, separate from the API; WHIP, WebRTC/SFU and JSMPEG are still ingested by Live. Runs in parallel with Live; slots move one at a time behind Live's per-slot ingest_authority switch."
  }
ddiff --git a/package.json b/package.json
iindex 0a0110d7..89414d5d 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.15.0",
++  "version": "0.16.0",
    "description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
    "main": "index.js",
    "types": "generated/typescript/index.d.ts",