Refresh T2 docs and pins to v0.153.0; mark slice-1 proposals shipped (#171)

ddiff --git a/README.md b/README.md
iindex ba7cacf5..cb7fd72b 100644
---- a/README.md
++++ b/README.md
@@@ -49,7 +49,7 @@ Identity and account service for the OpenVibe network. Manages user accounts, OA
  
  ## Depends on
  
--- `openvibe-contracts` v0.111.0 (registry manifests, capability checks), `openvibe-sdk` v0.35.0 (PostgreSQL
++- `openvibe-contracts` v0.162.0 (registry manifests, capability checks), `openvibe-sdk` v0.44.0 (PostgreSQL
    and Valkey adapters, events, per-actor limits, universal telemetry), `openvibe-shared` v4.1.3, pinned by release tarball
  - OpenVibe.Events (Network's outbox relay; the events it consumes), OpenVibe.AI (the `network.site_copy`
    workflow), OpenVibe.Blog (the changelog feed it proxies)
ddiff --git a/STATUS.json b/STATUS.json
iindex b3fb15e3..5092854f 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -6,7 +6,7 @@
    "runtime": "node 22, express, PostgreSQL 18 (openvibe-sdk/db, async) + Valkey 9",
    "port": 4000,
    "domain": "openvibe.network (with auth., api., admin., my. and themes.openvibe.network in its manifest)",
--  "contracts": "openvibe-contracts v0.153.0",
++  "contracts": "openvibe-contracts v0.162.0",
    "sdk": "openvibe-sdk v0.44.0",
    "shared": "openvibe-shared v4.1.3",
    "capabilities": [
@@@ -48,5 +48,5 @@
      "per-actor limits (openvibe-sdk/limits)",
      "universal telemetry: per-route aggregated platform.telemetry-sample@1 plus per-flush HTTP autoscaling gauges (openvibe-sdk/telemetry)"
    ],
--  "updated": "2026-10-12"
++  "updated": "2026-10-13"
  }
ddiff --git a/docs/capabilities-proposal/network.confirmation.manage.json b/docs/capabilities-proposal/network.confirmation.manage.json
iindex 0a6e1eda..cd077831 100644
---- a/docs/capabilities-proposal/network.confirmation.manage.json
++++ b/docs/capabilities-proposal/network.confirmation.manage.json
@@@ -2,6 +2,8 @@
    "id": "network.confirmation.manage",
    "version": "1.0",
    "_note": "shipped in openvibe-contracts v0.89.0",
++  "shipped_in": "openvibe-contracts v0.89.0",
++  "shipped_note": "v0.89.0 published network.confirmation.manage; this file stays as the slice-1 proposal, cited by docs/t2-projects-and-grants.md section 8.",
    "owner": "network",
    "status": "planned",
    "visibility": "first-party",
ddiff --git a/docs/contracts-proposal/identity.service-token-claims.v1.json b/docs/contracts-proposal/identity.service-token-claims.v1.json
iindex e6dc7ae9..f7e30f2c 100644
---- a/docs/contracts-proposal/identity.service-token-claims.v1.json
++++ b/docs/contracts-proposal/identity.service-token-claims.v1.json
@@@ -2,6 +2,8 @@
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "$id": "https://openvibe.network/contracts/identity/service-token-claims.v1.json",
    "_note": "shipped in openvibe-contracts v0.89.0",
++  "shipped_in": "openvibe-contracts v0.89.0",
++  "shipped_note": "v0.89.0 published the agent actor_type with on_behalf_of, cap_confirm and act; this file stays as the slice-1 proposal, cited by docs/t2-projects-and-grants.md section 8.",
    "title": "ServiceTokenClaims",
    "description": "Claims of a short-lived RS256 client-credentials token issued by OpenVibe.Network to a service, app, mod, node or agent principal. Replaces X-Internal-Key. App tokens (actor_type app) also carry project_id and env; receivers refuse env=sandbox unless they opted in. Agent tokens (actor_type agent; roadmap WS-Z2, docs/t2-projects-and-grants.md) are minted for an agent by its host and also carry project_id, env and on_behalf_of (the owner), and act (the host).",
    "type": "object",
ddiff --git a/docs/contracts-proposal/network.confirmation.changed.v1.json b/docs/contracts-proposal/network.confirmation.changed.v1.json
iindex da537121..afce1573 100644
---- a/docs/contracts-proposal/network.confirmation.changed.v1.json
++++ b/docs/contracts-proposal/network.confirmation.changed.v1.json
@@@ -1,6 +1,8 @@
  {
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "$id": "https://openvibe.network/contracts/events/payloads/network.confirmation.changed.v1.json",
++  "shipped_in": "openvibe-contracts v0.89.0",
++  "shipped_note": "v0.89.0 published network.confirmation.changed@1; this file stays as the slice-1 proposal, cited by docs/t2-projects-and-grants.md section 8.",
    "title": "NetworkConfirmationChangedPayload",
    "description": "network.confirmation.changed v1 (OpenVibe.Network; roadmap WS-Z2, docs/t2-projects-and-grants.md section 5). A confirmation request (network.confirmation-request@1) an agent raised for a sensitive capability was created, approved, denied, expired, cancelled or used. Written to Network's outbox in the transaction that changes it, beside an audit row. Never carries the summary or details, which may hold message text: a reader that needs them asks Network with its own authority. Envelope: subject { type: confirmation, id: cnf_… }, visibility internal, on_behalf_of the owner, actor the owner who decided (or the system for an expiry, a cascade or a standing rule).",
    "type": "object",
ddiff --git a/docs/t2-cells-and-node-principal.md b/docs/t2-cells-and-node-principal.md
iindex 3ce514fe..edaa8861 100644
---- a/docs/t2-cells-and-node-principal.md
++++ b/docs/t2-cells-and-node-principal.md
@@@ -1,10 +1,10 @@
  # T2 lane B — cells, the node principal and registry slice 5 (design)
  
--Status: **N1–N7 merged** on `origin/main` `fbd6312` (registry slice 5, the node principal, node tokens and the registry
++Status: **N1–N7 merged** on `origin/main` `2ca00ed` (registry slice 5, the node principal, node tokens and the registry
  operator writers; each slice's state is in §8). The cells layer of `docs/t2-resource-registry.md` §9 was already on
  `origin/main` (`d6ed8c4`, PR #5: `migrations/0008_cells_and_node_principals.sql`, `server/registry/cells.js`,
  `test/cells-registry.test.js`); this document designed the rest of lane B on top of it and re-planned registry slice 5.
--Pinned: Network `openvibe-contracts` **v0.107.0** (`package.json:33`). v0.98.0 added `network.node.revoked@1`, the event
++Pinned: Network `openvibe-contracts` **v0.162.0** (`package.json:33`). v0.98.0 added `network.node.revoked@1`, the event
  Network now emits on every node-principal revoke (§10), so a connected machine is stopped at once rather than at its next
  reauth. v0.85.0 closed every contract gap in §2 and the §9.1 T1 brief (the doc was
  written against v0.83.0, checked then against v0.84.0). OpenVibe.Bot
ddiff --git a/docs/t2-projects-and-grants.md b/docs/t2-projects-and-grants.md
iindex 970c7cf3..522fc3c6 100644
---- a/docs/t2-projects-and-grants.md
++++ b/docs/t2-projects-and-grants.md
@@@ -5,16 +5,17 @@ merge `4ec36e1`) and **lane B step 3 built** (`GET /internal/projects/:project_i
  only: `server/internal/routes.js:490`; PR #28, merge `e422342`) and **slice 3 built** (delegated grants and modes:
  `migrations/0017_agent_grants.sql`, the ceiling in `server/developer/agents.js`), **slices 4–5 built** (confirmations,
  owner side, and budgets: `0018`, `0019`) and **slices 6–7 built** (`GET /internal/agents/:agent` and the four
--`/internal/confirmations` routes, `server/internal/routes.js`, with the pin at `openvibe-contracts` v0.107.0) and **slices
++`/internal/confirmations` routes, `server/internal/routes.js`, with the pin at `openvibe-contracts` v0.162.0) and **slices
  8–9 built** (agent tokens, `server/developer/agent-tokens.js`; `network.confirmation.changed@1` decision events from
  `server/developer/confirmations.js`; and the owner notification, `confirmations.notifyOwner` sending `openvibe-shared`
  `TYPES.CONFIRMATION_REQUESTED`, PR #47, merge `fbd6312`).
++refreshed 2026-10-13 against 2ca00ed
  Plan T2, "Projects and grants: projects as the ownership boundary for every resource;
  `agt_` principals, delegated grants with modes, sensitive capabilities, confirmation requests, budgets (WS-Z2)".
--Pinned version: `openvibe-contracts` **v0.107.0** (`package.json`); every contract claim below was
++Pinned version: `openvibe-contracts` **v0.162.0** (`package.json`); every contract claim below was
  re-checked against the `v0.85.0` tag of OpenVibe.Contracts when slices 1–2 were built (it was written against v0.83.0).
  v0.89.0 published `network.confirmation.manage` (`planned`, `implementedBy` the four `/internal/confirmations` routes),
--the `agent` actor in `identity.service-token-claims@1` and `network.confirmation.changed@1`; v0.86–v0.97 are additive.
++the `agent` actor in `identity.service-token-claims@1` and `network.confirmation.changed@1`; v0.86.0–v0.162.0 are additive.
  
  Scope: an **agent** is a principal (`agt_<ULID>`) that acts for one person, inside one developer project, run by one
  host (a developer app or a first-party service such as OpenVibe.Actor). Its owner **delegates** part of the host's
ddiff --git a/docs/t2-resource-registry.md b/docs/t2-resource-registry.md
iindex 76fced80..f1b3f568 100644
---- a/docs/t2-resource-registry.md
++++ b/docs/t2-resource-registry.md
@@@ -3,7 +3,7 @@
  Status: **resource registry and N6 built** (`migrations/0007_resource_registry.sql`,
  `migrations/0009_resource_offer_kinds.sql`, `server/registry/offers.js`); **cells and node principals built**
  (section 9, `migrations/0008`). The original slice plan in §7 is historical.
--Current pin: `openvibe-contracts` **v0.107.0** (`package.json`; the kinds below are as of v0.85.0); the v0.83.0 observations below describe the original design.
++Current pin: `openvibe-contracts` **v0.162.0** (`package.json`; the kinds below are as of v0.85.0); the v0.83.0 observations below describe the original design.
  
  Scope: one table and one module that store **what the network can sell or place on** — node, provider, storage, delivery,
  runtime, agent and harness offers — reported by the components that own them, listed publicly so that `openvibe-sdk/placement` can plan against