- Add receipt replay protection (payload_sha256, action, origin in HMAC)
- Remove shadow_verdict and redacted_payload from client responses
- Remove version/mode from /health endpoint
- Add ALETHEIA_ALIAS_SALT for non-deterministic rotation
- Add Scout memory cap with eviction
- Remove dead asyncio code from spectral_monitor
- Replace print() with logging
- Enforce RECEIPT_SECRET at boot in active mode
- Add Base64 bomb protection (10x size limit)
- 275 tests passing