- define explicit MCP read scope boundaries and upgrade handling - document Nightscout private-origin pinning and reset revocation