2- HYBRID RECEIVER — 5.1.0-0920-02

Scope
- Dash-number identity and stable menu position.
- HMAC and five-minute timestamp validation retained.
- One-use nonces enforced for API Bridge, provisioning, SSO launch and frame launch.
- Expired nonce cleanup retained.
- Frame origin is limited to the configured platform origin.
- Provisioning accepts active local staff only.
- Platform origin input is URL validated.

QA boundary
- Source, route/contract, JSON, archive, secret-pattern and conflict-marker scans completed.
- Target Perfex/PHP activation and remote round-trip tests are still required on a staging clone.
- No customer, payment, password, API-key or session data is included.
