Rotating heartbeat — verifies + rotates the binding nonce, emits split-detection on mismatch

Signed project phone-home JWT

Signed binding token from the last activate / heartbeat response

Compact JWS signed with the project-JWT signing key