Close CCR drift and high-risk policy gaps

docs/credential-change-approval.md

@@ -74,6 +74,7 @@ Suggested states:
 
 ```text
 draft
+in_flight
 proposed
 needs_changes
 approved
@@ -89,6 +90,12 @@ superseded
 cancelled
 ```
 
+`in_flight` is the only state that may explicitly omit completion-only fields.
+It must declare every omission in `in_flight.missing_fields`, name the owner and
+blocking reason, and remain non-resolvable. The validator still checks every
+other field. This is not an applyable state and must never be used to hide a
+malformed active lane.
+
 Only `approved` requests may be applied. Only `verified` requests may become
 `active`.
 
@@ -141,6 +148,12 @@ Version 1 should be boring:
 - prompt or delegate separately for secret value entry;
 - record non-secret evidence in State Hub.
 
+When the schema adds or strengthens a required field, the same change must
+include a migration pass over every existing CCR. Active declarations must
+describe the live authentication path; incomplete requests must move to the
+explicit `in_flight` state rather than relying on a filename exception or a
+loosened repository-wide assertion.
+
 The first implemented CLI slice is:
 
 ```bash