# GTR007 — UpdateProfile: declare the newest valid profile

**Contract:** structural-only (the `upgrade` contract's pivot point).

## The transform
Set the root `profile=` to `newest_valid_profile` — add it when absent, bump an
older literal, or rewrite an **inline** `@TOKEN@`'s value in the tool's own
`<macros>` (keeping `profile="@TOKEN@"`). An optional `ceiling` caps the
declared value (the behaviour gate's boundary, [behavior-gate](behavior-gate.md));
bump-up-only still holds, so a declaration already above the ceiling is never
lowered.

## Proof
- Validity at the declared profile is established by construction: the value
  *is* the newest vendored XSD the tool satisfies (`newest_valid_profile`).
- The inline-token rewrite preserves the declaration shape; a token defined in
  an **imported** macro file is left to the consensus phase (the
  every-importer-agrees gate, registry D5) — never edited per-tool.
- Runtime behaviour changes from crossing profile boundaries are the point of
  `upgrade`, surfaced via `behavior_preserving` + the §23 per-tool warnings;
  the validity-vs-behaviour boundary is the audited soundness boundary
  (codemod §22/§25, `docs/profile_upgrades.md`).