GTR007 — UpdateProfile: declare the newest valid profile

Contract: structural-only (the upgrade contract’s pivot point).

The transform

Set the root profile= to newest_valid_profile — add it when absent, bump an older literal, or rewrite an inline @TOKEN@’s value in the tool’s own <macros> (keeping profile="@TOKEN@"). An optional ceiling caps the declared value (the behaviour gate’s boundary, behavior-gate); bump-up-only still holds, so a declaration already above the ceiling is never lowered.

Proof

• Validity at the declared profile is established by construction: the value is the newest vendored XSD the tool satisfies (newest_valid_profile).

• The inline-token rewrite preserves the declaration shape; a token defined in an imported macro file is left to the consensus phase (the every-importer-agrees gate, registry D5) — never edited per-tool.

• Runtime behaviour changes from crossing profile boundaries are the point of upgrade, surfaced via behavior_preserving + the §23 per-tool warnings; the validity-vs-behaviour boundary is the audited soundness boundary (codemod §22/§25, docs/profile_upgrades.md).