Name the project-scoped fields that drifted from their binding.
The refusal these feed is safe either way, but it is not diagnosable without the field names: the resolution reads the extension trust store on every call, so a transient read failure reports as a policy change. These values are paths and booleans, never secrets, so naming them is safe.
