- hmac_sign now takes method+path instead of device_id; builds message as method\npath\ntimestamp\nhex(sha256(body)) per server verify_device_hmac - reporter: header renamed X-HMAC-Signature → X-Signature; passes "POST"+path - test vector regenerated against new message format; timestamp-diff test updated - .size() → .length() throughout (Arduino String has no size()) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>