[ancongui]

An unexpired locally verified JWT can outlive the current provider account or session state. Add an explicit LIVE admission mode that performs an uncached current-state check after the existing local JWT verification, binds issuer, subject, client, audience and expiration, and preserves the original verified Jwt. Unsupported, empty, malformed, timed-out or failed checks refuse without stale/local fallback. LOCAL_JWT remains the default, and existing SPI implementations refuse the new method until they support it deliberately.

Use native Spring introspection, owned JDK HTTPS transport and bounded Jackson/Spring codecs. The managed Jackson dependency has no version override. BearerToken diagnostic rendering becomes constant redaction while retaining its published final modifier. Existing default-chain APIs remain available; custom security chains must explicitly adopt the decoder decorator. The operating guide explains configuration and deployment verification.

Validation:

• Fresh isolated hosted source qualification passed 176 maintained tests and the same 176 from a reconstructed source archive, including all 41 new methods. No test/container failures, skips or aborts.
• The genuine nonfinal predecessor and published privacy baseline failed their intended regression assertions. Strict class-byte parity and modifier-aware retention of 55 public classes and 281 descriptors passed; result/completion hashes and owned child shutdown were verified separately.
• Public full-reactor and CodeQL checks are required on this PR. Provider disable/logout/account-block semantics, physical network termination and consuming-service adoption remain separate gates.

No root/parent/BOM version, generated SDK, or Cache PR47 source changes. Published 26.10.23 is unchanged; this addition requires a future qualified whole-framework release.