update

docs/client-api.md

@@ -43,6 +43,10 @@ Successful response:
 The first exchange enrolls that host against the authorization. Reusing the
 same code and host fingerprint does not consume another host slot. A different
 fingerprint consumes one slot until the configured limit is reached.
+Package authorizations grant access by stable package slug. The version,
+filename, and checksum in a response are resolved from the current package
+catalog when the code is exchanged; replacing a package does not require a new
+authorization code.
 When `requested_action` or `requested_package` is present, the broker validates
 that entitlement before enrolling the host. Older clients may omit both fields,
 but current clients should always identify what they intend to use.