§6.3 needs the same no-DENY hook exception that §6.5 has for postCompact #270

§6.3 says an Observed Agent that receives an invalid modifications object "MUST fail closed, treating the decision as DENY". That can't work at the five hooks where DENY isn't a legal disposition: postCompact, plus the four whose Decision line in hooks.md is "Audit only" or "Not decision-eligible" (lines 256, 298, 308 and 320).

§6.5 already has an exception for postCompact, where the Guardian returns ALLOW with an audit event for MODIFY-incapable clients. §6.3 has no matching exception, so an implementation has to pick something the spec doesn't say. The Go port in PR #169 (fee41d41) answers ALLOW plus an audit event at all five hooks, which seems like the right reading, but right now its §6.3 conformance row claims "Met" for behavior the text doesn't allow.

Suggested change: add one sentence to §6.3. "At a hook whose Decision line does not permit DENY, the Observed Agent MUST instead proceed with the original content and MUST record the same audit event." Then link it from the postCompact Decision line, next to the existing §6.5 reference.