diff --git a/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Replicator.Grpc/Protos/secrets_hub.proto b/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Replicator.Grpc/Protos/secrets_hub.proto
index 7d7f84b..6354c0c 100644
--- a/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Replicator.Grpc/Protos/secrets_hub.proto
+++ b/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Replicator.Grpc/Protos/secrets_hub.proto
@@ -4,6 +4,12 @@ package zb.mom.ww.secrets.hub.v1;
 
 option csharp_namespace = "ZB.MOM.WW.Secrets.Replicator.Grpc.V1";
 
+// Wire-compatibility policy: this contract evolves additively only. Never
+// renumber or repurpose an existing field number. When a field is removed, add
+// a `reserved` range (and `reserved` name) covering it in the same change so a
+// future editor cannot accidentally reuse the retired tag. There are no
+// `reserved` declarations today because no field has ever been removed.
+
 // The central-hosted secrets hub, as seen by a site node.
 //
 // PULL-ONLY BY CONSTRUCTION. This service mirrors exactly the read half of