Cover floor 2 in proxy token state table and rewrap proxy README

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: Brooooooklyn

platform/packages/api/test/unit/proxy-token.test.ts

@@ -160,6 +160,7 @@ describe('state table', () => {
     { raw: null, accepted: [0, 1, 5], rejected: [], send: [0], issue: 0 },
     { raw: '{"gen":0}', accepted: [0, 1, 5], rejected: [], send: [0], issue: 0 },
     { raw: '{"gen":1}', accepted: [1, 2], rejected: [0], send: [1, 0], issue: 1 },
+    { raw: '{"gen":2}', accepted: [2, 3], rejected: [0, 1], send: [2, 1], issue: 2 },
     { raw: '{"gen":3}', accepted: [3, 4], rejected: [0, 1, 2], send: [3, 2], issue: 3 },
   ])('floor $raw', async ({ raw, accepted, rejected, send, issue }) => {
     const { routing } = kvStub(raw === null ? {} : { [proxyTokenStateKey(PROJECT)]: raw });

platform/packages/proxy/README.md

@@ -57,9 +57,10 @@ The ROUTING key `proxy-token:{projectId}` holds the project's accept floor,
 least `N`. A missing key means floor 0, so the legacy token is accepted. The
 `projectId` must be a generated project id, and the MAC is checked before the
 floor is read, so an invalid token never reads KV. A floor that cannot be read
-or does not parse fails closed with 503 `project token state unavailable`. Each isolate caches a floor for 15 seconds
-and reads KV with `cacheTtl: 30`, so with KV propagation a raised floor rejects
-older tokens everywhere within about 105 seconds.
+or does not parse fails closed with 503 `project token state unavailable`. Each
+isolate caches a floor for 15 seconds and reads KV with `cacheTtl: 30`, so with
+KV propagation a raised floor rejects older tokens everywhere within about 105
+seconds.
 
 Service-binding auth and `/email/verify-receipt` use this check. `/revalidate`
 forwards the token, and the API checks it against the same floor.