docs: correct the Accept header and the dependency claim

The spec named a strict Accept: application/rdap+json while the plan, and
so the code, sends application/rdap+json with application/json at q=0.9.
A spec review caught the disagreement. The wider header is the right
behaviour, since some registries serve plain application/json and a
strict header would lose a contact that was published, so the spec moves
to match the code and now records why.

Both documents also claimed requirements.txt stays empty. There is no
requirements.txt in this repository and there never has been, so the
claim was true only vacuously. They now say the tool declares no
dependencies, which is the thing actually being promised.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wrfqr2xqQfhtXCscU7zrdz

2 files changed, 11 insertions, 6 deletions

diff --git a/docs/plans/2026-09-09-contacts.md b/docs/plans/2026-09-09-contacts.md
index 244fdce..d6bb54d 100644
--- a/docs/plans/2026-09-09-contacts.md
+++ b/docs/plans/2026-09-09-contacts.md
@@ -6,7 +6,7 @@
 
 **Architecture:** Two modules. `rdap.py` is the protocol (IANA bootstrap fetch and cache, server selection, query, jCard extraction). `contacts.py` is the policy (which indicators resolve, how hosts fold, what reaches the manifest). Both take a `fetch` callable as an argument, defaulting to a real urllib transport, so the entire test suite keeps passing with sockets raising.
 
-**Tech Stack:** Python 3.11+ standard library only. `urllib.request`, `ipaddress`, `json`, `email.utils`. No new dependencies; `requirements.txt` stays empty.
+**Tech Stack:** Python 3.11+ standard library only. `urllib.request`, `ipaddress`, `json`, `email.utils`. No new dependencies, and no dependency file in the repository.
 
 **Read first:** `docs/specs/2026-09-09-contacts.md`. It states a FOURTH non-negotiable property, that a query carries a bare host or IP and never a URL, and every task below that touches a query exists to hold that property.
 
diff --git a/docs/specs/2026-09-09-contacts.md b/docs/specs/2026-09-09-contacts.md
index faeef58..c751bcb 100644
--- a/docs/specs/2026-09-09-contacts.md
+++ b/docs/specs/2026-09-09-contacts.md
@@ -148,9 +148,14 @@ successful query plus a few cheap misses.
 
 ### Transport
 
-`urllib.request` from the standard library. `requirements.txt` stays empty.
-
-- `Accept: application/rdap+json`
+`urllib.request` from the standard library. The tool still declares no
+dependencies, and there is no `requirements.txt` in the repository to add one
+to.
+
+- `Accept: application/rdap+json, application/json;q=0.9`. The weaker
+  alternative is offered because some registries serve plain
+  `application/json`, and a strict header would lose a contact that was
+  published.
 - **timeout mandatory**, 10 seconds. `urllib` with no timeout blocks forever,
   and a hung registry would hang a review.
 - **redirects capped at 5 hops.** RIRs redirect to each other and the default
@@ -165,8 +170,8 @@ directing our next move.
 so packaging was not the deciding factor. It simply buys little here: the two
 things this module needs beyond a plain GET are the redirect cap and the
 downgrade refusal, and neither is a knob on `requests` either, both needing a
-`Session` plus custom wiring of comparable size. An empty `requirements.txt`
-means the tool runs and tests with no venv step at all.
+`Session` plus custom wiring of comparable size. Declaring no dependencies at
+all means the tool runs and tests with no venv step.
 
 ### Caching policy