Document proxy resource release gate

Record the missing tagged proxy rename surface and the write-only password/import design required before Terraform can safely manage proxies.

Author: IlyaasK

docs/architecture.md

@@ -66,7 +66,7 @@ Core v1 data sources:
 
 Late or conditional v1 work:
 
-- `kernel_proxy` resource, after write-only credential and import semantics are accepted
+- `kernel_proxy` resource, after write-only credential/import semantics are accepted and a tagged SDK exposes in-place rename
 - masked `kernel_api_key` metadata lookup
 - `kernel_api_key` resource, only after plaintext-once, retry, rotation, import, and provider self-use semantics are accepted
 - project limits, only after their lifecycle is clearly separate from basic project management

docs/concerns.md

@@ -55,6 +55,33 @@ Until that tag exists, `kernel_profile` resource implementation remains
 blocked. Create/read/delete/import alone would make ordinary rename replace a
 profile even though Kernel supports preserving its identity.
 
+### Proxy Rename And Credential Release Gate
+
+The Kernel API supports in-place proxy rename through
+`PATCH /proxies/{id}`, but the latest tagged Go SDK, v0.76.0, exposes no proxy
+update method or update params. The generated surface is present in
+[`kernel-go-sdk` PR #133](https://github.com/kernel/kernel-go-sdk/pull/133),
+which is the pending v0.77.0 release.
+
+Provider stance:
+
+- wait for a tagged SDK release containing `Proxies.Update`;
+- model `name` as the only in-place update and replace other durable proxy
+  configuration because the API exposes no other mutation;
+- do not pin an SDK branch, patch generated SDK code, or add fallback HTTP;
+- keep proxy health status, last-check time, and exit IP out of desired state.
+
+Custom proxy passwords need a separate accepted Terraform state design before
+the resource is implemented. Reads expose only `has_password`, never the
+password. The preferred design is a sensitive write-only password plus an
+explicit version/keeper field to request replacement when the secret changes.
+Import can recover metadata only. Storing plaintext in ordinary Terraform state
+or pretending an imported secret can be read back is not acceptable.
+
+Until the tagged update surface and password design are both available,
+`kernel_proxy` remains a v1 late/conditional resource. The existing masked
+metadata data source remains supported.
+
 ### Browser Pool Selector Echoes
 
 Resolved upstream. Browser pool responses now include authoritative top-level