[dzikowski]

• NFT vesting lock. A lock with a vesting start releases the locked tokens when that time arrives. Fungible locks already did this. An NFT stayed locked, because the instance lock check ignored the vesting start. The check now treats a vesting hold as released from its vesting start.
• Mint fulfillment key. owner is now part of the TokenMintFulfillment key. Mints to different owners in one transaction write separate records, each readable by its own key, and the raw putState workaround is gone. Two mints to the same owner still add up into one record. No code reads fulfillments other than this write path. For a second owner, the new key matches the key the workaround used.
• Network root and .dockerignore. network-up rejects a network root inside a chaincode directory unless that directory's .dockerignore lists it, so network crypto material does not reach the chaincode image build. The template already lists test-network. The fabloRoot flag description and the README now state the actual rule.