currenlty text says "A server SHOULD set a Content-Profile header in HTTP response to the profile
identifier (URI) that the Client requested, not the identifier of any narrower profile that is also applicable identifier (URI) that the Client requested, not the identifier of any narrower profile that is also applicable
since the client might not understand the narrower profile identifier. since the client might not understand the narrower profile identifier."

however after 303 the server doesnt necessarily know what was requested - and should not need to support negotiation. I think the final resource server MAY return either the most specific profiles or the profiles requested by the client or both. The redirection server MUST indicate the profile requested by the client and SHOULD indicate the expected narrower profile to be returned in the redirection request (303 response).

This puts the onus on clients to collate information via the full HTTP information set if they ask for complex negotiation scenarios. This is OK IMHO as if they ask for a single profile they should be able to just trust the response matches.