Red-first: fingerprint normalized (unresolved-identifier hash let handle-vs-DID resubmission bypass dedupe; ThumbnailURL now hashed); reservation release decoupled from the dying request context (WithoutCancel — leaks correlated with exactly the failures that trigger release); admission wiring fail-loud (silent null-object defaults deleted; shame-named test-only allow-all); ActorClass fail-closed; aggregator infra-errors no longer minted as authz refusals; double-tap raced under -race; T2 wire probe pins DualAuth + admission routing + refusal-consumes-no-quota + reserve-release through the production-constructed service. Honesty pass: bucket boundary, leaked reservations, unbounded ledger documented. PRD rev 2.6. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>