10-stream review (3 Claude specialty + 5 pragma validators + codex + kimi-k3). Headline: rkey derivation switched to SHA-256/base32 digest — codex caught that the readable URI transform is non-total over the legal DID space (>512-byte DIDs, percent-escapes). Also: invalid fixtures now pin their failure reason (were vacuously green on ANY error incl. unresolvable $type); per-family fixture floor; shape-test parity (removal subject strongRef, reason maxGraphemes, full knownValues set, format pins); verification-boundary + moderator-restore + tombstone description language; validate-lexicon record detection now parses defs.main.type instead of a substring allowlist (coverage report was wrong in both directions); blob-conversion harness parity; 2 new fixtures (bad-DID, images embed). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>