11 new reds; T0 and T1 otherwise clean, mechanical gates green. P7 (contract change, authorized) — TestDecider_FallsToTheStricterClass... replaced by a two-halves pin. The engine now must DEFER on an IsAggregator failure: it stamps the verdict into the admission row with redrivable=false, so a downgrade there is a permanent unretryable refusal for a reason that was never true. The write path keeps the stricter-class fallback, pinned beside it against the composition — CreatePost answers a live client who can retry, and nothing is written down. The comment states that asymmetry as the rule. P1 — jetstream gains a PDS floor (one line, harness_test.go) so the positive case runs against a real repo's real CAR; a hand-built fixture would encode guesses about the verification's internals. Three cases: the endpoint must be sync.getRecord, a PDS echoing the pinned CID over substituted content must be refused (RED — believed today), and the honest recomputation must still converge (green, the positive control). P5 — quota over the real admissions table, counting accepted+pending for (author, community). The ledger cannot serve this: post_submissions is written by CreatePost, so a firehose author has no row and never will — counting it would limit local users and exempt the remote ones §8 is about. New AdmissionRepository.CountRecentAdmissions (stubbed). P6 — no schema change. Over-fetch past a backed-off prefix (RED: a stuck community at the head of the backlog starves everything behind it), plus pruning deferrals for subjects that leave the backlog, via a new QueueSnapshot.DeferredSubjects. P11 — seam added as confirmed: ssrfSafeTransport grows a lookupIP field so a test can make the second resolution disagree with the first. RED with the real diagnosis in the output: the base transport re-resolved the hostname independently. The private-answer guard is pinned separately so closing the window cannot widen what passes through it. P12 — 60/min own limiter declared in the routes table; 2048-byte DID accepted, malformed still 400, Cache-Control: no-store. Guards passing deliberately: the write-path stricter-class half, the direct-fetch positive control, the quota's window-roll / refusals-are-free / trusted-exempt cases, and the SSRF private-answer refusal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>