The inbox accepts any HTTP-signed delivery. A bare (un-announced) Create or Update whose sender-chosen audience named a followed community was materialized: the author got a minted DID and repo, and for a postv2 the bridge wrote the community's acceptance record on its behalf. Any host (unlimited hosts with wildcard DNS) could inject posts and comments into a bridged Coves community that the real Lemmy community never saw, and mint unlimited bridged identities. A bare Undo{Delete} of mapped content could likewise re-fetch and re-materialize whatever its origin served, with no community binding. Lemmy always fans community content out through the community's Announce, including its direct copy of a reply to the parent's author, so content is now materialized only from that Announce. PieFed and Mbin are assumed to follow the same FEP-1b12 fan-out. Changes: - handleBareCreateUpdate drops any object not typed Person/Group (including untyped references) as a processed skip before any fetch, tombstone lookup or mint. Bare Create/Update of a Person/Group goes straight to the refresh-only applyProfileUpdate. - handleUndoDelete drops a bare Undo{Delete} of a mapped post or comment (soft-deleted or live) before the fetch; announced restores, bare undos of unmapped ids (marker retraction only) and actor undos are unchanged. - New expvar tidepool_content_bare_dropped, incremented on both drop paths, with an Info log carrying signer, object id and type, and the delivered audience (never fetched). - materializeContent is reached only from the Announce path: its bare branch (audience-derived follow check, deferred community-scoped tombstone recheck) is deleted, its announcer parameter is removed (it always equalled signer), and the dead announcer == "" delegation tail is gone. - Delegation tests now assert a bare Create never materializes or counts, and that the announced delivery does. - TestBareContentDeliveryIsNeverMaterialized (bare post, bare reply to a persona inbox later announced, audience-less reply, bare edit) and TestBareUndoDeleteNeverRematerializesContent (soft-deleted post and comment, live post) assert no mapping, record, acceptance, mint or fetch, and the drop counter. - Two restore tests that drove the bare path now use announced restores; the persona-inbox tests use the shared deliverToUserInbox helper. - README trust paragraph and /ap/inbox row, FOLLOWUPS.md legacy origin check entry, and stale comments updated. Closes 2026-10-03-tidepool-unannounced-creates-reach-coves. Follow-ups filed: 2026-10-03-tidepool-announced-comment-parent-not-community-bound, 2026-10-03-tidepool-isbridged-accepts-content-ids, 2026-10-03-tidepool-backfill-not-community-bound. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>