Wires the fediverse to the materializer: a signed /inbox that verifies HTTP signatures and binds the signer to the activity actor, a durable postgres work queue (per-community serial ordering, exponential-backoff retry, poison handling, lease fencing) over inbox_events, FEP-1b12 Announce unwrapping and activity dispatch, the Follow/Accept community-subscription lifecycle behind a bearer-auth admin API, resumable outbox backfill, and #nobridge/#nobot consent handling. Adds the VoteAggregator seam (no-op) for task 07. Migration 009 adds the queue columns + ap_tombstones; store gains the fenced queue API, Tombstones, and APObjects.Restore. The verifier's fresh-key refetch is now cache-gated. Reviewed by 8 reviewers (5 Claude specialty agents + Codex gpt-5.5 + Gemini 3.1 Pro; GLM produced no report). Fixes applied from the review: Authorization (flagged by up to 5 reviewers): - Announced Delete/Undo now require SameAuthority(target, announcer); an actor (terminal DeleteActor) target additionally requires target==announcer, so a followed community can no longer tombstone unrelated instances' content or co-hosted actors. - Bare Update{Person|Group} is refresh-only and never mints/bridges an unknown actor (closed an SSRF + PLC-mint-budget exhaustion vector). - Announced content must name the announcing community (no bridging a non-subscribed same-host community). Correctness: - Queue lease fencing token (claimed_until) on MarkProcessed/Release/ MarkPoisoned so a lease-overrun worker can't clobber a re-claim — required before task 07's non-idempotent vote counting. - Shutdown cancellation no longer classified as processing failure; outcome writes use context.WithoutCancel. processed/poisoned made mutually exclusive. - Undo{Delete} compensates (re-soft-delete + re-tombstone) if re-materialize skips, preventing a live-mapping-without-record. - handleAccept only transitions pending→accepted (a late Accept can't re- subscribe an unfollowed community). - backfillReplies checks tombstones; truncated/failed backfill leaves last_backfill_at unset so it resumes; activityID propagates crypto/rand failure instead of emitting a zero-entropy id; backfill drained on shutdown. 14 regression tests added. go build/vet/test ./... green against real postgres. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>