Chunk-2 findings 1, 3, 4, 5 from the second-opinion re-review — the irreversible-identity traps in the AP identity surface. - One normalizer (2.1): CanonicalizeOrigin now reduces the authority through normalizeHost — the same rule the Host router applies to every request — and asserts the round-trip so a future divergence fails at boot instead of minting an unroutable namespace. Before, an origin spelled http://host:443 minted normalized_origin "host:443" that the routed Host, folded to "host", could never match under any spelling, permanently (actor_id is frozen at mint). Widened toward the router's unconditional fold because the router cannot learn the scheme (TLS terminates at the proxy). No-op for portless https origins and the dev default, pinned by test; the echo mirror's byte-identity is pinned by a cross-package matrix test. - Fail-closed everywhere (2.3): one servedActor gate fronts the actor document, the outbox, and WebFinger — the latter two previously served a corrupt or foreign-authority actor_id with a 200, handing every remote resolver a cached alias that dereferences into a permanent 500. actorOrigin also refuses an actor_id whose authority differs from the stored normalized_origin. - The DID is validated before it freezes (2.4): syntax.ParseDID at the top of CreateActorForDID, before keygen — a DID containing "/" or a percent-encoded did:web previously minted a permanently unservable actor. - The shadow check canonicalizes both sides (2.5): BRIDGE_HOSTNAME is reduced with the router's own rule before comparing, so the spellings the check's own comment names (https://TDPL.IO:443) and the composed-mode trap (tdpl.io:443 vs https://tdpl.io) are refused at boot instead of silently fronting the bridge's write surface with a 404 fallback in production. Repro tests: the 6×5 origin/Host spelling matrix, the three-surface corrupt-row matrix, the unservable-DID set, and the seven-case shadow matrix — all red before the fix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>