Criticals (pinned test-first): one shared origin canonicalizer (path/userinfo/query rejected; :443/:80 + trailing dot stripped; https required in prod; shadow check on canonical forms — closes the tdpl.io:443 bypass and the :443 webfinger-404s-forever hazard); actor docs/outboxes bound to their own origin (cross-DID URL-spelling webfinger pinned at both defense layers); public-IP Hosts 421 in prod (loopback-only service carve-out); Recoverer/RequestID wrap the host router. Hardening: personas logging threaded (500s, sampled 421s, exhaustion); malformed stored actor_id fails closed; ErrLocalPartExhausted sentinel (not IsAlreadyExists); truncation trims trailing separators; suffix normalization; nodeinfo identity hoisted to one shared constant; staged-contract label on federation.json; doc corrections. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>