- docker-compose.prod.yml: AP_USER_ORIGIN loses its default and becomes ${AP_USER_ORIGIN:?...} — the fail-closed boot contract DEPLOY §1 documents is now enforced at compose-interpolation time instead of being silently defaulted away; §1 rewritten to match. - DEPLOY §7 + README support matrix: the Lemmy pin discrepancy this branch already resolved (Dockerfile bumped to 0.19.20 in a7b0516) is no longer described as unresolved; both now state 0.19.20 matching decision 19. - README OUTBOUND_DRY_RUN row: parks are attempt-neutral and resume on their own, so the pre-fix "keep it to seconds, then redrive" advice (a no-op at best, a fleet-wide poisoned replay at worst) is replaced with the real cost model. - DEPLOY Caddy apex split: inverted so explicit text/html routes to the AppView and everything else — including a request with NO Accept header — falls through to Tidepool, satisfying instance.go's stated requirement that absent-Accept peers still get the instance actor; a no-Accept curl added to the verification steps. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>