Hold one non-cloneable linked owner for the daemon lifetime and route registration, ingest, day listing, events, and status through a cloneable least-authority PrivateLinkCapability. Configured origins, config.json bearer authority, and the localhost:5015 fallback are no longer production paths, while capture continues independently of link state. Close the three foundation rollovers first: accept only the exact bounded pair-link grammar, serialize carrier admission behind a persistence-failure latch, and replace the generic method/path request surface with typed capability operations. The admission guard encloses every synchronous token persist hook because the pinned transport has exactly one refresh path, inside dial_carrier_over_relay and reachable only through TransportClient::dial_carrier; it has no refresh timer, background task, or stream-open refresh. This closes the race declared by 69d6707 without changing the pinned revision. Never clear registered authority. Publish a generation-stamped auth epoch only after observer.json and the authority-free canonical-stream config are durable. Inject headers as a pure function of the current epoch and the owner-only x-solstone-linux-registration-route marker; accept exactly one marker with value 1, strip it before forwarding, and reject malformed or duplicate forms locally. The marker is necessary because the pinned CarrierOpener::proxy_headers sees filtered headers rather than method or path. Commit observer.json first, then the authority-free config, then the epoch. Treat persisted stream or observer mismatches as unregistered on restart and re-register without rollback, deletion, or manual cleanup. Sanitize config authority durably through private-file guarantees on every start rather than as a one-time migration. Raise the body ceiling to 64 MiB and apply route-specific timeouts. Reject declared over-limit bodies locally with 413 and unknown-length bodies at the head with 400 before carrier admission. Run the observer contract gate over the linked peer without changing its vendored bundle, manifest digest, Makefile target, or single-test inventory. Leave legacy authority definitions unreachable under L3-CLEANUP(spl-cutover), with chat_bridge.rs compiled and dormant on its existing direct HTTP. The 127.0.0.1:5015 zero-connection check remains opportunistic and announces when it cannot bind instead of silently passing. linked_authority_policy_tests carries the structural proof that no active production path constructs that fallback. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>