Without --server-did, a PDS configured with only --public-url advertised did:web:localhost and rejected service-auth whose aud was its real DID. Derive did:web:<host> (port as %3A) like the reference PDS (PDS_SERVICE_DID ?? did:web:${hostname}) and tranquil; explicit wins. Collapse fourteen clock_gettime helpers into core/clock.zig on Io.Timestamp. On 32-bit targets timespec.sec is 32-bit, so each copy was Y2038-bound; the i96 nanosecond timestamp is not. Document 32-bit builds and link the Pi 1 recipe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>