M0 and M3 are done. A throwaway authority at did:web:lexicon-poc.jarrett.app served four lexicons across two authority domains from a Cloudflare Worker and was verified four independent ways against one record CID: corpora verify, goat, @atproto/lexicon-resolver with nothing injected, and a third-party browser tool. The container image was built and run too. The largest correction is to M0's own caveat. It said the cold OAuth path could not be tested from outside, because you cannot flush other people's Auth Server caches. You do not need to: a brand-new NSID has never been resolved by anybody, so its first request is the cold path by construction. A pushed authorization request is the whole test, and the two control scopes naming lexicons that do not exist came back invalid_scope — which is what makes the 201 mean something rather than being a rubber stamp. Claims promoted from reported to verified: the OAuth path calls only sync.getRecord and never repo.getRecord; redirect: 'error' on did.json; the DID document id check. One report refuted outright: there is no content-type check on did.json anywhere in the atproto stack. One rule added that no document stated: did:web must be a bare hostname, and a port is allowed only for localhost — where @atproto/identity and goat disagree in the dangerous direction. M5's blockers are now listed explicitly: the missing cutover mode for the build's DNS check, the sailor.webhook deletion, and the fact that Corpora is not on npm, which leaves the container and standalone templates uninstallable for anyone but us. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>