- Facts table: image pin, COOKIE_DOMAIN, persistent ED25519 key via host env file; restarts no longer invalidate solved challenges. - Gotcha 8: X-Real-Ip mandatory at v1.27+ (500 without; chain sets it). - Gotcha 9: DENY renders error-styled page at HTTP 200 — probe bodies, not statuses. - Verify live: probe www (apex 308s), version-marker grep, body-based deny check. All commands executed live before commit.