Take one (#90) died on two real edge bugs, both fixed and pinned by tests in mesh-controller (#66: autocert 404s unknown tokens itself; #67: the internal authority 403s every public name before the token lookup). The challenge path verified end to end reaching mailu's own nginx before this flip.