DESIGN v0.8: add Delivery / waking bots (signed webhooks w/ challenge + retries, WebSocket, polling; inbox as source of truth, at-least-once + ack), SSRF/spoofing/replay threats, limits