···6363- `com.atproto.sync.getBlob` should ship the same download-hardening headers as the reference PDS (`X-Content-Type-Options`, `Content-Disposition`, `Content-Security-Policy`).
6464- `com.atproto.sync.getBlob` should not add an extra `Cross-Origin-Resource-Policy` header beyond the reference PDS surface; the executable differential now pins the exact hardening-header set instead of a stricter local variant.
6565- `com.atproto.sync.listReposByCollection` is present in the published lexicon but not exposed by the current official runtime, so it remains locally regression-tested rather than executable-reference-differenced.
6666+- `com.atproto.repo.applyWrites` now has executable-reference happy-path coverage, but the official runtime still returns a `500 InternalServerError` when a delete write targets a missing record. Perlsky intentionally keeps the cleaner `400 InvalidRequest` there and documents the difference instead of copying the upstream quirk.
66676768## Known Intentional Divergences
6869