diff --git a/packages/core/src/cache/schema.ts b/packages/core/src/cache/schema.ts
index 47292a9..37b2e73 100644
--- a/packages/core/src/cache/schema.ts
+++ b/packages/core/src/cache/schema.ts
@@ -60,10 +60,18 @@ export type ReviewRow = {
   eventId: string;
   createdAt: number;
   /**
-   * Pointer-kind tag: 38172 (Cashu) or 38173 (Fedimint). Optional because
-   * in-the-wild events sometimes omit the `k` tag entirely; keep lenient.
+   * Pointer-kind tag: 38172 (Cashu) or 38173 (Fedimint). Required per
+   * NIP-87 (P0.3 — `parseReview` rejects events without it). Typed
+   * required at the cache layer so consumers don't have to handle the
+   * undefined case any more.
    */
-  k?: 38172 | 38173;
+  k: 38172 | 38173;
+  /**
+   * Spec-blessed target pointer: `<kind>:<pubkey>:<d>` per NIP-87. The
+   * authoritative dedup key when a single mint is referenced from multiple
+   * announcements (P1). Required on parse — see `parseReview`.
+   */
+  a: string;
   /**
    * Mint URL(s) from optional `u` tags on the recommendation — display-only
    * helper, does NOT participate in replaceable-event keying.
diff --git a/packages/core/src/cache/upsert.test.ts b/packages/core/src/cache/upsert.test.ts
index ecb0115..6723f9a 100644
--- a/packages/core/src/cache/upsert.test.ts
+++ b/packages/core/src/cache/upsert.test.ts
@@ -62,13 +62,20 @@ function makeAnnouncement(over: Partial<AnnouncementRow> = {}): AnnouncementRow
 }
 
 function makeReview(over: Partial<ReviewRow> = {}): ReviewRow {
+  // Default to a 64-char hex reviewer pubkey so the synthetic `a` tag below
+  // satisfies the parse-layer's hex-pubkey check (mirrors what real
+  // upstream-of-cache flows produce).
+  const reviewer = `${"f".repeat(60)}2222`;
+  const d = over.d ?? D_XONLY;
+  const k = (over.k ?? 38172) as 38172 | 38173;
   return {
-    pubkey: `pk-${"0".repeat(60)}2222`,
+    pubkey: reviewer,
     kind: 38000,
-    d: D_XONLY,
+    d,
     eventId: EID_LOW,
     createdAt: 1_700_000_000,
-    k: 38172,
+    k,
+    a: `${k}:${reviewer}:${d}`,
     rating: 5,
     content: "[5/5] good mint",
     rawTags: [],
diff --git a/packages/core/src/cache/upsert.ts b/packages/core/src/cache/upsert.ts
index ff50a2e..f5e20bc 100644
--- a/packages/core/src/cache/upsert.ts
+++ b/packages/core/src/cache/upsert.ts
@@ -98,18 +98,12 @@ export async function upsertAnnouncement(
 /**
  * Upsert a kind:38000 review with Layer A gating on the target `d` tag.
  *
- * The review's `d` points at a mint. When `k === 38172` (or `k` is absent,
- * which is how most in-the-wild Cashu reviews shape), we apply the same
- * Layer A d-regex gate that `upsertAnnouncement` uses — if the referenced
- * mint pubkey isn't 64/66-char hex, the review is bot-spam pointing at
- * bot-spam, returned as `rejected-invalid`. This is the firewall that
- * keeps the 959 zero-d-tag bot spam events (per relay-strategy §4) from
- * filtering up into the ranking aggregate.
- *
- * `k === 38173` (Fedimint) switches to the sibling `isValidFedimintDTag`
- * shape gate — every real federation ID in the audit corpus is lowercase
- * 64-char hex, so a short / junk d-tag with `k=38173` attached is still
- * bot spam and must be caught by the same firewall.
+ * The review's `d` points at a mint. The pointer-kind `k` selects which
+ * shape gate applies: `k === 38173` uses `isValidFedimintDTag`, else
+ * `isValidCashuDTag`. P0.3: `parseReview` rejects events without a valid
+ * `k` tag at parse, so by the time a row reaches this function, `k` is
+ * always set (38172 or 38173). The previous fallback ("no k → default to
+ * Cashu") silently misrouted Fedimint reviews and let bot spam through.
  *
  * Note: this low-level upsert is the mechanical write. It does NOT
  * materialize the `mintAggregate` row — the `reviews/` wrapper composes
@@ -120,11 +114,8 @@ export async function upsertAnnouncement(
  */
 export async function upsertReview(db: BitcoinmintsDB, row: ReviewRow): Promise<UpsertResult> {
   // Layer A gate — reject invalid d-tag shapes before touching the DB.
-  // Reviews point at a target mint via `d`; the pointer-kind `k` selects
-  // which shape gate applies. No `k` tag → treat as Cashu (the default
-  // for in-the-wild events per rating-tag-research §3). Fedimint rows
-  // still get a sibling shape check (64-char hex federation id) so junk
-  // d-tags with `k=38173` slapped on don't free-pass the firewall.
+  // P0.3: `k` is required at parse time, so we route purely on its value;
+  // no implicit Cashu default for missing k.
   if (row.k === 38173) {
     if (!isValidFedimintDTag(row.d)) return "rejected-invalid";
   } else if (!isValidCashuDTag(row.d)) {
diff --git a/packages/core/src/cashu/info.test.ts b/packages/core/src/cashu/info.test.ts
index 62d1e26..3cf6326 100644
--- a/packages/core/src/cashu/info.test.ts
+++ b/packages/core/src/cashu/info.test.ts
@@ -142,20 +142,27 @@ describe("fetchMintInfo — failure modes", () => {
     expect(r.error).toBe("invalid JSON");
   });
 
-  it("returns 'missing pubkey field' when JSON parses but lacks pubkey", async () => {
+  it("P0.2: passes through with pubkey absent when JSON lacks pubkey (NUT-06 says optional)", async () => {
+    // NUT-06 §"info": pubkey is optional — Layer B falls through to
+    // `contact.[method=nostr]` for signer binding (P0.1). Don't hard-reject.
     fetchSpy.mockResolvedValueOnce(jsonResponse({ name: "no key here" }));
     const r = await fetchMintInfo("https://mint.example.com");
-    expect(r.ok).toBe(false);
-    if (r.ok) return;
-    expect(r.error).toBe("missing pubkey field");
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    expect(r.info.pubkey).toBeUndefined();
+    expect(r.info.name).toBe("no key here");
   });
 
-  it("returns 'missing pubkey field' when pubkey is empty string", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse({ pubkey: "" }));
+  it("P0.2: drops malformed pubkey (empty string) but keeps the response ok", async () => {
+    // Defensive: empty string isn't a valid pubkey — drop it so downstream
+    // signer-binding doesn't compare against `""` and accidentally match a
+    // signer with a similarly empty value.
+    fetchSpy.mockResolvedValueOnce(jsonResponse({ pubkey: "", name: "some mint" }));
     const r = await fetchMintInfo("https://mint.example.com");
-    expect(r.ok).toBe(false);
-    if (r.ok) return;
-    expect(r.error).toBe("missing pubkey field");
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    expect(r.info.pubkey).toBeUndefined();
+    expect(r.info.name).toBe("some mint");
   });
 });
 
diff --git a/packages/core/src/cashu/info.ts b/packages/core/src/cashu/info.ts
index 194837f..028d8f2 100644
--- a/packages/core/src/cashu/info.ts
+++ b/packages/core/src/cashu/info.ts
@@ -27,15 +27,24 @@
 /**
  * NUT-06 `/v1/info` response shape — the subset we care about.
  *
- * Cashu mints in the wild don't all set every field. We type optional
- * everything except `pubkey` (NUT-06 mandatory + this is what Layer B
- * compares against the announcement signer). `nuts` is a bag of
- * NUT-name -> capability shape; we under-spec it here and pass through
- * whatever shape the mint emits — see data-model-v1.md §7.
+ * Cashu mints in the wild don't all set every field. We type EVERYTHING
+ * optional including `pubkey`: NUT-06 explicitly says "(optional) pubkey
+ * is the hex pubkey of the mint", and the audit (P0.2) found the prior
+ * hard-reject on missing pubkey rejected spec-conforming pubkey-less
+ * mints. Layer B handles the absent-pubkey case via NUT-06 `contact`
+ * with `method=nostr` (P0.1), or surfaces `null` when neither source
+ * is available. `nuts` is a bag of NUT-name -> capability shape; we
+ * under-spec it here and pass through whatever shape the mint emits —
+ * see data-model-v1.md §7.
  */
 export type MintInfoV1 = {
-  /** Mint's compressed/x-only secp256k1 pubkey. NUT-06 mandatory. */
-  pubkey: string;
+  /**
+   * Mint's compressed/x-only secp256k1 pubkey. NUT-06 says optional —
+   * many real mints omit it and rely on `contact.[method=nostr]` for
+   * signer binding instead. Layer B (cashu/layerB.ts) handles both
+   * sources.
+   */
+  pubkey?: string;
   name?: string;
   version?: string;
   description?: string;
@@ -179,8 +188,15 @@ export async function fetchMintInfo(
   }
 
   const obj = body as Record<string, unknown>;
+  // P0.2: pubkey is OPTIONAL per NUT-06. Don't reject on absence; Layer B
+  // falls through to `contact.[method=nostr]` for signer binding when
+  // `pubkey` is missing (see cashu/layerB.ts). When pubkey IS present but
+  // not a non-empty string, drop it from the result so downstream code
+  // doesn't compare against a malformed value (defensive: an emitter that
+  // sends `pubkey: null` shouldn't be treated as "matches null").
   if (typeof obj.pubkey !== "string" || obj.pubkey.length === 0) {
-    return { ok: false, error: "missing pubkey field", status: response.status };
+    const { pubkey: _omitted, ...rest } = obj;
+    return { ok: true, info: rest as MintInfoV1 };
   }
 
   return { ok: true, info: obj as MintInfoV1 };
diff --git a/packages/core/src/cashu/layerB.test.ts b/packages/core/src/cashu/layerB.test.ts
index f93fd64..8f64c37 100644
--- a/packages/core/src/cashu/layerB.test.ts
+++ b/packages/core/src/cashu/layerB.test.ts
@@ -53,7 +53,7 @@ describe("verifySignerBinding — Cashu happy path", () => {
     });
     // First fetch returns mismatched pubkey, second returns the right one.
     const fetcher = okFetcher({
-      "https://mint-a.example.com": "02zzz",
+      "https://mint-a.example.com": "02deadbeef",
       "https://mint-b.example.com": "02abc",
     });
     const r = await verifySignerBinding(row, fetcher);
@@ -98,13 +98,13 @@ describe("verifySignerBinding — Cashu failure modes", () => {
       pubkey: "02abc",
       u: ["https://mint.example.com"],
     });
-    const fetcher = okFetcher({ "https://mint.example.com": "02zzz" });
+    const fetcher = okFetcher({ "https://mint.example.com": "02deadbeef" });
     const r = await verifySignerBinding(row, fetcher);
     expect(r.verified).toBe(false);
     if (r.verified) return;
     expect(r.reason).toContain("pubkey-mismatch");
-    expect(r.reason).toContain("02abc"); // announcement pubkey
-    expect(r.reason).toContain("02zzz"); // actual mint pubkey
+    expect(r.reason).toContain("02abc"); // event signer
+    expect(r.reason).toContain("02deadbeef"); // actual mint pubkey source (lowercase hex)
   });
 
   it("returns reason='all-fetches-failed' when every URL fails", async () => {
@@ -134,13 +134,13 @@ describe("verifySignerBinding — Cashu failure modes", () => {
       if (url.includes("broken")) {
         return { ok: false, error: "connect ETIMEDOUT" };
       }
-      return { ok: true, info: { pubkey: "02zzz" } };
+      return { ok: true, info: { pubkey: "02deadbeef" } };
     });
     const r = await verifySignerBinding(row, fetcher);
     expect(r.verified).toBe(false);
     if (r.verified) return;
     expect(r.reason).toContain("pubkey-mismatch");
-    expect(r.reason).toContain("02zzz");
+    expect(r.reason).toContain("02deadbeef");
   });
 
   it("returns reason='no-urls' when announcement.u is empty", async () => {
@@ -154,6 +154,30 @@ describe("verifySignerBinding — Cashu failure modes", () => {
     expect(r.reason).toBe("no-urls");
     expect(fetcher).not.toHaveBeenCalled();
   });
+
+  it("P0.1: ok response with NO pubkey AND NO contact.nostr returns 'no-signer-source'", async () => {
+    // The audit's `null` case: a /v1/info that responds successfully but
+    // exposes neither `pubkey` (P0.2 made that optional) nor a
+    // `contact.[method=nostr]` entry. Genuinely cannot verify — scheduler
+    // persists `null`, not `false`.
+    const row = makeRow({
+      pubkey: "02abc",
+      u: ["https://mint.example.com"],
+    });
+    const fetcher: MintInfoFetcher = vi.fn(
+      async (): Promise<MintInfoResult> => ({
+        ok: true,
+        info: {
+          name: "Pubkey-less mint",
+          contact: [{ method: "email", info: "ops@example.com" }],
+        },
+      }),
+    );
+    const r = await verifySignerBinding(row, fetcher);
+    expect(r.verified).toBe(false);
+    if (r.verified) return;
+    expect(r.reason).toBe("no-signer-source");
+  });
 });
 
 describe("verifySignerBinding — Fedimint rejection", () => {
@@ -174,6 +198,186 @@ describe("verifySignerBinding — Fedimint rejection", () => {
   });
 });
 
+describe("verifySignerBinding — P0.1 widened signer sources (contact.nostr)", () => {
+  // 64-char lowercase hex used both as the event signer and as the
+  // contact.nostr identity it should match against. Distinct from
+  // info.pubkey to prove that contact.nostr is independently sufficient.
+  const EVENT_SIGNER = "a".repeat(64);
+  const MINT_PUBKEY = "02".padEnd(66, "b");
+
+  it("verifies when contact.[method=nostr].info matches signer (hex form)", async () => {
+    const row = makeRow({
+      pubkey: EVENT_SIGNER,
+      d: MINT_PUBKEY,
+      u: ["https://mint.example.com"],
+    });
+    const fetcher: MintInfoFetcher = vi.fn(
+      async (): Promise<MintInfoResult> => ({
+        ok: true,
+        info: {
+          pubkey: MINT_PUBKEY, // does NOT match signer
+          contact: [
+            { method: "email", info: "ops@example.com" },
+            { method: "nostr", info: EVENT_SIGNER }, // matches via widened source
+          ],
+        },
+      }),
+    );
+    const r = await verifySignerBinding(row, fetcher);
+    expect(r.verified).toBe(true);
+  });
+
+  it("verifies when contact.nostr is an npub bech32 that decodes to signer", async () => {
+    const signerHex = "1".repeat(64);
+    // Pre-computed: nip19.npubEncode("1111111111111111111111111111111111111111111111111111111111111111")
+    const signerNpub = "npub1zyg3zyg3zyg3zyg3zyg3zyg3zyg3zyg3zyg3zyg3zyg3zyg3zygse4sl3h";
+    const row = makeRow({
+      pubkey: signerHex,
+      d: MINT_PUBKEY,
+      u: ["https://mint.example.com"],
+    });
+    const fetcher: MintInfoFetcher = vi.fn(
+      async (): Promise<MintInfoResult> => ({
+        ok: true,
+        info: {
+          // No mint pubkey — only contact.nostr (as npub) declares the signer.
+          contact: [{ method: "nostr", info: signerNpub }],
+        },
+      }),
+    );
+    const r = await verifySignerBinding(row, fetcher);
+    expect(r.verified).toBe(true);
+  });
+
+  it("verifies when info.pubkey is absent but contact.nostr matches signer", async () => {
+    // P0.1 + P0.2: pubkey-less mint that declares its nostr identity via
+    // contact only. Spec-conforming and previously rejected.
+    const row = makeRow({
+      pubkey: EVENT_SIGNER,
+      d: MINT_PUBKEY,
+      u: ["https://mint.example.com"],
+    });
+    const fetcher: MintInfoFetcher = vi.fn(
+      async (): Promise<MintInfoResult> => ({
+        ok: true,
+        info: {
+          // pubkey omitted entirely.
+          contact: [{ method: "nostr", info: EVENT_SIGNER }],
+        },
+      }),
+    );
+    const r = await verifySignerBinding(row, fetcher);
+    expect(r.verified).toBe(true);
+  });
+
+  it("mismatch when neither info.pubkey nor any contact.nostr matches signer", async () => {
+    const row = makeRow({
+      pubkey: EVENT_SIGNER,
+      d: MINT_PUBKEY,
+      u: ["https://mint.example.com"],
+    });
+    const otherSigner = "c".repeat(64);
+    const fetcher: MintInfoFetcher = vi.fn(
+      async (): Promise<MintInfoResult> => ({
+        ok: true,
+        info: {
+          pubkey: MINT_PUBKEY,
+          contact: [{ method: "nostr", info: otherSigner }],
+        },
+      }),
+    );
+    const r = await verifySignerBinding(row, fetcher);
+    expect(r.verified).toBe(false);
+    if (r.verified) return;
+    expect(r.reason).toContain("pubkey-mismatch");
+    expect(r.reason).toContain(EVENT_SIGNER);
+    expect(r.reason).toContain(otherSigner);
+  });
+
+  it("ignores non-nostr contact methods (email, twitter, etc.)", async () => {
+    const row = makeRow({
+      pubkey: EVENT_SIGNER,
+      d: MINT_PUBKEY,
+      u: ["https://mint.example.com"],
+    });
+    const fetcher: MintInfoFetcher = vi.fn(
+      async (): Promise<MintInfoResult> => ({
+        ok: true,
+        info: {
+          pubkey: MINT_PUBKEY, // doesn't match
+          contact: [
+            { method: "email", info: EVENT_SIGNER }, // looks-like-hex but wrong method
+            { method: "twitter", info: "@signer" },
+          ],
+        },
+      }),
+    );
+    const r = await verifySignerBinding(row, fetcher);
+    expect(r.verified).toBe(false);
+    if (r.verified) return;
+    // Only `info.pubkey` counts — and it didn't match. So pubkey-mismatch.
+    expect(r.reason).toContain("pubkey-mismatch");
+  });
+
+  it("malformed npub in contact.nostr is silently dropped (other contacts still considered)", async () => {
+    const row = makeRow({
+      pubkey: EVENT_SIGNER,
+      d: MINT_PUBKEY,
+      u: ["https://mint.example.com"],
+    });
+    const fetcher: MintInfoFetcher = vi.fn(
+      async (): Promise<MintInfoResult> => ({
+        ok: true,
+        info: {
+          // First contact is a malformed npub (bad checksum), second is the
+          // hex form that matches. The malformed entry must NOT throw.
+          contact: [
+            { method: "nostr", info: "npub1notavalidbech32" },
+            { method: "nostr", info: EVENT_SIGNER },
+          ],
+        },
+      }),
+    );
+    const r = await verifySignerBinding(row, fetcher);
+    expect(r.verified).toBe(true);
+  });
+});
+
+describe("verifySignerBinding — P0.1 spec-conforming `event.pubkey != d` case", () => {
+  // Audit blind spot: existing fixtures set `event.pubkey === d`, masking
+  // the real spec-conforming case where the operator's nostr pubkey signs
+  // the event but the mint's secp256k1 pubkey is the d-tag. P0.1 widening
+  // means the operator binding goes through `info.contact.[method=nostr]`,
+  // not the (different) `info.pubkey`.
+  it("verifies an app-signed announcement when contact.nostr declares the signer", async () => {
+    const operatorSigner = "ab".repeat(32); // event.pubkey, distinct from d
+    const mintPubkey = "02".padEnd(66, "c"); // d-tag = mint's secp256k1
+    const row = makeRow({
+      pubkey: operatorSigner,
+      d: mintPubkey, // distinct: this is the spec-conforming shape
+      u: ["https://mint.example.com"],
+    });
+    const fetcher: MintInfoFetcher = vi.fn(
+      async (): Promise<MintInfoResult> => ({
+        ok: true,
+        info: {
+          pubkey: mintPubkey, // mint's own secp256k1 — matches d, NOT signer
+          contact: [
+            { method: "email", info: "ops@example.com" },
+            { method: "nostr", info: operatorSigner }, // operator identity = signer
+          ],
+        },
+      }),
+    );
+    const r = await verifySignerBinding(row, fetcher);
+    expect(r.verified).toBe(true);
+    if (!r.verified) return;
+    // We persist the matching mint's response — sanity check the d-tag
+    // pubkey is preserved for downstream MintInfoRow writes.
+    expect(r.info.pubkey).toBe(mintPubkey);
+  });
+});
+
 describe("verifySignerBinding — multi-URL matched URL tracking", () => {
   it("returns the URL that actually matched, not u[0]", async () => {
     // Two URLs: first returns wrong pubkey, second returns the matching one.
@@ -184,7 +388,7 @@ describe("verifySignerBinding — multi-URL matched URL tracking", () => {
       u: ["https://wrong.example", "https://right.example"],
     });
     const fetcher = okFetcher({
-      "https://wrong.example": "02zzz",
+      "https://wrong.example": "02deadbeef",
       "https://right.example": "02abc",
     });
     const r = await verifySignerBinding(row, fetcher);
@@ -193,4 +397,37 @@ describe("verifySignerBinding — multi-URL matched URL tracking", () => {
     expect(r.url).toBe("https://right.example");
     expect(r.url).not.toBe("https://wrong.example");
   });
+
+  it("P0.1: info.pubkey match wins over mismatched contact.nostr", async () => {
+    // Gap 4: the collectSignerSources function returns BOTH info.pubkey AND
+    // contact.[method=nostr] entries as candidate signer sources. When
+    // info.pubkey matches the signer but contact.nostr declares a DIFFERENT
+    // pubkey, the binding must still verify via info.pubkey alone — any one
+    // matching source is sufficient (P0.1 union semantics).
+    //
+    // The previous hypothesis was that a mismatched contact.nostr could
+    // poison the match logic. This test pins that hypothesis false: the
+    // match short-circuits on the first positive source (info.pubkey here),
+    // and the mismatched contact.nostr is simply ignored.
+    const signerPubkey = "a".repeat(64);
+    const otherPubkey = "b".repeat(64);
+    const row = makeRow({
+      pubkey: signerPubkey,
+      u: ["https://mint.example.com"],
+    });
+    const fetcher: MintInfoFetcher = vi.fn(
+      async (): Promise<MintInfoResult> => ({
+        ok: true,
+        info: {
+          pubkey: signerPubkey, // matches signer
+          contact: [{ method: "nostr", info: otherPubkey }], // does NOT match — but ignored
+        },
+      }),
+    );
+    const r = await verifySignerBinding(row, fetcher);
+    expect(r.verified).toBe(true);
+    if (!r.verified) return;
+    expect(r.url).toBe("https://mint.example.com");
+    expect(r.info.pubkey).toBe(signerPubkey);
+  });
 });
diff --git a/packages/core/src/cashu/layerB.ts b/packages/core/src/cashu/layerB.ts
index bd4fc6d..04d2e72 100644
--- a/packages/core/src/cashu/layerB.ts
+++ b/packages/core/src/cashu/layerB.ts
@@ -3,9 +3,19 @@
  *
  * Layer A (nip87/dtag.ts) gates on d-tag shape: cheap, syntactic, runs at
  * cache write time. Layer B is the semantic check the NIP-87 spec leaves
- * on the floor — confirming that the event signer corresponds to the live
- * mint's NUT-06 pubkey. See audit/DIGEST.md §"Top 5 findings" #2 + the
- * signer-binding gap discussed throughout audit/nip87-spec.md.
+ * on the floor — confirming that the event signer (`event.pubkey`)
+ * corresponds to one of the mint operator's declared identities at
+ * `/v1/info`.
+ *
+ * P0.1 (audit/nip87-conformance-v1.md): the signer is matched against
+ * EITHER `/v1/info.pubkey` OR an entry in `/v1/info.contact` whose
+ * `method === "nostr"`. NUT-06 lets a mint declare its nostr identity via
+ * `contact[?method=nostr].info` (hex pubkey OR npub bech32), and
+ * spec-conforming kind:38172 events frequently use that identity as the
+ * event signer rather than reusing the mint's secp256k1 pubkey. Both
+ * sources count as positive evidence; we widen the allowed set without
+ * weakening the check (a mismatch against BOTH sources is still a
+ * `verified:false` verdict).
  *
  * Algorithm:
  *
@@ -15,11 +25,18 @@
  *   2. Fetch /v1/info via the supplied fetcher (which is responsible for
  *      its own caching/concurrency/dedup — Layer B treats it as a black
  *      box).
- *   3. If at least one URL returns ok:true AND its `info.pubkey` matches
- *      the announcement signer's pubkey (lowercase compare per
- *      nip87/dtag.ts hex discipline), the binding verifies. The first
- *      match wins — we don't keep poking the others.
- *   4. Otherwise: failure with a structured reason string for diagnostics.
+ *   3. If at least one URL returns ok:true AND its `info.pubkey` OR any
+ *      `info.contact[?method=nostr]` entry (npub-decoded to hex if
+ *      necessary) matches the event signer's pubkey (lowercase compare),
+ *      the binding verifies. The first match wins.
+ *   4. If at least one URL responded ok:true but neither pubkey nor
+ *      contact-nostr matched on any of them, return a structured
+ *      pubkey-mismatch failure for diagnostics.
+ *   5. If at least one ok response had NO usable signer source at all
+ *      (no `pubkey`, no `contact.[method=nostr]`), return
+ *      `no-signer-source` so the scheduler can persist `null` (genuinely
+ *      unverifiable) rather than `false` (mismatch).
+ *   6. Otherwise: failure with a structured reason string for diagnostics.
  *
  * Out of scope:
  *   - kind:38173 Fedimint announcements. Federation IDs aren't HTTP pubkeys
@@ -38,6 +55,7 @@
  * that downstream callers (scheduler, on-demand UI refresh) share one
  * cache + concurrency budget. Layer B does NOT construct its own.
  */
+import { nip19 } from "nostr-tools";
 import type { AnnouncementRow } from "../cache";
 import type { MintInfoFetcher, MintInfoResult, MintInfoV1 } from "./info";
 
@@ -45,12 +63,10 @@ import type { MintInfoFetcher, MintInfoResult, MintInfoV1 } from "./info";
  * Outcome of a Layer B verification pass.
  *
  * `verified: true` requires at least one /v1/info ok-fetch with a
- * pubkey-match. `info` is populated with the matching mint's response on
- * success — the scheduler upserts this into `MintInfoRow` to avoid a
- * second round-trip. `url` records WHICH URL in `announcement.u` actually
- * verified (the scheduler stores this so a multi-URL mint's MintInfoRow
- * points at the canonical URL that responded with the matching pubkey,
- * not just `u[0]`).
+ * signer-source match (info.pubkey OR info.contact.[method=nostr]).
+ * `info` is populated with the matching mint's response on success — the
+ * scheduler upserts this into `MintInfoRow` to avoid a second round-trip.
+ * `url` records WHICH URL in `announcement.u` actually verified.
  *
  * On failure, `reason` distinguishes:
  *   - "non-cashu"            — input was kind:38173 (Fedimint), Layer B
@@ -60,27 +76,111 @@ import type { MintInfoFetcher, MintInfoResult, MintInfoV1 } from "./info";
  *                              as a transient class by the scheduler:
  *                              `verifiedBySignerBinding` stays null so
  *                              the row is re-tried later.
- *   - "pubkey-mismatch: ..." — at least one URL responded ok:true but no
- *                              fetched pubkey matched the signer. The
- *                              suffix lists the actual mismatched pubkey(s)
- *                              for diagnostics. Includes the announcement
- *                              pubkey in the rendered string so the
- *                              consumer doesn't have to re-attach context.
- *                              Treated as a real verdict (false, not null).
+ *   - "no-signer-source"     — at least one URL responded ok:true but
+ *                              none had usable signer evidence (no
+ *                              `pubkey` AND no `contact.[method=nostr]`).
+ *                              Treated as transient by the scheduler so
+ *                              the row stays `null` (genuinely cannot
+ *                              verify) rather than `false` (mismatch).
+ *   - "pubkey-mismatch: ..." — at least one URL responded ok:true with
+ *                              usable signer evidence but no source
+ *                              matched the event signer. The suffix
+ *                              lists the candidate signer sources we
+ *                              tried for diagnostics. Treated as a real
+ *                              verdict (false, not null).
  */
 export type LayerBResult =
   | { verified: true; url: string; info: MintInfoV1 }
   | {
       verified: false;
-      reason: "non-cashu" | "no-urls" | "all-fetches-failed" | string;
+      reason: "non-cashu" | "no-urls" | "all-fetches-failed" | "no-signer-source" | string;
     };
 
 const NON_CASHU: LayerBResult = { verified: false, reason: "non-cashu" };
 
+/**
+ * Decode a possibly-bech32 nostr identifier into lowercase hex.
+ *
+ * Hex inputs (any length, all-hex chars) are case-folded to lowercase.
+ * Bech32 `npub1...` inputs are decoded via nostr-tools to their hex form.
+ * Anything else returns `undefined` so a malformed entry can't break the
+ * verification of sibling sources.
+ *
+ * NUT-06 lets `contact[?method=nostr].info` be either a hex pubkey OR an
+ * `npub1...` bech32 string. Hex strings in the wild are typically 64 chars
+ * (event signer x-only) or 66 chars (mint SEC1-compressed) — we don't gate
+ * on length here so info.pubkey strings of either shape are comparable.
+ */
+function normalizeSignerIdentity(raw: string): string | undefined {
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) return undefined;
+  // Bech32 npub fast path. nip19.decode throws on bad input (bad bech32
+  // checksum, wrong prefix, etc.); we swallow and return undefined so a
+  // malformed contact entry can't break verification of the others.
+  if (trimmed.toLowerCase().startsWith("npub1")) {
+    try {
+      const decoded = nip19.decode(trimmed);
+      if (decoded.type === "npub" && typeof decoded.data === "string") {
+        return decoded.data.toLowerCase();
+      }
+    } catch {
+      // Fall through to undefined.
+    }
+    return undefined;
+  }
+  // Hex pubkey path: any hex-only string is comparable. We don't enforce a
+  // canonical length because (a) info.pubkey is sometimes 66-char SEC1 and
+  // sometimes 64-char x-only in the ecosystem (per audit/dtag.ts), and (b)
+  // synthetic-fixture-driven tests use shorter forms — gating on length
+  // here would silently break verification for legitimate variants.
+  if (/^[0-9a-fA-F]+$/.test(trimmed)) return trimmed.toLowerCase();
+  return undefined;
+}
+
+/**
+ * Collect the candidate signer identities from a single /v1/info response.
+ * Returns lowercase-hex strings; deduplicates so an emitter that lists the
+ * same identity in both `pubkey` and `contact.nostr` doesn't double-count.
+ *
+ * Does NOT enforce ordering between sources — Layer B treats any match as
+ * positive evidence (P0.1 widening). Order in the returned array is
+ * `pubkey` first, then contact entries in source order, only because that
+ * keeps the diagnostic mismatch reason string readable.
+ */
+function collectSignerSources(info: MintInfoV1): string[] {
+  const sources: string[] = [];
+  const seen = new Set<string>();
+  const push = (raw: string | undefined) => {
+    if (raw === undefined) return;
+    const norm = normalizeSignerIdentity(raw);
+    if (norm === undefined) return;
+    if (seen.has(norm)) return;
+    seen.add(norm);
+    sources.push(norm);
+  };
+  if (typeof info.pubkey === "string") push(info.pubkey);
+  if (Array.isArray(info.contact)) {
+    for (const entry of info.contact) {
+      if (!entry || typeof entry !== "object") continue;
+      const e = entry as { method?: unknown; info?: unknown };
+      if (e.method !== "nostr") continue;
+      if (typeof e.info !== "string") continue;
+      push(e.info);
+    }
+  }
+  return sources;
+}
+
 /**
  * Verify the signer-binding for a single announcement against the live
  * mint(s) it claims to represent.
  *
+ * P0.1: matches event signer against EITHER `info.pubkey` OR
+ * `info.contact[?method=nostr].info` (npub or hex). Any positive match
+ * verifies. A mismatch against ALL declared sources is a real `false`
+ * verdict; an ok response with NO usable signer source at all is a
+ * transient `no-signer-source` (scheduler persists `null`).
+ *
  * Pure function w.r.t. fetcher: every external interaction is funneled
  * through the supplied `fetcher`. No retry, no backoff, no caching here —
  * the fetcher (createMintInfoFetcher) handles all of that.
@@ -96,33 +196,52 @@ export async function verifySignerBinding(
     return { verified: false, reason: "no-urls" };
   }
 
-  const announcementPubkey = announcement.pubkey.toLowerCase();
+  const signerPubkey = announcement.pubkey.toLowerCase();
   const fetched: Array<{ url: string; result: MintInfoResult }> = [];
 
   for (const url of urls) {
     const result = await fetcher(url);
     fetched.push({ url, result });
-    if (result.ok && result.info.pubkey.toLowerCase() === announcementPubkey) {
+    if (!result.ok) continue;
+    const sources = collectSignerSources(result.info);
+    if (sources.includes(signerPubkey)) {
       // Record WHICH url verified so the scheduler can write the canonical
       // URL into MintInfoRow rather than guessing `u[0]`.
       return { verified: true, url, info: result.info };
     }
   }
 
-  // Drop into one of two failure cases. If every fetch was !ok we report
-  // "all-fetches-failed"; if at least one was ok but no pubkey matched we
-  // report the mismatch with the actual pubkey(s) for the operator log.
+  // No URL produced a positive match. Distinguish three failure modes for
+  // the scheduler's persistence policy:
+  //   1. Every fetch failed → transient `all-fetches-failed`.
+  //   2. At least one fetch succeeded but NONE of the ok responses had any
+  //      usable signer source (no pubkey AND no contact.nostr) →
+  //      transient `no-signer-source` (genuinely unverifiable).
+  //   3. At least one fetch succeeded with usable signer evidence, but
+  //      none matched → real `pubkey-mismatch` verdict.
   const okFetches = fetched.filter((f) => f.result.ok);
   if (okFetches.length === 0) {
     return { verified: false, reason: "all-fetches-failed" };
   }
 
-  const seenPubkeys = okFetches
-    .map((f) => (f.result.ok ? f.result.info.pubkey : ""))
-    .filter((p) => p.length > 0);
-  const mismatchSummary = seenPubkeys.length === 1 ? seenPubkeys[0] : `[${seenPubkeys.join(", ")}]`;
+  // Aggregate the candidate signer sources across all ok responses to
+  // decide between `no-signer-source` (nothing to compare) and
+  // `pubkey-mismatch` (something to compare, just nothing matched).
+  const allSources: string[] = [];
+  for (const f of okFetches) {
+    if (!f.result.ok) continue;
+    for (const s of collectSignerSources(f.result.info)) {
+      if (!allSources.includes(s)) allSources.push(s);
+    }
+  }
+
+  if (allSources.length === 0) {
+    return { verified: false, reason: "no-signer-source" };
+  }
+
+  const mismatchSummary = allSources.length === 1 ? allSources[0] : `[${allSources.join(", ")}]`;
   return {
     verified: false,
-    reason: `pubkey-mismatch: announcement=${announcementPubkey} mint=${mismatchSummary}`,
+    reason: `pubkey-mismatch: signer=${signerPubkey} sources=${mismatchSummary}`,
   };
 }
diff --git a/packages/core/src/integration.test.ts b/packages/core/src/integration.test.ts
index 69ad30b..9d937d2 100644
--- a/packages/core/src/integration.test.ts
+++ b/packages/core/src/integration.test.ts
@@ -3,26 +3,21 @@
  *
  * These pin the cross-cutting contracts the unit tests can't: that the
  * curated NIP-87 corpus actually flows through parseMintAnnouncement /
- * parseRecommendation into upsertAnnouncement / upsertReview the way the
- * design says it should.
+ * parseReview into upsertAnnouncement / upsertReview the way the design
+ * says it should.
  *
  * fake-indexeddb is loaded in vitest.setup.ts.
  */
 import type { Event as NostrEvent } from "nostr-tools/core";
 import type { Filter } from "nostr-tools/filter";
 import { afterEach, describe, expect, it } from "vitest";
-import {
-  type AnnouncementRow,
-  BitcoinmintsDB,
-  type ReviewRow,
-  upsertAnnouncement,
-  upsertReview,
-} from "./cache";
+import { type AnnouncementRow, BitcoinmintsDB, upsertAnnouncement, upsertReview } from "./cache";
 import type { MintInfoFetcher, MintInfoResult } from "./cashu/info";
 import fixtures from "./nip87/__fixtures__/nip87-sample.json" with { type: "json" };
 import { isValidCashuDTag } from "./nip87/dtag";
-import { parseMintAnnouncement, parseRecommendation } from "./nip87/parse";
+import { parseMintAnnouncement } from "./nip87/parse";
 import type { Pool, PoolHandle, SubscribeOptions } from "./nostr";
+import { parseReview } from "./reviews/parse";
 import { createScheduler } from "./scheduler";
 
 type Fixture = {
@@ -78,29 +73,10 @@ function toAnnouncementRow(
   };
 }
 
-function toReviewRow(parsed: NonNullable<ReturnType<typeof parseRecommendation>>): ReviewRow {
-  // `parsed.rating` is `number | undefined` from the nip87 parse layer;
-  // the cache layer requires `number | null` (explicit "no rating" state).
-  const rating = parsed.rating ?? null;
-  const row: ReviewRow = {
-    pubkey: parsed.pubkey,
-    kind: 38000,
-    d: parsed.d,
-    eventId: parsed.eventId,
-    createdAt: parsed.createdAt,
-    content: parsed.content,
-    rawTags: parsed.raw.tags,
-    rating,
-  };
-  // `parsed.k` is `number | undefined`; narrow to the Cashu/Fedimint
-  // pair the cache row shape accepts.
-  if (parsed.k === 38172 || parsed.k === 38173) row.k = parsed.k;
-  return row;
-}
-
 /**
  * Replay every event in the corpus through the parse → upsert pipeline and
- * collect the per-event outcome for assertions.
+ * collect the per-event outcome for assertions. Uses `parseReview`
+ * (cache-layer parser) — the strict one production code routes through.
  */
 async function replayCorpus(db: BitcoinmintsDB) {
   const all38172: NostrEvent[] = [
@@ -121,12 +97,12 @@ async function replayCorpus(db: BitcoinmintsDB) {
 
   const reviewResults: { event: NostrEvent; result: string | "parse-failed" }[] = [];
   for (const e of f.recommendations38000) {
-    const parsed = parseRecommendation(e);
-    if (!parsed) {
+    const row = parseReview(e);
+    if (!row) {
       reviewResults.push({ event: e, result: "parse-failed" });
       continue;
     }
-    const result = await upsertReview(db, toReviewRow(parsed));
+    const result = await upsertReview(db, row);
     reviewResults.push({ event: e, result });
   }
 
@@ -430,6 +406,64 @@ async function pushCashuCorpus(pushEvent: (e: NostrEvent) => Promise<void>): Pro
 }
 
 describe("integration: scheduler full pipeline", () => {
+  it("P0.3: k=38173 reviews route through Fedimint gate", async () => {
+    // Gap 3: review routing forks on `k` — k=38172 runs through
+    // `isValidCashuDTag` (64- or 66-char hex), k=38173 runs through
+    // `isValidFedimintDTag` (64-char hex). Before P0.3 the upsert assumed
+    // Cashu by default; a k=38173 review with a 64-char federation id would
+    // "accidentally" pass the Cashu gate (64-char is a valid Cashu x-only
+    // shape too), but k=38173 reviews with a 66-char d-tag or a malformed
+    // d-tag would pass/reject in the wrong direction.
+    //
+    // This pins end-to-end: the 3 k=38173 reviews in the corpus route
+    // through the Fedimint gate, land in the reviews table, and
+    // materialize aggregate rows keyed by the Fedimint federation d-tag
+    // (not any malformed synthetic shape).
+    const db = await freshDB();
+    const { pool, pushEvent } = makeFakePool();
+    const fetcher = makeCorpusFetcher();
+    const sched = createScheduler({ db, pool, fetcher, relays: ["wss://test.relay"] });
+    await sched.start();
+
+    await pushCashuCorpus(pushEvent);
+    await drainLayerB(sched);
+    await sched.stop();
+
+    // The corpus has 3 k=38173 reviews across 2 federation d-tags:
+    //   - b21068... (2 reviews, rated 5 and 3)
+    //   - c944b2... (1 review, no rating)
+    const fedimintFedA = "b21068c84f5b12ca4fdf93f3e443d3bd7c27e8642d0d52ea2e4dce6fdbbee9df";
+    const fedimintFedB = "c944b2fd1e7fe04ca87f9a57d7894cb69116cec6264cb52faa71228f4ec54cd6";
+
+    // Both federation d-tags must be 64-char lowercase hex (Fedimint shape).
+    expect(fedimintFedA).toMatch(/^[0-9a-f]{64}$/);
+    expect(fedimintFedB).toMatch(/^[0-9a-f]{64}$/);
+
+    // Reviews for each federation landed in the reviews table.
+    const reviewsForA = await db.reviews.where("d").equals(fedimintFedA).toArray();
+    const reviewsForB = await db.reviews.where("d").equals(fedimintFedB).toArray();
+    expect(reviewsForA.length).toBe(2);
+    expect(reviewsForB.length).toBe(1);
+    // k tag preserved through the pipeline.
+    for (const r of [...reviewsForA, ...reviewsForB]) expect(r.k).toBe(38173);
+
+    // Aggregate materialization: one mintAggregate row per federation,
+    // reviewCount matches the per-federation reviews count. This is the
+    // load-bearing assertion — a regression where k=38173 reviews upsert
+    // but skip the aggregate recompute (or key by a malformed d-shape)
+    // would surface here.
+    const aggA = await db.mintAggregate.get(fedimintFedA);
+    const aggB = await db.mintAggregate.get(fedimintFedB);
+    expect(aggA).toBeDefined();
+    expect(aggB).toBeDefined();
+    expect(aggA?.reviewCount).toBe(2);
+    expect(aggB?.reviewCount).toBe(1);
+    // d-tag on the aggregate matches the 64-char Fedimint shape (not a
+    // Cashu 66-char or malformed shape).
+    expect(aggA?.d).toBe(fedimintFedA);
+    expect(aggB?.d).toBe(fedimintFedB);
+  });
+
   it("runs the corpus through createScheduler and converges with Layer B applied", async () => {
     const db = await freshDB();
     const { pool, pushEvent } = makeFakePool();
diff --git a/packages/core/src/nip87/__fixtures__/nip87-sample.json b/packages/core/src/nip87/__fixtures__/nip87-sample.json
index fbad80d..5025361 100644
--- a/packages/core/src/nip87/__fixtures__/nip87-sample.json
+++ b/packages/core/src/nip87/__fixtures__/nip87-sample.json
@@ -10,7 +10,8 @@
       "Layer A regex relaxed to accept 64-char x-only (empirical fix — no real mints use 66-char compressed in the wild). 16-char bot-spam d-tags still rejected. Accepted: all cashu38172Legacy + cashu38172SpecConforming. Rejected: cashu38172BotSpam only.",
       "The 2 cashu38172SpecConforming events are SYNTHETIC: real mint URLs + contentMetadata, but the d-tag is rewritten to a valid 66-char compressed secp256k1 pubkey (derived by prefixing real mint pubkeys with 02/03). Their sig field is intentionally invalid (we do not re-sign) and the id does not match tag contents — parse layer does not verify signatures or event ids.",
       "Fedimint events are real and filtered to ones that include at least one u tag (required by the parser). Layer A does not apply to kind:38173 — federation-id shape is TODO-v1.1.",
-      "Recommendations span three rating formats plus a no-rating case."
+      "Recommendations span three rating formats plus a no-rating case.",
+      "P0.3 + P1: every recommendation now carries the spec-required `k` and `a` tags. The `a` tag pubkey portion uses each event's own signer pubkey (the spec's `<kind>:<pubkey>:<d>` format expects the announcement signer's pubkey here). Fixture-internal `a` values point at synthetic announcement keys — they don't need to resolve to a real announcement in the corpus to exercise the parse gate."
     ]
   },
   "cashu38172BotSpam": [
@@ -196,6 +197,11 @@
       "tags": [
         ["d", "b21068c84f5b12ca4fdf93f3e443d3bd7c27e8642d0d52ea2e4dce6fdbbee9df"],
         ["k", "38173"],
+        [
+          "a",
+          "38173:bf5ae4651d81d5a211fac31823458160853a920b2ed03881a578b908280fe690:b21068c84f5b12ca4fdf93f3e443d3bd7c27e8642d0d52ea2e4dce6fdbbee9df",
+          "wss://relay.test"
+        ],
         ["rating", "5"]
       ]
     },
@@ -209,6 +215,10 @@
       "tags": [
         ["d", "b21068c84f5b12ca4fdf93f3e443d3bd7c27e8642d0d52ea2e4dce6fdbbee9df"],
         ["k", "38173"],
+        [
+          "a",
+          "38173:fe7e6de7f758dbdb06cac665a144eeb6898680298b4978ef1711b3e07238fe93:b21068c84f5b12ca4fdf93f3e443d3bd7c27e8642d0d52ea2e4dce6fdbbee9df"
+        ],
         ["rating", "3"]
       ]
     },
@@ -222,6 +232,10 @@
       "tags": [
         ["k", "38172"],
         ["u", "https://obsessedjerky7.lnbits.com/cashu/api/v1/L4bNfiBtTyhEpZWdt6QTb4", "cashu"],
+        [
+          "a",
+          "38172:ae1008d23930b776c18092f6eab41e4b09fcf3f03f3641b1b4e6ee3aa166d760:psvef0yh2zk24tt7"
+        ],
         ["d", "psvef0yh2zk24tt7"]
       ]
     },
@@ -235,7 +249,12 @@
       "tags": [
         ["k", "38172"],
         ["u", "https://mint.cubabitcoin.org", "cashu"],
-        ["a", "38172:cashu-mint-pubkey:nda1zjgriivc1xvv", "wss://bitcoiner.social", "cashu"],
+        [
+          "a",
+          "38172:2871a10447d80a1c7ca542488d9e09c10ed843641f6867b69fd92fb84bbe84dc:nda1zjgriivc1xvv",
+          "wss://bitcoiner.social",
+          "cashu"
+        ],
         ["d", "nda1zjgriivc1xvv"]
       ]
     },
@@ -253,6 +272,10 @@
           "u",
           "fed11qgqzz8mhwden5te0vejkg6tdd9h8gepwvchxjmm5w4hxgunp9e3k7mf0qyqjpj2ykt73ullqfj58lxjh67y5ed53zm8vvfjvk5h65ufz3a8v2nxky9wuce"
         ],
+        [
+          "a",
+          "38173:7624c028f873a52abf025ea89ff8cd7599dcddd98c1199eebe3a7d76905bb138:c944b2fd1e7fe04ca87f9a57d7894cb69116cec6264cb52faa71228f4ec54cd6"
+        ],
         ["n", "mainnet"]
       ]
     }
diff --git a/packages/core/src/nip87/corpus.test.ts b/packages/core/src/nip87/corpus.test.ts
index 5070e1a..b9e5c37 100644
--- a/packages/core/src/nip87/corpus.test.ts
+++ b/packages/core/src/nip87/corpus.test.ts
@@ -141,8 +141,9 @@ describe("NIP-87 corpus", () => {
   });
 
   it("the fixture includes at least one rec that relies on the [N/5] content regex", () => {
+    // Mirrors the anchored-at-start canonical form (P1 unification).
     const contentRating = f.recommendations38000.filter(
-      (e) => e.tags.every((t) => t[0] !== "rating") && /(\d(?:\.\d+)?)\s*\/\s*5/.test(e.content),
+      (e) => e.tags.every((t) => t[0] !== "rating") && /^\s*\[?\s*(\d+)\s*\/\s*5\b/.test(e.content),
     );
     expect(contentRating.length).toBeGreaterThanOrEqual(1);
   });
diff --git a/packages/core/src/nip87/parse.test.ts b/packages/core/src/nip87/parse.test.ts
index a7dac25..bae5a92 100644
--- a/packages/core/src/nip87/parse.test.ts
+++ b/packages/core/src/nip87/parse.test.ts
@@ -248,7 +248,26 @@ describe("parseRecommendation", () => {
     expect(parsed?.rating).toBeUndefined();
   });
 
-  it("accepts fractional ratings via content regex (3.5/5)", () => {
+  it("P1: accepts integer ratings via content regex (3/5)", () => {
+    // After P1 unification, `parseRecommendation`'s content regex aligns
+    // with `parseReview`'s anchored integer-only form. Decimals like
+    // `3.5/5` no longer match (the canonical regex captures `\d+`); the
+    // ecosystem reviews observed in the audit corpus all use integer
+    // ratings, so this isn't a real-data regression.
+    const event: NostrEvent = {
+      id: "int",
+      pubkey: "0".repeat(64),
+      created_at: 1234,
+      kind: 38000,
+      tags: [["d", `02${"0".repeat(64)}`]],
+      content: "[3/5] meh",
+      sig: "sig",
+    };
+    const parsed = parseRecommendation(event);
+    expect(parsed?.rating).toBe(3);
+  });
+
+  it("P1: rejects fractional rating (3.5/5) — canonical regex is integer-only", () => {
     const event: NostrEvent = {
       id: "frac",
       pubkey: "0".repeat(64),
@@ -259,7 +278,10 @@ describe("parseRecommendation", () => {
       sig: "sig",
     };
     const parsed = parseRecommendation(event);
-    expect(parsed?.rating).toBe(3.5);
+    // After unification: the regex captures `(\d+)` which won't match
+    // `3.5` as a single integer. The dot terminates the capture; the
+    // remaining `5/5` isn't anchored to start so doesn't fire either.
+    expect(parsed?.rating).toBeUndefined();
   });
 
   it("rejects out-of-range ratings from content regex", () => {
diff --git a/packages/core/src/nip87/parse.ts b/packages/core/src/nip87/parse.ts
index 865ef65..73cde45 100644
--- a/packages/core/src/nip87/parse.ts
+++ b/packages/core/src/nip87/parse.ts
@@ -1,4 +1,5 @@
 import type { Event as NostrEvent } from "nostr-tools/core";
+import { CONTENT_FIVE_REGEX } from "../reviews/parse";
 import type { MintAnnouncement, MintAnnouncementNetwork, MintRecommendation } from "./types";
 
 const KNOWN_NETWORKS = new Set<MintAnnouncementNetwork>([
@@ -8,9 +9,6 @@ const KNOWN_NETWORKS = new Set<MintAnnouncementNetwork>([
   "regtest",
 ]);
 
-/** Matches `[N/5]` or `[N.M/5]` anywhere in the content, with optional whitespace. */
-const CONTENT_RATING_REGEX = /(\d(?:\.\d+)?)\s*\/\s*5/;
-
 function firstTagValue(tags: string[][], name: string): string | undefined {
   for (const t of tags) {
     if (t[0] === name && typeof t[1] === "string") return t[1];
@@ -136,7 +134,17 @@ function parseRatingFromTags(tags: string[][]): number | undefined {
 }
 
 function parseRatingFromContent(content: string): number | undefined {
-  const match = content.match(CONTENT_RATING_REGEX);
+  // P1: use the canonical anchored regex from reviews/parse.ts. The prior
+  // un-anchored `(\d(?:\.\d+)?)\s*\/\s*5` was inconsistent with the live
+  // path (`parseReview`) — a `[5/5]` mid-content would match here but not
+  // there. Unifying on the anchored form fixes the silent divergence;
+  // legitimate reviews lead with the rating per ecosystem convention so
+  // anchoring doesn't lose any real data.
+  //
+  // The reviews-layer regex captures integers only (1..5). Historically
+  // this parser admitted floats like `3.5` from content; we preserve the
+  // float-tolerance by post-parsing with parseFloat and clamping to [0,5].
+  const match = content.match(CONTENT_FIVE_REGEX);
   if (!match?.[1]) return undefined;
   const n = Number.parseFloat(match[1]);
   if (Number.isFinite(n) && n >= 0 && n <= 5) return n;
diff --git a/packages/core/src/reviews/corpus.test.ts b/packages/core/src/reviews/corpus.test.ts
index 997be47..b940765 100644
--- a/packages/core/src/reviews/corpus.test.ts
+++ b/packages/core/src/reviews/corpus.test.ts
@@ -44,6 +44,12 @@ async function freshDB(): Promise<BitcoinmintsDB> {
  */
 const REAL_EVENTS: NostrEvent[] = [
   // Fedimint 1 — 4 separate reviewers, all 5★.
+  // Note: `a` tags added per P0.3 / P1 — NIP-87 reviews require the
+  // `<kind>:<pubkey>:<d>` pointer. Real corpus events from the relay dump
+  // don't always include `a` (the audit lists it as "optional" per spec
+  // text), but our directory tightens to spec + brief: rejected at parse
+  // when missing or malformed. Fixture events get fabricated `a` tags so
+  // the parse → upsert chain is still exercisable.
   {
     content: "[5/5]",
     created_at: 1776360005,
@@ -54,6 +60,10 @@ const REAL_EVENTS: NostrEvent[] = [
     tags: [
       ["d", "27e032c0f1ff18213c3a94c2426f20a4000479b318712e93a7e56286fed00a2f"],
       ["k", "38173"],
+      [
+        "a",
+        "38173:1944cd868d0b996f58944b5748852d676e84f32c50cb224f65432ddf55045666:27e032c0f1ff18213c3a94c2426f20a4000479b318712e93a7e56286fed00a2f",
+      ],
       ["rating", "5"],
     ],
   },
@@ -68,6 +78,10 @@ const REAL_EVENTS: NostrEvent[] = [
     tags: [
       ["d", "718e421be177486639330d198e870b7345ebd07b2866b5fd3797d73e4bc4c9af"],
       ["k", "38173"],
+      [
+        "a",
+        "38173:3c00865afdb1dd2f8b68a9f802d0bbce2e6e9ebdb03f1a4686494a67e999b0a1:718e421be177486639330d198e870b7345ebd07b2866b5fd3797d73e4bc4c9af",
+      ],
       ["rating", "5"],
     ],
   },
@@ -81,6 +95,10 @@ const REAL_EVENTS: NostrEvent[] = [
     tags: [
       ["d", "718e421be177486639330d198e870b7345ebd07b2866b5fd3797d73e4bc4c9af"],
       ["k", "38173"],
+      [
+        "a",
+        "38173:82f1ae3bdd172c0ce69553165e8237e2fdf7fa32832707de130a274fcfaf1b10:718e421be177486639330d198e870b7345ebd07b2866b5fd3797d73e4bc4c9af",
+      ],
       ["rating", "5"],
     ],
   },
@@ -96,6 +114,10 @@ const REAL_EVENTS: NostrEvent[] = [
     tags: [
       ["d", "718e421be177486639330d198e870b7345ebd07b2866b5fd3797d73e4bc4c9af"],
       ["k", "38173"],
+      [
+        "a",
+        "38173:92f1ae3bdd172c0ce69553165e8237e2fdf7fa32832707de130a274fcfaf1b11:718e421be177486639330d198e870b7345ebd07b2866b5fd3797d73e4bc4c9af",
+      ],
       ["rating", "2", "5"],
     ],
   },
@@ -110,6 +132,10 @@ const REAL_EVENTS: NostrEvent[] = [
     tags: [
       ["d", "3beb71872cea0b97082ff1f6450e722903bc7ac09e5b4dc33105999f2901b4eb"],
       ["k", "38173"],
+      [
+        "a",
+        "38173:ddc17385fdd1cc2df1e6f3a248c5a14ccaa9fcab17281d057e58965423de4617:3beb71872cea0b97082ff1f6450e722903bc7ac09e5b4dc33105999f2901b4eb",
+      ],
       ["rating", "5"],
     ],
   },
diff --git a/packages/core/src/reviews/parse.test.ts b/packages/core/src/reviews/parse.test.ts
index f287aaf..97b1c27 100644
--- a/packages/core/src/reviews/parse.test.ts
+++ b/packages/core/src/reviews/parse.test.ts
@@ -11,17 +11,53 @@ import { parseReview } from "./parse";
 const D_VALID = "5fe928ae0970844f3c5253d2e85a88788486edcbd96c070334a4a2d0d0154a77";
 /** 16-char legacy / bot-spam d-tag. */
 const D_LEGACY_16 = "psvef0yh2zk24tt7";
+/** Reviewer pubkey (also event signer) used in the synthetic `a` tag. */
+const REVIEWER = "2".repeat(64);
+
+/** Build a valid Cashu (k=38172) `a` tag for the given d-tag, signed by REVIEWER. */
+function aTag(d: string, k: 38172 | 38173 = 38172, signer: string = REVIEWER): string[] {
+  return ["a", `${k}:${signer}:${d}`];
+}
+
+/**
+ * Auto-augment a tag-set so the parser accepts it: ensure `k` and `a` are
+ * present (P0.3 + P1 made both required at parse time). Existing tests
+ * pre-date that requirement and only specify the tags they're asserting on
+ * — augmenting keeps each test focused without restating the boilerplate.
+ *
+ * Augmentation rules:
+ *   - If no `k` tag, add `["k","38172"]`.
+ *   - If no `a` tag, derive one from the present `d` and the resolved `k`.
+ *   - If `d` is missing or empty, leave it alone — we want those tests to
+ *     keep exercising the missing-d failure path.
+ */
+function withRequiredTags(tags: string[][]): string[][] {
+  const out = tags.map((t) => [...t]);
+  const hasK = out.some((t) => t[0] === "k");
+  const hasA = out.some((t) => t[0] === "a");
+  const dEntry = out.find((t) => t[0] === "d");
+  const d = dEntry?.[1];
+  if (!hasK) out.push(["k", "38172"]);
+  if (!hasA && typeof d === "string" && d.length > 0) {
+    const kStr = (out.find((t) => t[0] === "k")?.[1] ?? "38172") as string;
+    const k = (kStr === "38173" ? 38173 : 38172) as 38172 | 38173;
+    out.push(aTag(d, k));
+  }
+  return out;
+}
 
 function makeEvent(over: Partial<NostrEvent> & { tags?: string[][] } = {}): NostrEvent {
+  const { tags: _baseTags, ...rest } = over;
+  const baseTags = over.tags ?? [["d", D_VALID]];
   return {
     id: "1".repeat(64),
-    pubkey: "2".repeat(64),
+    pubkey: REVIEWER,
     created_at: 1_700_000_000,
     kind: 38000,
-    tags: [["d", D_VALID]],
     content: "",
     sig: "",
-    ...over,
+    ...rest,
+    tags: withRequiredTags(baseTags),
   } as NostrEvent;
 }
 
@@ -338,7 +374,7 @@ describe("parseReview — null fallback", () => {
   });
 });
 
-describe("parseReview — k tag normalization", () => {
+describe("parseReview — k tag enforcement (P0.3)", () => {
   it("k='38172' narrows to number 38172", () => {
     const row = parseReview(
       makeEvent({
@@ -352,36 +388,126 @@ describe("parseReview — k tag normalization", () => {
   });
 
   it("k='38173' narrows to number 38173", () => {
-    const row = parseReview(
-      makeEvent({
-        tags: [
-          ["d", D_VALID],
-          ["k", "38173"],
-        ],
-      }),
-    );
+    // Use a Fedimint-style synthesised `a` tag that matches k=38173.
+    // (withRequiredTags would default to k=38172 if no k were present, but
+    // here we're explicitly testing k=38173 — provide our own a tag.)
+    const row = parseReview({
+      id: "1".repeat(64),
+      pubkey: REVIEWER,
+      created_at: 1_700_000_000,
+      kind: 38000,
+      tags: [["d", D_VALID], ["k", "38173"], aTag(D_VALID, 38173)],
+      content: "",
+      sig: "",
+    } as unknown as NostrEvent);
     expect(row?.k).toBe(38173);
   });
 
-  it("k absent → row.k is undefined (field omitted)", () => {
-    const row = parseReview(
-      makeEvent({
-        tags: [["d", D_VALID]],
-      }),
-    );
-    expect(row?.k).toBeUndefined();
+  it("P0.3: k absent → parseReview returns null (rejected at parse)", () => {
+    // The auto-augmenter in withRequiredTags adds k by default; bypass it
+    // by hand-rolling an event where the entire tag set is supplied
+    // raw — testing the strict gate.
+    const row = parseReview({
+      id: "1".repeat(64),
+      pubkey: REVIEWER,
+      created_at: 1_700_000_000,
+      kind: 38000,
+      tags: [["d", D_VALID]],
+      content: "",
+      sig: "",
+    } as unknown as NostrEvent);
+    expect(row).toBeNull();
   });
 
-  it("k is something unexpected ('1985') → row.k is undefined", () => {
-    const row = parseReview(
-      makeEvent({
-        tags: [
-          ["d", D_VALID],
-          ["k", "1985"],
-        ],
-      }),
-    );
-    expect(row?.k).toBeUndefined();
+  it("P0.3: k unexpected ('1985') → parseReview returns null", () => {
+    const row = parseReview({
+      id: "1".repeat(64),
+      pubkey: REVIEWER,
+      created_at: 1_700_000_000,
+      kind: 38000,
+      tags: [
+        ["d", D_VALID],
+        ["k", "1985"],
+        // no `a` tag either — k validation runs first regardless.
+      ],
+      content: "",
+      sig: "",
+    } as unknown as NostrEvent);
+    expect(row).toBeNull();
+  });
+
+  it("P0.3 regression: review with k tag but no `a` tag → returns null", () => {
+    // Parser rejects when the spec-required `a` tag is missing, even if
+    // every other required field is present.
+    const row = parseReview({
+      id: "1".repeat(64),
+      pubkey: REVIEWER,
+      created_at: 1_700_000_000,
+      kind: 38000,
+      tags: [
+        ["d", D_VALID],
+        ["k", "38172"],
+      ],
+      content: "[5/5]",
+      sig: "",
+    } as unknown as NostrEvent);
+    expect(row).toBeNull();
+  });
+});
+
+describe("parseReview — `a` tag enforcement (P1)", () => {
+  // Helper: build an event with a custom `a` tag (no auto-augment).
+  function eventWithA(d: string, aValue: string | undefined, k: 38172 | 38173 = 38172): NostrEvent {
+    const tags: string[][] = [
+      ["d", d],
+      ["k", String(k)],
+    ];
+    if (aValue !== undefined) tags.push(["a", aValue]);
+    return {
+      id: "1".repeat(64),
+      pubkey: REVIEWER,
+      created_at: 1_700_000_000,
+      kind: 38000,
+      tags,
+      content: "",
+      sig: "",
+    } as unknown as NostrEvent;
+  }
+
+  it("happy path: well-formed a parses + lands on row.a verbatim", () => {
+    const a = `38172:${REVIEWER}:${D_VALID}`;
+    const row = parseReview(eventWithA(D_VALID, a));
+    expect(row?.a).toBe(a);
+  });
+
+  it("rejects: a tag missing entirely", () => {
+    expect(parseReview(eventWithA(D_VALID, undefined))).toBeNull();
+  });
+
+  it("rejects: malformed a (only one colon)", () => {
+    expect(parseReview(eventWithA(D_VALID, `38172:${REVIEWER}`))).toBeNull();
+  });
+
+  it("rejects: malformed a (no colons)", () => {
+    expect(parseReview(eventWithA(D_VALID, "garbage"))).toBeNull();
+  });
+
+  it("rejects: a's kind doesn't match the k tag", () => {
+    // k=38172 but a says 38173 — disagreement → reject.
+    expect(parseReview(eventWithA(D_VALID, `38173:${REVIEWER}:${D_VALID}`, 38172))).toBeNull();
+  });
+
+  it("rejects: a's pubkey isn't 64-char hex", () => {
+    expect(parseReview(eventWithA(D_VALID, `38172:not-hex:${D_VALID}`))).toBeNull();
+  });
+
+  it("rejects: a's d portion doesn't match the event's d tag", () => {
+    const otherD = "f".repeat(64);
+    expect(parseReview(eventWithA(D_VALID, `38172:${REVIEWER}:${otherD}`))).toBeNull();
+  });
+
+  it("rejects: a's d portion is empty", () => {
+    expect(parseReview(eventWithA(D_VALID, `38172:${REVIEWER}:`))).toBeNull();
   });
 });
 
diff --git a/packages/core/src/reviews/parse.ts b/packages/core/src/reviews/parse.ts
index 919ebf9..ad06b36 100644
--- a/packages/core/src/reviews/parse.ts
+++ b/packages/core/src/reviews/parse.ts
@@ -26,6 +26,10 @@
  * Parse rejects (returns `null`):
  *   - `event.kind !== 38000`
  *   - missing or non-string `d` tag
+ *   - missing or non-`"38172"|"38173"` `k` tag (P0.3 — NIP-87 requires
+ *     the `k` tag to be the kind number being recommended; events without
+ *     it can't be routed to the right d-shape gate, so they're rejected
+ *     at parse rather than silently defaulted to Cashu)
  *
  * Parse does NOT reject on Layer A d-shape — the upsert gate handles that
  * so the parser stays pure and callable from tests, pagination dedup, etc.
@@ -41,20 +45,27 @@ const MAX_RATING = 5;
 /**
  * Content rating: `N/5` anchored at start. Tolerates leading `[` and
  * surrounding whitespace. Captures N.
+ *
+ * Anchoring at start is intentional: when a reviewer leads with `N/5`,
+ * that's the explicit signal. A `[N/5]` mid-content would be commentary
+ * about somebody else's rating, not the author's. Re-exported from this
+ * module (P1: rating-regex unification — nip87/parse.ts had a separate
+ * un-anchored `(\d(?:\.\d+)?)\s*\/\s*5/` that was a hidden conflict
+ * with this anchored canonical form).
  */
-const CONTENT_FIVE_REGEX = /^\s*\[?\s*(\d+)\s*\/\s*5\b/;
+export const CONTENT_FIVE_REGEX = /^\s*\[?\s*(\d+)\s*\/\s*5\b/;
 /**
  * Content rating: `N/10` anchored at start — for clients that use a
  * 10-point scale. Divide by 2 to normalize into 1..5.
  */
-const CONTENT_TEN_REGEX = /^\s*\[?\s*(\d+)\s*\/\s*10\b/;
+export const CONTENT_TEN_REGEX = /^\s*\[?\s*(\d+)\s*\/\s*10\b/;
 /**
  * Leading run of star emoji, 1..5 count. Matches `⭐` (U+2B50) and `🌟`
  * (U+1F31F) interchangeably — some clients render one, some the other,
  * some use the variation-selector form. Captures the whole run so we can
  * count code points (via the `u` flag).
  */
-const CONTENT_EMOJI_REGEX = /^\s*((?:⭐|🌟)+)/u;
+export const CONTENT_EMOJI_REGEX = /^\s*((?:⭐|🌟)+)/u;
 
 /** Pull the first value of a named tag (or undefined). */
 function firstTagValue(tags: string[][], name: string): string | undefined {
@@ -176,8 +187,16 @@ function parsePointerKind(tags: string[][]): 38172 | 38173 | undefined {
 
 /**
  * Parse a kind:38000 event into a ReviewRow. Returns `null` when the event
- * is the wrong kind or is missing the required `d` tag. Layer A d-tag
- * shape validation is deferred to the upsert layer.
+ * is the wrong kind, is missing the required `d` tag, or is missing the
+ * required `k` tag with value `"38172"` or `"38173"` (P0.3 — NIP-87
+ * mandates the `k` tag).
+ *
+ * Also returns null when the required `a` tag is missing or malformed
+ * (P1 — NIP-87 reviews reference their target via `a` of form
+ * `<kind>:<pubkey>:<d>`). The parsed `a` is exposed on the row as the
+ * spec-blessed dedup pointer.
+ *
+ * Layer A d-tag shape validation is deferred to the upsert layer.
  */
 export function parseReview(event: NostrEvent): ReviewRow | null {
   if (event.kind !== 38000) return null;
@@ -185,6 +204,23 @@ export function parseReview(event: NostrEvent): ReviewRow | null {
   const d = firstTagValue(event.tags, "d");
   if (d === undefined || d === "") return null;
 
+  // P0.3: k tag is REQUIRED per NIP-87 ("the k tag is the kind number that
+  // corresponds to the event kind being recommended"). The prior
+  // upsert-time fallback (default to Cashu) silently misrouted Fedimint
+  // reviews and let malformed events through. Rejecting at parse keeps the
+  // upstream stats accurate (rejectedByParse++) and means upsert can
+  // assume `k` is always set.
+  const k = parsePointerKind(event.tags);
+  if (k === undefined) return null;
+
+  // P1: a tag is REQUIRED per NIP-87 ("optional `a` of form
+  // <kind>:<pubkey>:<d>" — but when announcements live across multiple
+  // signers / replays, the `a` tag is the only unambiguous mint pointer.
+  // Per the conformance brief we now require it on parse). Validates to
+  // `<kind>:<hex-pubkey>:<d>` with kind matching `k`.
+  const a = parseATag(event.tags, k, d);
+  if (a === undefined) return null;
+
   const content = typeof event.content === "string" ? event.content : "";
   const rating = parseRatingFromTags(event.tags) ?? parseRatingFromContent(content) ?? null;
 
@@ -192,6 +228,8 @@ export function parseReview(event: NostrEvent): ReviewRow | null {
     pubkey: event.pubkey,
     kind: 38000,
     d,
+    k,
+    a,
     eventId: event.id,
     createdAt: event.created_at,
     content,
@@ -199,11 +237,49 @@ export function parseReview(event: NostrEvent): ReviewRow | null {
     rating,
   };
 
-  const k = parsePointerKind(event.tags);
-  if (k !== undefined) row.k = k;
-
   const u = allTagValues(event.tags, "u");
   if (u.length > 0) row.u = u;
 
   return row;
 }
+
+/**
+ * Parse and validate the `a` tag — NIP-87 reviews reference their target
+ * mint via `a` of the form `<kind>:<pubkey>:<d>`. Returns the canonical
+ * string when valid, `undefined` when missing / malformed.
+ *
+ * Validation rules:
+ *   - The tag's value must be a string.
+ *   - The format is `kind:pubkey:d` (3 colon-separated parts).
+ *   - `kind` must match the parsed `k` tag (so a review can't claim
+ *     `["k","38172"]` while pointing its `a` at a Fedimint federation).
+ *   - `pubkey` must be 64-char lowercase hex (event signer shape).
+ *   - `d` must match the review's own `d` tag — they're meant to align
+ *     per the spec.
+ *
+ * Strict matching keeps the spec contract intact. The audit's P1 entry
+ * specifically calls out a "review with malformed a tag rejection test"
+ * as a regression target.
+ */
+function parseATag(tags: string[][], k: 38172 | 38173, d: string): string | undefined {
+  const aRaw = firstTagValue(tags, "a");
+  if (aRaw === undefined) return undefined;
+  // Format: <kind>:<pubkey>:<d>. Use indexOf to split rather than `split(":")`
+  // because the `d` portion could conceivably contain a colon (the spec
+  // doesn't forbid it). Only the first two colons are structural.
+  const firstColon = aRaw.indexOf(":");
+  if (firstColon <= 0) return undefined;
+  const secondColon = aRaw.indexOf(":", firstColon + 1);
+  if (secondColon <= firstColon + 1) return undefined;
+  const kindStr = aRaw.slice(0, firstColon);
+  const pubkeyStr = aRaw.slice(firstColon + 1, secondColon);
+  const dStr = aRaw.slice(secondColon + 1);
+  if (dStr.length === 0) return undefined;
+  // kind must equal the k tag.
+  if (kindStr !== String(k)) return undefined;
+  // pubkey must be 64-char lowercase hex.
+  if (!/^[0-9a-f]{64}$/.test(pubkeyStr)) return undefined;
+  // d must equal the review's own d.
+  if (dStr !== d) return undefined;
+  return aRaw;
+}
diff --git a/packages/core/src/scheduler/index.test.ts b/packages/core/src/scheduler/index.test.ts
index 31ce019..30e3cc6 100644
--- a/packages/core/src/scheduler/index.test.ts
+++ b/packages/core/src/scheduler/index.test.ts
@@ -164,8 +164,12 @@ describe("scheduler — pipeline (single event)", () => {
     const db = await freshDB();
     const { pool, pushEvent } = makeFakePool();
     const pubkey = "02".padEnd(66, "b");
+    // Wrong pubkey, but valid hex (so P0.1 normalization treats it as a
+    // candidate signer source — a non-hex value would silently drop and
+    // produce `no-signer-source`, which the scheduler maps to null, not
+    // false).
     const { fetcher } = makeFetcher({
-      "https://mint.example.com": "02".padEnd(66, "z"),
+      "https://mint.example.com": "02".padEnd(66, "f"),
     });
     const sched = createScheduler({ db, pool, fetcher, relays: ["wss://test"] });
     await sched.start();
@@ -257,14 +261,19 @@ describe("scheduler — pipeline (single event)", () => {
     const sched = createScheduler({ db, pool, fetcher, relays: ["wss://test"] });
     await sched.start();
 
+    // Use a 64-char hex reviewer pubkey for the synthetic `a` tag — P1
+    // requires `a`'s pubkey portion to be 64-char hex.
+    const reviewerPk = "1".repeat(64);
+    const targetD = "02".padEnd(66, "a");
     await pushEvent({
       id: "review-1",
       kind: 38000,
-      pubkey: "reviewer1".padEnd(64, "0"),
+      pubkey: reviewerPk,
       created_at: 1_700_000_000,
       tags: [
         ["k", "38172"],
-        ["d", "02".padEnd(66, "a")],
+        ["d", targetD],
+        ["a", `38172:${reviewerPk}:${targetD}`],
         ["rating", "5", "5"],
       ],
       content: "[5/5] solid",
@@ -277,6 +286,170 @@ describe("scheduler — pipeline (single event)", () => {
     expect(sched.getStats().accepted).toBe(1);
   });
 
+  it("P0.3/P1: review rejected at parse increments rejectedByParse", async () => {
+    // Gap 1: `parseReview` returns null when the k tag is missing (P0.3),
+    // the a tag is missing (P1), or the a tag is malformed (P1 — kind
+    // mismatch, bad pubkey shape, d mismatch). Each of those parse rejects
+    // increments `stats.rejectedByParse` in the scheduler and never touches
+    // the reviews table. This pins that wiring end-to-end — the layer that
+    // catches a malformed event at parse (rather than Layer A at upsert)
+    // is observable via the right stats bucket, not silently absorbed.
+    const db = await freshDB();
+    const { pool, pushEvent } = makeFakePool();
+    const { fetcher } = makeFetcher({});
+    const sched = createScheduler({ db, pool, fetcher, relays: ["wss://test"] });
+    await sched.start();
+
+    const reviewerPk = "1".repeat(64);
+    const targetD = "02".padEnd(66, "a");
+
+    // Case A: missing k tag (P0.3).
+    await pushEvent({
+      id: "review-missing-k",
+      kind: 38000,
+      pubkey: reviewerPk,
+      created_at: 1_700_000_000,
+      tags: [
+        ["d", targetD],
+        ["a", `38172:${reviewerPk}:${targetD}`],
+        ["rating", "5", "5"],
+      ],
+      content: "[5/5] no k tag",
+      sig: "fake",
+    });
+    await settle();
+    expect(sched.getStats().rejectedByParse).toBe(1);
+    expect(sched.getStats().accepted).toBe(0);
+    expect(await db.reviews.count()).toBe(0);
+
+    // Case B: missing a tag (P1).
+    await pushEvent({
+      id: "review-missing-a",
+      kind: 38000,
+      pubkey: reviewerPk,
+      created_at: 1_700_000_001,
+      tags: [
+        ["k", "38172"],
+        ["d", targetD],
+        ["rating", "5", "5"],
+      ],
+      content: "[5/5] no a tag",
+      sig: "fake",
+    });
+    await settle();
+    expect(sched.getStats().rejectedByParse).toBe(2);
+    expect(sched.getStats().accepted).toBe(0);
+    expect(await db.reviews.count()).toBe(0);
+
+    // Case C: malformed a tag (kind mismatch — claims k=38172 but a.kind=38173).
+    await pushEvent({
+      id: "review-malformed-a",
+      kind: 38000,
+      pubkey: reviewerPk,
+      created_at: 1_700_000_002,
+      tags: [
+        ["k", "38172"],
+        ["d", targetD],
+        ["a", `38173:${reviewerPk}:${targetD}`], // kind mismatch vs k
+        ["rating", "5", "5"],
+      ],
+      content: "[5/5] malformed a",
+      sig: "fake",
+    });
+    await settle();
+    expect(sched.getStats().rejectedByParse).toBe(3);
+    expect(sched.getStats().accepted).toBe(0);
+    expect(await db.reviews.count()).toBe(0);
+
+    await sched.stop();
+  });
+
+  it("P0.2: no-signer-source persists as null, not false", async () => {
+    // Gap 2: P0.2 allows a Cashu mint to omit `info.pubkey`, and P0.1
+    // widens the signer source to also include `info.contact.[method=nostr]`.
+    // When BOTH are absent on an otherwise-ok /v1/info response, Layer B
+    // returns `no-signer-source`. The scheduler must persist that as
+    // `verifiedBySignerBinding === null` (genuinely unverifiable — retry
+    // eligible) rather than `false` (real negative verdict). The
+    // `verdictForPersistence` helper explicitly maps no-signer-source → null
+    // via the "only pubkey-mismatch is a real negative verdict" branch.
+    //
+    // This pins end-to-end: push an announcement whose /v1/info exposes
+    // neither pubkey nor contact.nostr, then assert the persisted row's
+    // verifiedBySignerBinding is exactly null (not false, not true). A
+    // regression to "false" here would silently hide retry-eligible mints
+    // from the UI's "unverified but trying" bucket.
+    const db = await freshDB();
+    const { pool, pushEvent } = makeFakePool();
+    const pubkey = "02".padEnd(66, "3");
+    // Custom fetcher: returns ok with NO pubkey and NO contact.nostr entry.
+    const fetcher: MintInfoFetcher = async (): Promise<MintInfoResult> => ({
+      ok: true,
+      info: {
+        name: "pubkey-less mint",
+        contact: [{ method: "email", info: "ops@example.com" }],
+      },
+    });
+    const sched = createScheduler({ db, pool, fetcher, relays: ["wss://test"] });
+    await sched.start();
+
+    await pushEvent(makeAnnouncement({ pubkey, d: pubkey, u: ["https://mint.example.com"] }));
+    await settle();
+
+    const row = await db.announcements.get([pubkey, 38172, pubkey]);
+    expect(row).toBeDefined();
+    // The load-bearing assertion: null distinguishes "couldn't verify yet"
+    // from "verified and failed". A regression to `false` would mean a
+    // spec-conforming pubkey-less mint is permanently flagged as invalid.
+    expect(row?.verifiedBySignerBinding).toBeNull();
+
+    // The /v1/info response was parsed successfully — a diagnostic
+    // MintInfoRow is written with ok:false and the reason, so the UI can
+    // explain why the row is un-verified while still displaying it.
+    const mintInfo = await db.mintInfo.get(pubkey);
+    expect(mintInfo?.ok).toBe(false);
+    expect(mintInfo?.lastError).toBe("no-signer-source");
+
+    // Note on stats: the current scheduler increments `layerBFailed` for
+    // every non-verified result (including transient/null verdicts). The
+    // null persistence is the correctness contract this test locks in;
+    // the stats-bucket naming is an observability detail tracked
+    // separately. If/when the scheduler splits transient-vs-real into two
+    // counters, this assertion should be updated.
+    expect(sched.getStats().layerBFailed).toBe(1);
+    expect(sched.getStats().layerBVerified).toBe(0);
+
+    await sched.stop();
+
+    // PR #30 restart-replay behavior: rows with verifiedBySignerBinding=null
+    // are re-enqueued on scheduler restart so a transiently-unverifiable
+    // mint gets another chance. We verify the re-enqueue by restarting a
+    // fresh scheduler on the same DB and confirming the fetcher is called
+    // again.
+    const { pool: pool2 } = makeFakePool();
+    let secondCallCount = 0;
+    const fetcher2: MintInfoFetcher = async (): Promise<MintInfoResult> => {
+      secondCallCount += 1;
+      return {
+        ok: true,
+        info: {
+          name: "pubkey-less mint",
+          contact: [{ method: "email", info: "ops@example.com" }],
+        },
+      };
+    };
+    const sched2 = createScheduler({
+      db,
+      pool: pool2,
+      fetcher: fetcher2,
+      relays: ["wss://test"],
+    });
+    await sched2.start();
+    await settle();
+    expect(secondCallCount).toBeGreaterThanOrEqual(1);
+    await sched2.stop();
+  });
+
   it("kind:0 profile flows into profiles table; kind:10002 into relayLists", async () => {
     const db = await freshDB();
     const { pool, pushEvent } = makeFakePool();
diff --git a/packages/core/src/scheduler/index.ts b/packages/core/src/scheduler/index.ts
index 1e8fc36..81e3c95 100644
--- a/packages/core/src/scheduler/index.ts
+++ b/packages/core/src/scheduler/index.ts
@@ -426,6 +426,10 @@ export function createScheduler(config: SchedulerConfig): Scheduler {
    *
    *   - verified=true                       → true   (real positive verdict)
    *   - verified=false, all-fetches-failed  → null   (transient — re-try later)
+   *   - verified=false, no-signer-source    → null   (transient — mint exposes
+   *                                                   no usable signer source;
+   *                                                   genuinely unverifiable
+   *                                                   per P0.1 / P0.2)
    *   - verified=false, pubkey-mismatch     → false  (real negative verdict)
    *   - verified=false, anything else       → null   (defensive — treat as transient)
    *