Use shared domain validation and normalization for application, service, and preview domains so unsafe host input is rejected consistently. Cover command-substitution payloads in application domain tests.