Includes the rustls finding (it does not verify key/certificate pairing) so the explicit check is not later mistaken for redundant, and the archi-dev-box caveat: it has no HTTPS dashboard, so it cannot reproduce the iframe failure. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>