generated desired state, validated but not applied
Every name the platform answers on should get a real certificate. Names that resolve to the origin but match no route fall through to a default, self-signed one — a small leak, a real annoyance, and the kind of thing that gets fixed by…