- Shipped
- 23 ஆகஸ்ட், 2026 அன்று 5:31 AM UTC
- Author
- kamo
- Commit
- dfdf625
checkDns only ever latched sslConfirmed to true. A domain whose stored flag was set under the old any-one-host rule therefore kept a green SSL card and an unlocked Enter Workspace even when that very response listed hosts with no certificate. verify-dns now probes every host on each call, so take its answer in both directions. Only the state is updated, not the domain object: every consumer of "is SSL ready" reads the state, and rewriting domain here would change its identity on each check while domain is a dependency of the effect that calls it.