Docs: mark Phase 3 implemented (conversations, follow stream, DNS/TLS explorers, statistics)

docs/architecture.md

@@ -167,6 +167,7 @@ dumpcap -i IF [-f BPF] -w -  ──pcapng──▶ splitter ──▶ seg-000001
 
 ## Not yet implemented (phase 3+)
 
-These pages are not in the navigation until they work: conversations / follow
-TCP stream, DNS/TLS/HTTP explorers, statistics, findings, TLS interception
-(modes B and C), and scheduling.
+Implemented since Phase 2: conversations, follow TCP stream, DNS explorer, TLS
+explorer (metadata only), statistics. Not in the navigation until they work:
+HTTP explorer and TLS interception (modes B and C, deferred together), findings,
+and capture scheduling.

docs/limitations.md

@@ -7,9 +7,13 @@ versions, ALPN; for TLS 1.2: certificates). The optional HTTPS inspection mode (
 CA via mitmproxy) is **not implemented** in this version, and even when it is, it will not work
 against certificate pinning, private trust stores, mutual TLS, QUIC, or apps that bypass proxies.
 
-**Not yet implemented:** conversations view, follow TCP stream, DNS/TLS/HTTP explorers,
-statistics charts, findings/diagnostics rules, capture scheduling, the strict inspection mode,
-WireGuard, packet comparison. They are not shown in the UI.
+**Not yet implemented:** HTTP explorer, findings/diagnostics rules, capture scheduling,
+the strict inspection mode, WireGuard, packet comparison. They are not shown in the UI.
+
+**TLS explorer shows metadata only.** SNI, ALPN, negotiated version and cipher, plus any
+certificate sent in the clear (TLS ≤1.2). TLS 1.3 encrypts the certificate, so the certificate
+tab is usually empty — this is expected, not a fault. "Follow TCP stream" reconstructs the
+transport payload, which for TLS is ciphertext.
 
 **IPv6** is blocked for AP clients rather than routed (see network.md).