Docs: mark Phase 3 implemented (conversations, follow stream, DNS/TLS explorers, statistics)

README.md

@@ -20,11 +20,11 @@ capture or analysis.
 |---|---|---|
 | 1 | Installer, services, auth, AP / DHCP / DNS / firewall, health | implemented |
 | 2 | dumpcap capture, pcapng storage, live analyser, filters, export / import | implemented |
-| 3 | Conversations, follow TCP stream, DNS/TLS explorers, statistics | not started |
+| 3 | Conversations, follow TCP stream, DNS/TLS explorers, statistics | implemented (HTTP explorer deferred) |
 | 4 | Optional HTTPS inspection (mitmproxy, client-trusted CA) | not started |
 | 5 | Hardening, advanced UI, benchmarks | partial |
 
-Pages for later phases are not in the UI. PiLens never shows controls that do
+HTTP Explorer (Phase 3 in the spec) is deferred with Phase 4, since useful HTTP content requires interception. Pages for later phases are not in the UI. PiLens never shows controls that do
 nothing. For what was tested and how, see [docs/testing.md](docs/testing.md).
 
 ## Quick start

docs/architecture.md

@@ -167,6 +167,7 @@ dumpcap -i IF [-f BPF] -w -  ──pcapng──▶ splitter ──▶ seg-000001
 
 ## Not yet implemented (phase 3+)
 
-These pages are not in the navigation until they work: conversations / follow
+Implemented since Phase 2: conversations, follow TCP stream, DNS explorer, TLS
-TCP stream, DNS/TLS/HTTP explorers, statistics, findings, TLS interception
+explorer (metadata only), statistics. Not in the navigation until they work:
-(modes B and C), and scheduling.
+HTTP explorer and TLS interception (modes B and C, deferred together), findings,
+and capture scheduling.

docs/limitations.md

@@ -7,9 +7,13 @@ versions, ALPN; for TLS 1.2: certificates). The optional HTTPS inspection mode (
 CA via mitmproxy) is **not implemented** in this version, and even when it is, it will not work
 against certificate pinning, private trust stores, mutual TLS, QUIC, or apps that bypass proxies.
 
-**Not yet implemented:** conversations view, follow TCP stream, DNS/TLS/HTTP explorers,
+**Not yet implemented:** HTTP explorer, findings/diagnostics rules, capture scheduling,
-statistics charts, findings/diagnostics rules, capture scheduling, the strict inspection mode,
+the strict inspection mode, WireGuard, packet comparison. They are not shown in the UI.
-WireGuard, packet comparison. They are not shown in the UI.
+
+**TLS explorer shows metadata only.** SNI, ALPN, negotiated version and cipher, plus any
+certificate sent in the clear (TLS ≤1.2). TLS 1.3 encrypts the certificate, so the certificate
+tab is usually empty — this is expected, not a fault. "Follow TCP stream" reconstructs the
+transport payload, which for TLS is ciphertext.
 
 **IPv6** is blocked for AP clients rather than routed (see network.md).