Its Python service wildcard-bound 0.0.0.0:443, which is what silently compromised the reserved measurement address. Two routes on the admin UI would inherit the TLS and certificate already in place, need no extra port, and pick up authentication the standalone receiver never had. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>