First real document, first real pod: it came up at https://194.68.245.79:22198
and every page came back

  502 — OCR upstream pod failed: [SSL: CERTIFICATE_VERIFY_FAILED]
        unable to get local issuer certificate

A direct-TCP pod serves the certificate coderai's OWN CA signed, on a bare IP
that certificate can never name. codai.api.pod_http has always known this: it
pins to pod_tls.ensure_ca() and switches hostname checking off. The fan-out
gateway is async and could not reuse that requests-based module, and I gave it
a bare httpx client — so the one hop that now carries every OCR page was the
one hop with no pod trust.

It keeps TWO clients per event loop, chosen by pod_http.is_pinned_url: the
pinned context trusts only our CA, so using it for everything would reject a
cluster node whose certificate a public CA signed, and sharing one client would
let whichever upstream connected first decide the policy for both.

Worth recording: this was never fan-out-specific. With serve_fanout off, surya
attaches straight to that same https:// IP with its own httpx and fails
identically — `model` mode has never worked against a TLS pod. The gateway is
what makes it fixable in one place.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PxYHWbCAjjjD7A1rhFKtaW