Assisted-by: GLM 5.2 via pi

diff --git a/README.md b/README.md
index e9f9c69..34cda6a 100644
--- a/README.md
+++ b/README.md
@@ -19,8 +19,10 @@ A CardDAV server for my family.
 
 A read-only skeleton. Every response in `lib/pro_tacts/web.rb` is hardcoded:
 one principal, one address book, one vCard. Nothing is parsed, stored, or
-looked up yet. The goal of this stage is to get macOS Contacts to display a
-single card, so that later work has a known-good baseline to change.
+looked up yet. macOS Contacts displays the hardcoded card over Tailscale
+serve as of 2026-08-14, so later work has a known-good baseline to change.
+See `docs/plans/2026-08-12-one-card-on-macos.md` for what that milestone
+established.
 
 The hardcoded responses are **not** the minimal set macOS needs. They were
 assembled from what working servers send, so some properties are certainly
diff --git a/docs/plans/2026-08-12-one-card-on-macos.md b/docs/plans/2026-08-12-one-card-on-macos.md
index 21bd6d6..1f37672 100644
--- a/docs/plans/2026-08-12-one-card-on-macos.md
+++ b/docs/plans/2026-08-12-one-card-on-macos.md
@@ -120,9 +120,16 @@ minimum.
 
 ## Open questions
 
-- Does Tailscale serve rewrite or drop `PROPFIND` and `REPORT`, or pass
-  unknown methods through untouched?
-- Does the client accept an account with Server Path empty, or does it need
-  the principal URL spelled out? Reports conflict; this milestone answers it
-  for our setup.
-- Does anything break when the same hostname serves both `/` and `/dav/`?
+Answered 2026-08-14, when the milestone landed:
+
+- Tailscale serve passes `PROPFIND` and `REPORT` through untouched. Every
+  request in the debug log arrived with its method and body intact, and
+  nothing was rewritten on the way back.
+- The client accepts an account with Server Path empty. Discovery from the
+  bare hostname completed and the card displayed.
+- Nothing breaks when the same hostname serves both `/` and `/dav/`.
+
+One deviation from the constraints above: `/.well-known/carddav` never
+redirects for the client's `PROPFIND` — it answers directly with a 207,
+which sidesteps the redirect-downgrade trap entirely. Only `GET` on it
+redirects, and the client never issues one during discovery or sync.