[Bikebrainz]

Reflected-XSS checks could classify Content-Type parameters as HTML, select the wrong repeated media type, mistake custom tags for raw-text elements, and treat iframe fallback text as executable content. Persisted proxy certificates were also reused after CA replacement or private-key corruption, breaking HTTPS after restart.

This integrates three reviewed changes:

• Parse effective media types across repeated and comma-combined Content-Type fields; preserve quoted parameter commas and unknown-type sniffing behavior.
• Recognize exact HTML raw-text tag names, iframe fallback text and abrupt comment endings. Add native, browser and public-API cases.
• Verify cached certificate signatures using the current CA, match the private key's public component and require the requested DNS/IP subject alternative name before reuse. Regenerate stale or damaged files; retain valid cached leaves. Certificate details are also available in Validate persisted proxy certificate caches before reuse #23; HTML-context details are in Correct reflected XSS raw-text and comment boundaries #24.

The public changelog and generated roadmap include every change. Reflected-XSS parity moves to partial because separate browser comparisons reproduce remaining template and SVG context gaps. Live CA replacement and cache-management controls remain unfinished.

Validation before integration:

• Full local Windows media-type build: 102 native suites, 191 public-API checks, 50 runtime checks and 72 pinned Chromium comparisons passed.
• HTML-context fix: 285 native assertions and 95 pinned Chromium comparisons passed; resolved 66 of 68 reproduced mismatches, with the two remaining context gaps recorded in the roadmap.
• Certificate-cache fix: original implementation reproduced stale-CA/key mismatch failures; full local app passed 64 runtime checks including strict HTTPS, valid reuse, damaged/mismatched keys, invalid signatures, wrong/missing SANs and CA replacement.
• Website: 81 Markdown targets, 3 script-integrity hashes and 117 pages passed; desktop/mobile roadmap and changelog checks passed.

Combined local validation passed: 102 native suites, 196 probe checks, 64 runtime checks, 167 XSS browser comparisons and all seven broader browser workflows. The first probe run missed three HTTP OAST callbacks; an isolated rerun passed all 196 checks, and this intermittent test behavior remains a follow-up. An additional 1,238 generated media-type comparisons against pinned Chromium passed with zero mismatches. All eight cross-platform CI jobs passed on final head 685301c4978075cd65647b95d96864ab15ba1f0f (run 36540846886). #21 is merged into the default branch.