docs(internal): #69 two-port HTTP serving + session log update

Author: Reiers

internal-notes/ARCHITECTURE-OVERVIEW.md

@@ -4,10 +4,25 @@ _Ground-truth map, read top-to-bottom 2026-06-15 from local clone at HEAD `ab038
 Single source for "how everything ties together." Keep current._
 
 _Session 2026-06-15 PM: GH numbering note — internal-notes "C#NN" ≠ GitHub issue NN.
-Go by GitHub numbers. Closed this round: #74 (gossipsub head-tracking verified),
-#65 (pdp_data_sets failure-count drift). Opened: #78 (revert-only ChainNotify
-ERROR noise), #79 (re-arm prove_at_epoch on drift-recovered datasets). Fork HEAD
-moved a97f1c48 → 04532a3f (proofClearsLocalFailure + tests)._
+Go by GitHub numbers. Closed this round: #74 (gossipsub verified), #65 (failure-count
+drift), #67 (wake-at-write Notify), #69 (two-port + autocert TLS). Opened: #78
+(revert-only ChainNotify noise), #79 (re-arm prove_at_epoch). Re-scoped: #24 (P1→P2,
+paralysis risk already mitigated by adopted backpressure caps, gated on #2). Fork HEAD
+a97f1c48 → 0e523f0c. curio-core HEAD → 99c28cb._
+
+## HTTP serving (two-port model, #69 — NEW 2026-06-15)
+
+Default deploy needs **no nginx**. `cmd/curio-core/main.go` builds two route sets:
+- **Public** (`--public-listen`): `/pdp/*` + `/piece/*`. TLS via baked-in
+  `golang.org/x/crypto/acme/autocert` when `--public-tls-domain` set; ACME HTTP-01 +
+  HTTP→HTTPS on `--acme-http-listen` (:80). Refuses :443 without a domain.
+- **Admin** (`--admin-listen`, defaults to legacy `--listen`): dashboard + `/setup` +
+  `/admin/*`. Loopback-only.
+- `internal/httpserve` owns listener Build/Run/shutdown. `internal/acmecache` =
+  `autocert.Cache` over the `autocert_cache` SQLite table (migration 0014).
+- **Back-compat:** empty `--public-listen` → single listener via `combinedRouter`
+  prefix-dispatch (NOT chi.Mount — that double-prefixes full-path muxes to /pdp/pdp/).
+  cc-smoke runs this single-port mode unchanged.
 
 ## One-line