Caddy listens dual-stack, so the ipx_default gateway connects as ::ffff:192.168.64.1, and remote_ip 192.168.64.1 does not match it: every Cf-Access-* header was stripped, the tunnel's too. The browser suite binds Caddy to 127.0.0.1, IPv4 only, so it never saw it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>