diff --git a/HANDOFF.md b/HANDOFF.md
index 0e74333..1345d76 100644
--- a/HANDOFF.md
+++ b/HANDOFF.md
@@ -3,6 +3,25 @@
 Context for the next session/developer. Pairs with [`README.md`](README.md) and
 [`MCMS_API.md`](MCMS_API.md).
 
+## Last session (2026-05-31)
+
+Landed on `main`: a multi-agent code-review pass (correctness / concurrency /
+security / cleanup — see [`CHANGELOG.md`](CHANGELOG.md)), then removal of the
+self-signed TLS option (system trust only, parity with the Android client).
+
+> ⚠️ **Verify on the next Mac build.** The code-review fixes were confirmed
+> building on the Mac, but the **self-signed-TLS removal was merged to `main`
+> un-compiled** — the Linux dev box that made the change has no Swift toolchain.
+> First thing next session: build `main` and confirm it compiles. It's a small
+> change (removed `ServerTrustPolicy.allowSelfSignedForHost` + the Settings
+> toggle; the trust `switch` stays exhaustive), so it should be clean.
+
+TLS consequence: **system trust only** now — a self-signed appliance (the lab box
+`mcms.lab.svorka.net`) is unreachable until its CA is installed on the device
+(MDM/configuration profile), or it gets a CA-trusted cert. `CHANGELOG.md` is
+written to port these changes to the Android side. Merged branches
+`code-review-fixes` and `remove-self-signed-tls` can be deleted.
+
 ## Status
 
 Feature-complete and (per off-device typecheck + the user's Xcode builds)