docs/acme.md and jarl-lego show lego 5's commands (lego run, which also renews; lego migrate when upgrading) beside lego 4's. A new section explains why lego on a host inside a split DNS fails its own propagation check when the challenge goes into the external view only (JARL_VIEW, a one-view token, httpreq's /view/...), and the ways round it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>