The getattr(bundle_ctx, '_ctx', bundle_ctx).cert_store_stats() hedge asserted nothing a non-empty certifi bundle would not satisfy either way. Assert instead that platform_ssl_context() returned the (bundle, union=True) cached context, which goes red if the platform path ever builds a replacing (union=False) bundle context. Fold3 finding 2 (quality Low).