Changed

Managed Deep Capture now defaults to full launch-chain application inspection and retains packet evidence for exact session-created launch processes through route-owner release, including proven intermediate and helper processes. Explicit game-only inspection still uses blind middleware relay without narrowing packet evidence; older scope-policy facts cannot qualify the new default.

The signed direct-route foundation reconciles the owner-approved Deep Capture policy and includes official WinDivert 2.2.2-A in both MSI and ZIP packages with its license and corresponding source. Package certification checks exact component identity, and read-only Doctor reports static readiness. S200 and S201 complete selected final-client routing and public controls in this release. Hosted audit also prompted rusqlite 0.41.1 and bundled SQLite 3.54.1 for RUSTSEC-2026-0459, with a Rust 1.89 minimum.