Decisions

2026-11-06: Advance current v0.10.14 publication markers, documentation coverage, frozen review candidate, and six exact asset authorities only after merged source, annotated tag, ten successful post-merge workflows, four successful tagged jobs, normal protected registry approval, six independently downloaded files, and ten non-yanked downloaded registry archives reconcile. Retarget the published replay label to these verified bytes. Preserve the v0.8.0 predecessor, historical evidence, and unperformed independent whole-product review status. Hosted installed certification and portable workstation observation do not establish an unelevated local MSI upgrade or real-title success.

2026-11-06: Keep one bounded packet queue and one writer-held head while awaiting late process proof, and keep the packet sink active until route-owner release. Version the inspection policy as v2 so prior positive facts remain historical evidence, and retain the existing database schema because the policy identity is already stored. Advance the candidate Windows package smoke contract and its exact validator to exact-game-v2; the current harness also accepts the immutable v1 policy when replaying the published contract, which its released validator checks independently.

2026-11-06: Review of PR #575 required passive Capture to avoid all managed process-object receipts, the pending writer to re-resolve loopback orientation after each proof publication within one finite allowance, and the managed acquisition loop to honor packet bounds reached before final-client acquisition. The resulting regressions exercise each boundary directly.

2026-11-06: Classify EOF, reset, abort, and broken pipe as an observed TLS transport end only when no structured TLS cause is present. Walk a finite nested error source chain to retain structured rustls invalid-message and peer-alert evidence. Leave generic invalid-data errors unknown, preserve the existing trust, client-auth, pinning-signal, and protocol classes, and do not infer the closer or target behavior from a transport end. The existing version-one connection diagnostic, application artifact, and compatibility authorities carry the new stable codes without a schema migration. Controlled launcher/updater-like loopback exchanges demonstrate the supported path; private-title and direct-socket outcomes remain separate.

2026-11-06: Hosted short performance evidence found that the QUIC fixture released its selected UDP client port before creating the client endpoint. Keep the Quinn endpoint bound while establishing the proxy UDP association, so the fixture cannot race another socket for that port. This changes only the controlled measurement harness, not the shipped proxy or the frozen performance authority.

2026-11-09: Owner-approved #572 and #577 replace the absolute interception-driver ban with a precise separation between passive Npcap Capture and explicitly selected, bounded Deep Capture direct diversion. Constitution 2.0.0 retains no target memory access, injection, hooks, in-place game-file edits, silent global proxy changes, or disruption of unrelated traffic. Detected anti-cheat products remain evidence, not eligibility gates. Voluntary non-memory target key export is research #580; proxy-owned key logs remain separate.

2026-11-09: Select official WinDivert 2.2.2-A x64 under its LGPLv3 option as an external packaged component, not a new Rust dependency. Pin the upstream binary and corresponding source archives and selected DLL/SYS hashes, preserve dynamic replacement and source rights, and keep fragcap's Apache-2.0 source identity. Stage the component only in Windows distribution assembly, certify the exact driver signature on a fresh runner, and defer WinDivertOpen to the later authorized route adapter. Static Doctor readiness cannot prove a future driver open or game compatibility.

2026-11-09: Select a future session-scoped dynamic load of the exact packaged DLL after direct-route authorization. S199 introduces no binding or driver handle. Upstream installs the driver on demand at WinDivertOpen with Administrator rights and says an already-running driver may remain until the next reboot after files are removed. The S199 installer matrix proves owned file removal and does not claim active-service teardown. Read-only Doctor may report a disabled existing service; otherwise runtime blocking remains unverified until the later route adapter attempts its authorized open.

2026-11-09: Hosted audit reported RUSTSEC-2026-0459 in the bundled SQLite version selected by rusqlite 0.40.2. Update the existing rusqlite edge to 0.41.1 and libsqlite3-sys to 0.39.1, whose bundled source declares SQLite 3.54.1. The newer rusqlite requires Rust 1.89, so raise the workspace MSRV, minimum-toolchain gate, audit toolchain and reviewed graph digests together. No new package or graph edge is introduced by this repair. The two isolated fuzz and performance/native-proxy lockfiles also carry the patched versions so their locked audit and short campaign can run.

2026-11-09: The first complete hosted package assembly reached lifecycle certification and exposed a verifier error: Doctor emits JSON Lines, but the new component filter treated each line as a parsed object. Parse each nonempty record before selecting the component check; a local exact-component Doctor fixture confirms the ok readiness record without opening the driver.

2026-11-09: The documentation-closeout head's Ubuntu test run exposed an existing timing-sensitive offline-capture assertion. A five-packet volume stop can interrupt the source before all 24 fixture packets are observed; the file's exact five retained packets and volume-reached reason were already correct. Assert the reported observation count covers those five and cannot exceed the 24-packet source, preserving the test's actual contract.

2026-11-10: Scope S200 across #578, #581, and #582 as one controlled route and native-proxy bridge. The public CLI/calibration entry remains #583 and final operator documentation remains #584. The owner authorized automatic push and official PR publication only after the complete slice gates, with final merge reserved for owner review.

2026-11-10: The owner explicitly approved exact smoltcp 0.12.0 and transitive managed 0.8.0 under 0BSD for the finite local TCP/IP bridge. This is a two-crate exception, not a general license allowlist expansion. The owner also approved keeping official WinDivert despite its unmeasurable pre-WinDivertRecv kernel-queue loss: adapter dispositions are exact only after receipt, and controlled active sentinels must show zero observed missing replies or unexplained loss.

2026-11-10: Disposable Windows probes showed a PID-bearing SOCKET event before the first TCP SYN, but opening an exact NETWORK handle in response still missed that SYN, including the minimized event-to-open path. The event-triggered narrow-handle route fails the positive first-packet gate; driver-free ownership and stack tests do not repair it.

2026-11-10: The owner asked for the scale of a broad packet buffer and explicitly put a brief global pass-through on the table. Short paired loopback probes measured roughly 0.07-0.08 ms of added p99 round-trip delay while the prearmed TCP/UDP handle promptly reinjected unrelated packets. A four-conversation probe completed 2,000 exchanges with 0.52 ms p99 and 0.93 ms maximum round trip; all 4,400 intercepted packets were reinjected, and a separate positive probe caught the first SYN. The owner then approved selecting the broad pass-through. Constitution 3.0.0 changes the packet-interception boundary only for an authorized finite Deep Capture session: unrelated traffic may briefly enter a pass-through queue for header-only candidacy, but its application payload must never enter game inspection or retention; selected routing still needs exact client generation and original destination. Finite waits, a worker-stall watchdog, measured sentinels, packet accounting, and exact cleanup are mandatory. These short probes do not establish sustained-load, fault, or complete route behavior.

2026-11-10: Microsoft's WFP ALE connection redirection can avoid the first-packet race at the connection boundary, but requires a new signed kernel callout driver and a different distribution path. Retain the selected signed WinDivert component for S200 under the owner-approved broad pass-through, subject to the full controlled matrix. No issue closure or complete route claim follows from the probes alone.

2026-11-10: A prearmed broad WinDivert handle and finite smoltcp stack terminated a real loopback TCP first SYN and returned exact raw bytes without the OS listener accepting the connection. The first attempt exposed a Windows loopback IPv4 header checksum that failed smoltcp's software check while WinDivert marked the packet IP-checksum-valid and its TCP checksum verified. Normalize that header only in the private stack copy when the WinDivert flag attests validity; retain software checksum verification for other packets and never alter unrelated reinjected bytes. The narrower live rerun passed, while the proxy bridge and full route matrix remain open.

2026-11-10: A driver-free packet-stack test now sends an admitted raw TCP stream through the native proxy's authenticated SOCKS5 CONNECT path to its original destination and verifies the exact request, reply, half-close, and proxy byte counts. The helper capability is zeroized after negotiation. This is a bridge building block; it does not yet establish live process ownership, receipt correlation, or the full Windows matrix.

2026-11-10: The live direct runtime now prearms a finite broad handle before the selected child starts, joins first packets to SOCKET events and managed process generations, authenticates one-use helper receipts, and passes raw TCP and UDP through the native proxy. Controlled IPv4/IPv6 raw TCP and UDP probes, same-destination unrelated sentinels, original-owner mapping, and a 100 ms worker-progress watchdog passed on disposable Windows runs before HTTP/TLS was added. Pre-receive WinDivert queue loss remains unmeasurable. The current matrix still lacks required failure, mixed-chain, QUIC, and artifact reconciliation rows.

2026-11-10: Direct-owner SOCKS5 CONNECT now dispatches recognized cleartext HTTP and TLS into the existing native protocol engines, while unknown TCP remains byte-transparent. This differs from #582's suggested HTTP CONNECT framing but uses one authenticated helper leg and the same TLS authority, upstream trust, HTTP/2, HTTP/1.1, key-log, and retention components. In a disposable Windows probe, direct HTTP and trusted TLS completed, but a raw all-token prefix waited under the first version's ten-second classification budget and timed out at the client. The classifier now bounds incomplete post-byte prefixes to 100 ms while retaining the normal request timeout before any bytes arrive; a local raw half-close test passes. Full Windows rerun and the remaining matrix are pending.

2026-11-10: The completed disposable Windows route passed raw TCP, inspected HTTP/TLS, opaque TLS, selected IPv4/IPv6 UDP, and direct HTTP/3/QUIC through the same native proxy. A completed QUIC peer can yield Windows UDP ConnectionReset on the helper relay socket; count that signal separately and keep the route running without inventing a lost intercepted packet. A successful hosted run then mapped 20 versioned Windows rows to 18 passing probes with zero skipped rows. Its cold platform-to-publisher-to-client fixture used both final-client direct TCP and UDP while publisher HTTP used the ordinary proxy route, and asserted exact original owner and destination for each direct helper leg.

2026-11-10: Extend the controlled fault matrix with independent driver-open, driver-receive, authentication, absent-listener, writer, packet-send and cleanup-report failures. Failed driver workers close the broad handle; a report-only cleanup fault remains named as unconfirmed even after the handle is released. The versioned manifest maps every required Windows row to an executable probe, and the workflow checks that every listed probe passed with zero ignored tests. Keep pre-receive driver queue loss unmeasurable in product truth; controlled sentinels validate only observable continuity.

2026-11-10: The first official PR CI exposed one stale direct ring edge in each isolated fuzz and native-performance lockfile. Regenerate only those two lockfiles offline, verify all six isolated graphs remain locked, and retain the existing exact dependency policy. Proxy application and compatibility correlation use an original Capture flow ID only when independent retained Capture packet evidence agrees with the direct-route receipt; the helper leg cannot mint packet evidence.

2026-11-10: The first Codex review found two valid route gaps. Bind selected and refused tuples to the exact WinDivert socket endpoint ID, retire the selected stack, helper exclusions and receipt on the matching close event, and keep a stale close from removing a newer owner. Inspect direct TLS ClientHello SNI before issuing the leaf; retain the original admitted IP stream as the network destination while using the DNS identity for both client-facing certificate and separately verified upstream TLS. Add disposable DNS TLS and UDP endpoint-reuse rows to the closed matrix. Do not treat the earlier Windows run as validation of these fixes.

2026-11-10: The first review-fix run passed DNS-name TLS but the second UDP socket bypassed with competing-socket-events. A WinDivert SOCKET CLOSE can omit the remote endpoint, so tuple decoding discarded it and left the prior OPEN current. Retain a bounded original tuple by endpoint ID and PID, recover it on CLOSE, and retire only that exact owner. The subsequent exact-head disposable Windows run passed all 21 probes for 25 required rows with zero skips, including a distinct association for the reused UDP tuple. Both Codex review threads were answered and resolved. Pre-receive driver-queue loss remains unmeasurable; the controlled run observed no sentinel loss.

2026-11-10: The second Codex review found two further gaps: a second HTTPS exchange could reconnect by DNS SNI rather than the admitted IP, and a queued UDP candidate could issue a second receipt for an active tuple and stop the route. Keep the original network authority and TLS identity separate across every reconnect, and feed pending candidates to an exact matching active endpoint before admitting another association. Add a two-request unresolvable-DNS test and a three-datagram live burst row. The first hosted rerun after documentation reconciliation also exposed an intermittent managed-chain helper-count failure; retain that as an open gate until diagnostic evidence and a clean exact-head rerun.

2026-11-10: The second-round code-fix Windows run passed the expanded 26-row, 22-probe matrix and the managed chain. The security review found a hash-to-load DLL replacement window and unbounded session-long event history. Pin each package file and ancestor directory against replacement before hashing and through module release, with a disposable conflicting-access probe. Prune closed socket generations beyond the finite candidate interval while retaining live and recent owner events. Any true event capacity or observer evidence loss releases the broad packet handle and returns a named failure; never silently reinject an established selected flow as a successful route. Revalidate both changes on the next exact head.

2026-11-10: The first security-fix Windows run passed all prior route probes but the new conflicting-access test found that a directory handle opened for attributes alone did not prevent a second delete-access handle. Request directory-list access for each pinned ancestor so Windows sharing checks apply to renames, and require a new live rerun. Add the exact reviewed fail-closed reinjection statement to the P-1 linter allowlist after its hosted docs gate rejected it; leave all other packet-injection sites forbidden.

2026-11-10: The next Windows rerun exposed the earlier intermittent managed-chain failure again: TCP routed, but final-client UDP candidates expired without helper receipts despite no observed packet or socket-event loss. Keep S200's live gate open. Snapshot assertion diagnostics before panicking so the cleanup path and later probes still run, and collect only test-scoped event/owner state at candidate expiry to distinguish late versus missing socket proof. Do not widen the ten-millisecond wait or waive the chain row without evidence.

2026-11-10: The diagnostic-head Windows probe and an independent same-head probe both passed all 27 required rows across 23 executable cases, including the signed-component lock check; the primary hosted package matrix also passed. The intermittent managed UDP chain remains unproven as stable because neither passing run explains earlier candidate expiries. Add five exact managed-chain repetitions to the disposable workflow and require all to pass; any failure stays a route gate with test-only owner/event diagnostics.

2026-11-10: The independent diagnostic-head Windows run completed its package matrix. The repeat-gate PR head passed 27 required Windows rows across 23 executable probes with zero skips and five additional exact managed-chain repetitions. Local cargo xtask ci also passed. Preserve the earlier intermittent UDP candidate expiry as an unverified reliability limit: all delivered packets were accounted for and passed through, but a candidate whose exact socket proof arrives after 10 ms can miss the selected route. Do not claim sustained workstation-load stability or measurable WinDivert pre-receive loss from these controlled runs.

2026-11-10: All eight hosted PR workflows passed on code head 2630cd4, including the full Windows package certification, TShark analyzer, native performance, docs, platform, audit and fuzzing. Both Codex code review rounds and the security review completed; all six inline findings were fixed, answered and resolved. Close the S200 checklist and rerun exact-head CI for the documentation-only closeout before owner review and merge.

2026-11-10: Combine #587, #583, and #584 in S201. The 10 ms S200 candidate hold missed proof publication in the controlled cold chain. Start the S201 qualification sweep at a receipt-origin 100 ms bound, retain socket events for 300 ms, and evaluate available proof before expiry. Keep the separate 90 ms worker-progress watchdog and finite queue. This bound is provisional until exact selected TCP/UDP and parallel unrelated sentinel checks pass; 250, 500, and 1000 ms are comparison values only if needed.

2026-11-10: Add a distinct child-environment+direct-socket-v1 compatibility route identity rather than expanding the historical routing-strategy enum. Schema 15 preserves and labels earlier child-environment facts, so they remain readable and cannot qualify the composite route. A positive composite route fact requires a matched final-client direct-route receipt, native proxy observation, and independent packet evidence. Guided resume retains the selected route identity.

2026-11-10: Add the existing fragcap/direct-route feature to the official CLI build, package identity, Windows integration build, and supply-chain release graph. No third-party package or dependency version is added; the release graph gains a first-party feature edge. The packaged WinDivert hashes and signature contract remain exact. Read-only Doctor and target commands remain ordinary-user operations; live Capture, extcap live capture, CA mutation, and direct-route sessions require the rights exercised by their implementation.

2026-11-10: Preserve the composite route in guided completion commands and refuse user-confirmed positive composite route facts as current evidence. Only observed runs can qualify a positive direct-route fact, and the CLI records one only after the exact final-client receipt, proxy outcome, and passive packet join.

2026-11-10: Package certification now renders notices for S200's already approved 0BSD dependencies, smoltcp 0.12.0 and managed 0.8.0. The supply-chain gate rejects any other package that requires 0BSD to satisfy its declared license expression; dual-licensed packages remain eligible through an ordinary allowed license. This retains the exact exception while admitting the promoted direct-route release graph.

2026-11-10: A second Codex review found that the CLI-side runtime observation list was empty when a positive composite route fact was persisted. Pass the coordinator's retained observations and eligibility windows directly to the fact repository. A positive fact now requires an exact direct receipt in the observation window and binds its final owner to that receipt; environment-only or pre-client records cannot satisfy it. This avoids a second unbounded observation copy in the CLI.

2026-11-10: S202 advances only eleven first-party package versions from 0.10.14 to 0.11.0 and rebinds three measured supply-chain graph digests. Third-party sources, versions, features, package counts, edge counts, exception inventory, and unsafe-review expiry remain unchanged. The unstarted review template follows the candidate workspace version; frozen v0.10.14 publication evidence remains unchanged until independent public readback.