Fixed

After client observation, route-owner cleanup now requests bounded close and force for exact receipt-backed session-created helpers, including helpers absent from declared launch stages. Missing ownership proof leaves an unresolved cleanup obligation instead of silently releasing the route.

Deep Capture now reports transport-ended TLS handshakes and structured invalid TLS messages separately, preserving the accepted connection, handshake stage, transport category, and any explicit peer alert. A completed CONNECT remains distinct from successful TLS or inspected HTTP work.

Start the bounded first-packet candidate wait at WinDivert receipt, reconsider exact socket and process proof before expiry, and promptly reinject a proven helper or unrelated owner. The qualified bound is 100 ms with 300 ms socket-event retention, backed by controlled selected-route and unrelated-continuity measurements. WinDivert queue loss before receipt remains unmeasurable.

Current documentation and frozen replay authority now identify the independently verified v0.10.14 files and all ten published crates. Managed client handoff continuity, causal diagnostics, exact-game ownership, current-user storage, blind middleware relay, and scope-aware calibration are described as shipped while unperformed installed and real-title behavior remains explicit.