Changed

The external-dependency model is now stated once. The glossary carries a "Dependency model" entry defining the three tiers (npcap required, Wireshark recommended, the Wireshark extcap integration optional) to match the fragcap doctor severities; the README and the Getting Started guide summarize and link to it rather than restating the tiers, so the tool and the docs cannot drift.

The stale loopback framing is corrected across the README, the glossary, and the master specification: current Npcap installs loopback capture support automatically, so it is no longer a separate installation option to enable. The one option that still matters, WinPcap API compatible mode, is kept. The docs now also state that npcap is by the Nmap Project and that the Wireshark installer bundles it.

fragcap doctor now recognizes a machine-wide Wireshark extcap registration, not only the per-user one. The analyzer extcap check reports ok when the fragcap binary is present in either the current user's Wireshark extcap directory or the machine-wide (system) one, and names which scope registered it. Previously a second user on a machine where fragcap was registered machine-wide (the MSI's machine-wide option, slice 043) saw the "not registered" optional warning even though Wireshark could see the source. The machine-wide directory is resolved from the same HKLM\SOFTWARE\Wireshark registry value the MSI registers into, so a non-default Wireshark install location is recognized too, with the Program Files path as a fallback. Detection stays read-only, and the not-registered case is still an optional warning.

fragcap doctor output is easier to read and now identifies itself: it opens with the fragcap version and the paths to the running binary, the user profile directory, and the hint database, separates its sections with blank lines, colors the status flags when writing to a terminal, and wraps long lines to a normal terminal width. Redirected output, output with NO_COLOR set, and the --json form stay plain.

The glossary "Technique denylist" entry is now an actual list. The six denylisted techniques (packet interception drivers, code injection, function hooking, memory-read process handles, layered service providers, and executable image modification) each get their own item with a plain-language gloss of what the technique is and one line on why it is off-limits, naming the permitted alternative that observes from outside the target. The enforcement note and the P-1 framing are preserved. Documentation only; the denylist itself is unchanged.

The vendored brand kit under brand/ is refreshed to version 1.1.0, a presentation and completeness pass over the resolved 1.0.0 identity rather than a re-decision of it. Every brand immutable is unchanged: Geist Mono, Signal Cyan #27C7E7, Capture Orange #FF5300, and the dark-first #050708 ground. The logo, wordmark, and favicon masters are redrawn as clean filled paths, and the favicons and social preview are re-rendered from them.

What the refresh adds is deliverable rather than decorative: a Fault color (#E9505F on dark, #C0293A on light) for the failure state the earlier palette had no color for; a semantic token layer (--fc-bg, --fc-fg, and their kin) plus a .fc-light class so the light reading mode is expressible in code; tokens/base.css and tokens/spacing.css; a components/ set, guidelines/index.html, styles.css, a SKILL.md, and a measured VERIFY.md whose numbers are re-derived from the shipped files. The version 1.0.0 --fragcap-* CSS variable names are retained as aliases of the canonical --fc-* tokens, so nothing that consumed the old names breaks. The documentation site single-sources both its palette (now including the Fault swatch) and its logo, favicon, and guide assets from brand/, so the site and the kit cannot drift.