fix: continue Vane 1.0.0-rc.1 production blocker remediation

[lulushuz]

Status

P0-06 IMPLEMENTED; PRIVILEGED DNS ACCEPTANCE STILL BLOCKED

STARTUP REGRESSION: FIXED
DNS READINESS FAIL-CLOSED: FIXED
PATTERN SETTINGS ROLLBACK: FIXED
LINUX FIREWALL COMMAND FAIL-CLOSED: FIXED
DNS KILL SWITCH TRANSACTION FAIL-CLOSED: FIXED
WINDOWS NETSH REMOVE REGRESSION: FIXED
ROLLBACK FORWARDER IDENTITY: FIXED
ACCEPTANCE HARNESS FIREWALL DISCOVERY: FIXED
REDUNDANT FORWARDER RESTART: FIXED
WINDOWS PORT 53 REBIND: FIXED
WINDOWS PRIVILEGED DNS ACCEPTANCE: FAILED — forwarder queries timed out
WINDOWS PRIVILEGED KILL SWITCH ACCEPTANCE: NOT EXECUTED
PRODUCTION RELEASE: BLOCKED

Source

• PR head: 2cc77b0ee820b2c07ea924f5ba9dd988def04164
• Verify run: 30850187914 — passed
• Package/evidence run: 30850210878 — passed
• Draft PR remains open and unmerged.

P0-06 automated validation

• Identical active config reuses the existing owned forwarder after local readiness verification
• Reuse preserves handle and generation and skips spawn, system DNS, firewall, and metadata mutation
• Concurrent identical requests serialize through the transaction manager
• Changed config stops once and uses bounded bind attempts: immediate, 50 ms, 150 ms, 300 ms
• Only AddrInUse/Windows 10048 is retried; TCP partial bind drops UDP before retry
• Provider apply refreshes get_doh_forwarder_status; UI changes Start to Stop without a second start command
• Provider and toggle transactions share a non-overlapping busy gate
• Frontend: 158/158 — passed; production build passed
• Rust: 332/332 — passed; all-target/all-feature tests and Clippy passed
• Release build and 15-second non-privileged startup smoke passed

Package evidence

• Artifact: unsigned-rc-1.0.0-rc.1-2cc77b0ee820b2c07ea924f5ba9dd988def04164
• Artifact ID: 8870485672
• Artifact digest: sha256:4b99076e750df4451013086726b9b41b3375c57efbd21635a8d7c20a0417bb38
• Artifact size: 4,289,597 bytes
• Artifact expires: 2026-08-17T20:33:55Z

Gate-02R admin retest

• Admin session: true
• WARP adapter/UI: off and stable
• External DPI tools, Vane DPI engine, and Kill Switch: off
• Provider apply count: 1
• Start-forwarder command count after provider apply: 0
• UI forwarder button after provider apply: Stop
• UDP/TCP 127.0.0.1:53: listening, owned by Vane PID 21544
• Wi-Fi 2 and Ethernet 2 DNS: 127.0.0.1
• System and explicit localhost DNS queries: failed by timeout across two attempts and multiple domains
• Clean stop: passed; DNS baseline restored; port/firewall/process residue: 0

Remaining blockers

• Functional upstream DNS forwarding in privileged Windows Session A
• Windows privileged Kill Switch acceptance: not executed
• Linux privileged acceptance: not executed
• Windows Authenticode signing: not executed
• Tauri updater signing: not executed
• Linux distribution: blocked

Production

PRODUCTION RELEASE: BLOCKED