# First-release implementation review The implementation was reviewed against `40cf3276cdc74bf6f1795990ed600891a637d1fe`. Independent standards and specification reviews inspected candidate `d608ffe`. Corrections followed in the same branch. Review findings do not establish that the release acceptance matrix has passed. ## Standards The standards review found no hard repository-rule violations and three design observations: - Numeric TUI screen state allowed a subscription row to be clamped against the configuration list. Refresh now uses the current screen's row bounds. - Entry validation used free-form strings. Saved entries now use a serialized status enum, and the storage boundary rejects contradictory validation/connection data. - The controller created Xray probes directly while activation used the runtime boundary. Probe creation now goes through that boundary as well. Standards findings: three design observations, zero hard violations. The row-selection bug was the most consequential observation and is corrected. ## Spec The specification review found five correctness issues: - Retry could bypass a failed activation preflight. Runtime retries now require successful compatibility checks, and each managed Xray service start repeats the version check. - An unset selection could reuse a TUN left by the previous controller. Startup first blocks forwarding, and no-selection reconciliation stops the owned core and removes capture. Enabled selection changes block forwarding before committing new state. - An untrusted local listener could impersonate the probe's SOCKS endpoint. The adapter now generates a private TLS identity for an authenticated HTTPS proxy. Diagnostic requests authenticate that identity before using the proxy, so a reused TCP port cannot authorize a different route. - Manual diagnostic requests ignored provider cooldowns. Retry-After now prevents further diagnostic requests to that provider, including manual Ping and Speed. - Competing HTTP and measurement timeouts could turn a completed duration-limited Speed observation into a generic error. Diagnostics now use one measurement deadline and report consumed bytes when the duration cap ends a nonempty measurement. Spec findings: five correctness issues, corrected. The stale-selection forwarding path was the most serious finding. VM CLI regressions cover failed preflight retries and startup with stale capture and unset selection. The continued validation below covers probe TLS transport and duration/rate-limit behavior using non-TUN fixtures. Qualification of the full managed lifecycle on the required current Xray runtime remains pending. ## Validation boundary After the user's VM-only instruction, all test execution used the supplied ALT VM. Compilation and formatting used the local checkout. The VM checkpoint precedes package/test preparation and is restored after validation. The current package available from that VM's refreshed Sisyphus repository is Xray 26.3.27. The implementation rejects activation with it. The tests distinguish actual guard/controller/polkit/editor/recovery behavior and fixture-backed diagnostics from unverified native-TUN forwarding and managed-probe lifecycle operation with the researched newer Xray contract. The product installer is not counted as a successful installation in this environment; system-bus tests stage their integration fixtures explicitly. The initial available suite passed on 2026-10-30: 10 Rust CLI/controller acceptance tests and 21 VM workflow checks. The [captured output](validation/linux-vm.txt) records the tested executable digest and each result. Checks include TCP and UDP DNS destination policy, IPv4/IPv6 blocking, retained incoming connections, denial/allow authorization, ordinary-user TUI restoration, editor privacy, failed-preflight retries, stale capture with unset selection, malformed TOML recovery, missing durable state, and uninstall retention/purge. ## Continued implementation and review Independent standards and specification reviews compared candidate `7999fab` against `fc3c1d51b1be9db6ba6ad286584fbc34bb305f38`. Standards found no actionable issues. Spec found one P2 issue: a JSON error document larger than the diagnostic prefix could count as a successful Speed download. A bounded-memory scanner now checks top-level error markers throughout consumed response chunks. Controller acceptance checks cover long error values, late and escaped error keys, legitimate nested payload fields, and HTML after long leading whitespace. All pass. The continued work also corrected diagnostic CLI exit status after provider rejection and stale successful observations after probe startup failure. Probe sessions now use the runtime boundary, and both production and acceptance fixtures share the authenticated HTTPS proxy configuration. Networking units use a shared dependency drop-in so the guard starts first. The final available suite passed on 2026-10-30: 20 Rust acceptance tests and 29 VM workflow checks. The [continued captured output](validation/linux-vm-continued.txt) records the tested executable digest and results. All tests ran only on the supplied ALT VM. The diagnostic fixtures used its distribution-owned Xray 26.3.27 in non-TUN mode, a temporary trusted CA, an authenticated HTTPS proxy, a real Trojan TLS connection, and a local HTTPS provider. Checks covered TLS failures without direct fallback, redirects and error documents, byte/time limits, both Retry-After header forms, cancellation, scheduling, and CLI failures. Temporary certificates and trust anchors were removed afterward. System checks used actual terminal polkit/PAM authentication with wrong and correct temporary fixture passwords, cancellation, and noninteractive denial. A real VM reboot retained enabled/blocked intent, and the guard became active before NetworkManager. SIGKILL and SIGSTOP checks retained protection; explicit recovery persisted disabled intent before releasing it. The reboot fixture deliberately had no selected configuration, so it does not qualify successful native-TUN forwarding after reboot. The required Xray 26.10.29 distribution package was unavailable in the refreshed VM repository. Production compatibility requirements remain unchanged. Full native-TUN forwarding, successful managed-probe startup, and the product installation lifecycle on that package remain unqualified. The VM checkpoint was restored after this run.