What this closes (audit F17)

A process target that stops matching mid-run was invisible from the CLI. Measured
2026-07-28 on a real capture (elevated, real WinDivert), with the probe narrowed to
--target <pid> --dst-ip 8.8.8.8 --dst-port 53 --syn-drop 100 so nothing else on the
machine could be touched:

So the name path recovers on its own and a restart costs exactly one connection (the
one opened before the process owns any socket - the _pids limit F16 already documents).
The PID path never recovers, because that id is gone. Either way the CLI said nothing.

gui/app.py::_refresh_target re-reads the verdict on every tick and raises a banner, so
the blind spot was precisely on the CI/CD side (convention 18).

Change

• _targeting_state(engine) + transition logging in _report_loop: warn on losing the
  target, info on getting it back. matched is a plain bool on the live
  ProcessTargeting - no lock, no syscall - so the loop asks on every pass. Sampled, not
  continuous, and the comment says so.
• End of run: warn when a target was set, traffic was captured and nothing was in
  scope, plus In scope: X of Y captured packets in the text summary.
• Guarded on seen: with nothing captured at all the capture filter is the story and
  --min-packets is the flag that tells it.

Deliberately not done

No new exit code, no --min-scoped. A target with no traffic of its own is a legitimate
run, and an assertion would change the exit-code contract under everyone already running
one. counters.scoped_seen is in the JSON summary for a pipeline that wants to assert on
it itself. The NDJSON sample schema (frozen contract) is untouched.

Verification

• python -m pytest tests - 717 passed, 0 failed on an elevated shell (was 715).
• python smoke_gui.py - OK.
• Convention guards green (test_repo_conventions, test_cli_docs, test_code_hygiene,
  test_layering).
• Five mutants, all caught, each on its intended assertion: transition logging removed;
  fired every pass instead of on change; zero-scope warning removed; its seen guard
  removed; the In scope line removed.

🤖 Generated with Claude Code