feat(core): put the first packet of a fresh UDP flow in targeting scope

[donislawdev]

Closes the last two open items from the engine handoff: point 3 (UDP not covered by the
fresh-flow fix) and point C (the recycled-PID window, "known edge, never reproduced").

The gap, and how big it actually was

decide() step 1 asked the live socket map only when is_syn, and is_syn is set for TCP
alone. UDP has no SYN, so it was never asked. For a long-lived flow that costs one packet -
but DNS over UDP and QUIC take a fresh ephemeral port per exchange, so it cost all of
them.

Acceptance, master worktree against this tree on the same machine. 8 DNS queries from fresh
sockets, the probe holding one socket open so _pids cannot be the hidden variable,
--target <probe> --dst-ip 8.8.8.8 --dst-port 53 --loss 100 --filter out:

tree	queries answered	scoped_seen	drop_loss
master	8 of 8	0 of 1944 captured	0
this branch	0 of 8	8	8

The master column is the finding in its purest form: with a process target set, not one
packet of 1944 was ever in scope. The branch column cross-checks exactly.

The shape was chosen by measurement, and the measurement reversed my recommendation

I first proposed "ask on every miss" on the strength of a microbenchmark of one call (185 ns)
plus reasoning that the difference between variants was negligible. That reasoning was the
thing being asked about, so it got measured properly - each variant as a real byte patch of
core.py, fresh subprocess, three traffic mixes x three map sizes, median of 5:

map / mix	today	every miss	syn or not tcp	difference
400 / tcp-bulk	799	997	788	+209
10 000 / tcp-bulk	796	1056	790	+266
100 000 / tcp-bulk	834	1052	833	+219
100 000 / mixed	865	1030	934	+96
100 000 / udp-heavy	819	1028	1017	+11

(ns per decide(), every packet missing.) The chosen form is free on TCP-heavy traffic -
within noise of today - while the other costs ~26% of decide(). Map size barely matters
(400 -> 100 000 ports is ~35 ns), so this is about how often each variant asks, not about the
lookup. ProcessTargeting.syn_covers is renamed owner_targeted, since the old name became a
lie about when it runs.

Point C: the window is measured, not asserted

owner_targeted trusts the pid without verifying identity (verifying is create_time() in
the packet path, convention 20). The docstring claimed "up to one resolver cycle (0.30 s)"
with nothing behind it. Measured against the real socket table - no WinDivert or admin needed,
portmap reads iphlpapi - seven rounds per transport:

transport	median	range
TCP	309 ms	271-327
UDP	315 ms	290-325

The routine 0.30 s tick and no more, and TIME_WAIT does not stretch it - worth checking
rather than assuming, since a TCP socket can outlive its owner. Chasing real Windows PID reuse
was deliberately skipped: hitting the same number inside 0.30 s needs a spawn storm at
~30-50 ms per process, and "we tried and it did not reproduce" is an expensive non-result.

The price is named where it belongs: covering UDP widens that false positive from one SYN
per connection to every UDP datagram of such a socket. Ordinary TCP data is still never asked,
so an established connection cannot be dragged in.

A mutant found a real hole rather than confirming a test

Mutating owner_targeted to ignore the portless case went green - the core test drives a
_FakePorts double with its own implementation, so it never touched the code under test. Same
trap F16 recorded, hit from a different direction. And that line was newly load-bearing:
ICMP is not TCP, so every ping now calls owner_targeted(None) on the capture thread. It
has its own guard against the real class now, and the core test says which half it pins.

Verification

• python -m pytest tests - 721 passed, 0 failed on an elevated shell (718 -> 721, three
  new guards).
• python smoke_gui.py - OK.
• Seven mutants across the two chunks, all caught on their intended assertion.
• Both READMEs updated (the socket-events bullet now says "connection or UDP flow", naming
  DNS and QUIC). No em/en dashes, LF endings intact.

🤖 Generated with Claude Code