(a) run-netns-roaming.sh asserts only ping continuity (<=1% loss) + relay-forwarded==0 — it proves the M2 endpoint-relearn/egress-redirect property only transitively, unlike its sibling money tests. run-netns-registration-hijack.sh carries a genuine positive witness (a raw Lookup(A) probe before/after, byte-identical reflexive). Give roaming an equivalent direct witness (log-grep relearn_endpoint / raw-capture of the learned source addr). (b) 7 tunnel_netns.rs wrappers (dpi_undetectability, quic/tls_classified, port_plausibility_oracle, reality_probe_serves_decoy, relay_tls/reality_tunnel_ping) are never invoked by --exact in the privileged CI (real coverage is the .sh scripts run directly); in unprivileged ci.yml they SKIP-pass forever with no honesty guard. Silent-drift risk. Delete them or loop them into the dpi-undetectability job.
See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.
(a) run-netns-roaming.sh asserts only ping continuity (<=1% loss) + relay-forwarded==0 — it proves the M2 endpoint-relearn/egress-redirect property only transitively, unlike its sibling money tests. run-netns-registration-hijack.sh carries a genuine positive witness (a raw Lookup(A) probe before/after, byte-identical reflexive). Give roaming an equivalent direct witness (log-grep relearn_endpoint / raw-capture of the learned source addr). (b) 7 tunnel_netns.rs wrappers (dpi_undetectability, quic/tls_classified, port_plausibility_oracle, reality_probe_serves_decoy, relay_tls/reality_tunnel_ping) are never invoked by --exact in the privileged CI (real coverage is the .sh scripts run directly); in unprivileged ci.yml they SKIP-pass forever with no honesty guard. Silent-drift risk. Delete them or loop them into the dpi-undetectability job.
See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.