harden IPv4/IPv6 and Windows/Wine verification

[mark-e-deyoung]

Summary

• fix CLI TCP framing, exact partial I/O, response-size validation, and IPv4-only connection logic
• add tested DNS, IPv4, bracketed IPv6, and scoped-IPv6 endpoint parsing with AF_UNSPEC resolution
• make the live Windows matrix exercise complete CLI/daemon framed requests for HTTP/HTTPS × IPv4/IPv6
• make MinGW artifacts self-contained, explicitly link the Windows Compression API dependency, and repair cross-compiler ABI warnings
• embed and extract-validate the GUI manifest (Common Controls v6, PerMonitorV2, long-path awareness)
• repair the control, daemon lifecycle, HTTP, and v2 TLA+ checks; add bounded control audit trace replay
• remove the hosted-runner TSAN sysctl mutation and pin TSAN to the compatible Ubuntu 22.04 runner
• replace a detached rendezvous-test timing race with deterministic worker ownership/joining
• record current Windows/Wine network evidence and the GitHub Actions minutes pause

Root causes

Wine execution exposed a protocol bug: the CLI reused the network-byte-order frame header as the host-order payload length and assumed every send/recv completed in one call. The client also used sockaddr_in and first-colon endpoint parsing, so IPv6 was not actually supported. A strict MinGW build additionally exposed a legacy const ABI mismatch, missing cabinet linkage, and an undeclared toolchain-specific libmcfgthread-2.dll deployment dependency.

The formal CI had ineffective BFS -depth assumptions, over-broad message domains, invalid invariants, terminal deadlocks, and vacuous properties. The revised finite models are exhaustive where practical and use explicit DFID for v2.

Validation

• MSVC Release build: pass
• test_core: 5 consecutive passes after rendezvous synchronization fix
• GUI ViewModel tests: 2/2 pass
• discovery integration test: pass
• native Windows HTTP/HTTPS + framed TCP × IPv4/IPv6 matrix: 4/4 pass
• embedded GUI manifest extraction and XML assertions: pass
• strict MinGW GCC 16 build with warnings as errors: pass
• Wine 10.0 clean-prefix IPv4 HTTP + framed CLI/TCP health: pass
• Wine 10.0 IPv6 evidence: wildcard bind succeeds; this Debian container reports WSAEADDRNOTAVAIL for ::1, documented as an unavailable-runtime matrix cell
• formal checks: 7/7 pass (Handshake 780/192; v2 156,928/96,000; Daemon 119/39; Control 221,847/8,946; HTTP 6,553/937; Transport 56,252/6,250; Address 34/33 generated/distinct states)
• Wine compatibility policy and fixtures: pass, 0 warnings/errors
• clang-format gate: pass
• TSAN and strict Linux builds: pass locally

GitHub-hosted workflows remain administratively disabled because Actions minutes do not reset until 2026-08-01. No workflows were dispatched or rerun.

Advances #304. Remaining address-family work is tracked for TLS-wrapped TCP, rendezvous, discovery/mDNS, browser/UI zone handling, and RFC 8305 concurrent Happy Eyeballs.

Stacked on #306.