# Implementation checkpoint

Prerequisites unavailable here: Docker/Linux runtime, production-volume clone and RouterOS hardware. The user has no separate test stand; native checks are wired into CI and remain pending actual execution. Implementation and local verification cover F1/F2/F3, including a browser check of the 100k-entry paged list. Astra accepted the final feature/security package and benchmark CI wiring, with no open confirmed P1/P2 blockers. Local implementation is accepted; native release acceptance remains pending.

Root's final local suites passed: API 281 tests, shared 22, frontend 42, with 21 mounted UI checks recorded. The earlier 274-test checkpoint is superseded. The final fresh Windows in-memory run passed all 1611 requests, zero 429s, all raw/fleet/deduplication assertions and the bounded 100k import summary. Its separated steady profile observed new-ingestion p95 11.09ms and timeseries p95 8.07ms; the unconstrained host is not native target-host acceptance. Earlier mixed-profile results and full measurement limitations are documented in [runtime-validation.md](runtime-validation.md).

| Stage | Scope | Status | Acceptance still required |
| --- | --- | --- | --- |
| 0 | Baseline, preparation, ReUI | partial | ReUI skill updated to `68f0e6fa91`; root confirmed premium CLI `@reui/settings-2 --dry-run` passed (10 hypothetical files; no installation). Run reproducible baseline on Linux; collect initial-route/browser measurements and registry evidence |
| 1 | Security and data preservation | implemented, local checks passed | Representative native DB upgrade, production recovery rehearsal and matching pre-upgrade backup procedure remain pending |
| 2 | Reliable policy application | implemented, local checks passed | Linux CI and RouterOS application/failure/recovery against real packets and agents remain pending |
| 3 | Sources and policy evaluation | implemented, local checks passed | Representative live-source and long-duration capacity checks remain pending |
| 4 | Trustworthy telemetry | implemented, local checks passed | Counter resets, timestamps and mixed-agent versions against native traffic remain pending |
| 5 | Analytics and storage | implemented, native acceptance pending | Local analytics/coverage/retry checks exist; long-duration retention, DB growth and Linux capacity measurements remain pending |
| 6 | Frontend speed and ReUI | implemented, local/browser checks recorded | Native network/navigation measurements remain pending; asset growth is disclosed below |
| 7 | Operations and Docker | implemented, CI wired | Actual built-image smoke, previous-image upgrade, recovery, digest provenance and constrained performance result remain pending CI/Linux |
| 8 | New F1/F2/F3 features | implemented, local checks passed | F1 diagnostics/source health/explain IP-port/analytics CSV; F2 TTL overrides/snapshots/canary/rollback/webhooks/one-time enrollment/token rotation; F3 labels/preview and guarded group assignment/IPv6. Native agents still require CI/hardware |

Operations now include identity-scoped rate limits, durable bounded audit and webhook outboxes, secret masking, fail-closed encrypted webhook storage, DNS-pinned HTTPS delivery, online SQLite backup/restore tooling, generated contract drift checks, per-run Docker builders with effective GC verification and a digest-pinned previous-image release upgrade gate. Review fixed queued-webhook cancellation after endpoint changes and signing-master exposure through settings/install context. The quality workflow now invokes the real benchmark harness after smoke against the exact same immutable image ID, with a disposable 2-vCPU/4GB container and a 500ms steady ingestion/timeseries p95 gate. Relevant PRs and every CD quality invocation run this job; a failed native benchmark blocks release.

Root's browser check loaded the 100000-entry global list as a 100-row page, then searched the final entry `11.1.134.159/32`: exactly one result appeared and input focus remained intact. This confirms whole-list server filtering and bounded rendering for that scenario.

Final build artifacts: all JS/CSS assets 1908807 bytes raw / 590263 bytes gzip (+6.90% / +9.42% from the recorded baseline); bootstrap 871972 / 243973 bytes (+1.54% / +1.65%). Gzip figures are generated artifact sizes, not measured network transfer. Features increased total assets; no bundle-size reduction is claimed.

The Linux CI harness creates fresh network/mount/PID namespaces for nft and ipset independently, exercises IPv4/IPv6 traffic denial, drift repair, invalid-candidate preservation and unrelated rules. Its control-plane fixture now returns the exact report ID and sequence required by the durable telemetry sender; a pure acknowledgement-contract regression passes locally. Shell/Python validation is not native execution. Built-image startup/native SQLite, backup/upgrade, resource baselines, Docker-network traffic and RouterOS remain explicit pending gates.

Backend implementation/checks: [backend-hardening.md](backend-hardening.md). Frontend implementation/checks: [frontend-validation.md](frontend-validation.md). Runtime commands, actual constraints and pending gates: [runtime-validation.md](runtime-validation.md). Update this checkpoint only with observed integration evidence; a unit test alone does not complete a stage.