[cppla]

Summary

• Freeze official Debian browser package archives so unchanged browser versions remain installable after mirror rotation. Keep signature/package-hash verification; disable only historical metadata expiry per frozen source.
• Add native ARM64 browser/driver pins and matching fixed-baseline binary selection. Reject host/engine architecture mismatches.
• Correct the active cover fixture's H3 Alt-Svc policy to match the existing relay policy, with real H1/H2/H3 regression tests. Product behavior and strict header comparisons are unchanged.
• Preserve resource requirements, workloads, first-attempt accounting and statistical gates.

Validation at 6a7039a

• Go 1.26.8: make check, stealth-tools checks, full-lab self-test, targeted cover tests and probe race tests passed.
• All 14 GitHub checks passed. Independent source review found no blocker.
• Native ARM small pilot completed on a frozen private host-bound child of 80cf208 (only private host binding changed): four real-browser H2/H3 readiness checks; 65/65 first-attempt captures; no retries. Capture time was 6m48s. No full corpus was started.
• Offline extraction passed for 65 captures and 49 features. Capture hashes, ledger and privacy checks passed. Classification and audit correctly remain insufficient_evidence (one sample per cell; the preregistered classifier requires 500). No statistical or browser-indistinguishability claim is supported.
• Offline analysis reused a verified immutable ARM runtime containing the pinned Python/TShark versions; its image archive and provenance were retained. The fresh network-disabled runtime build did not succeed, so this is not represented as a successful fresh wrapper build.
• First local Docker 3-iteration smoke at 80cf208 failed 24/75 records because the H3 control omitted Alt-Svc. Zero tested marker leaks and zero negative-request dials; later stages were not run. This first failure is preserved.
• A separate post-fix smoke passed: AutoCAR 75 records (69 equivalent responses plus six authenticated dials), fixed baseline 54/54 equivalent, blackhole cover 12/12, and transition/healthy/new-flow-blackhole/Gecko checks. It used the pre-commit working-tree form of the final patch and is smoke evidence, not a release gate.

Scope and evidence

Private host bindings, credentials, PCAPs and raw operational artifacts are not part of this PR. The frozen capture checkout was not changed after collection started. Both failed and successful smoke evidence are retained separately. Owned test containers/networks were cleaned up; evidence remains preserved.

This PR repairs test infrastructure and enables a reproducible native ARM pilot. It does not establish comparative superiority.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.