Module model 

What the kernel attributed to whom, and what it means (§12d).

Structs

Change

One attributed change: object names what was touched (an interface, a route prefix, a rule, an nft table or chain), so a later removal of the same object undoes it. steers is whether it currently steers traffic (§12d: a default or all-covering route, a catch-all rule, DNS on the unit’s interface, the system proxy, a dropping or redirecting firewall rule); an interface by itself steers nothing.

Claims

The tracker’s claims, as .state keeps them across a restart of the watch (a dot-file the hold does not read).

Endpoint

Footprint

A unit’s footprint as the files carry it.

FootprintView

Everything the hold needs, read back from the files (or scripted by the fake): the watch, why .unattributed stands (empty: it is absent), and the footprint of each network tool, keyed by its file name (crate::file_name).

Invocation

What netwatch knows of a unit’s latest invocation, from its cgroup.

Latch 🔒

The latch: an invocation found protecting once stays protecting, with the iface and endpoint lines that justified it, until a new invocation replaces it (reviewer, coordinator, Nov 3). What stands after a tool dies is not what it did: a tun-based VPN’s interface leaves with its last process, before its cgroup goes, with no netlink request.

Standing 🔒

The objects a unit has changed that still stand, and whether each one steers traffic.

Tracker

Each unit’s current footprint, kept from the kernel’s reports (or the fake’s script). apply takes one attributed change; lost records an event the ring buffer dropped; view renders what the files carry.

Enums

ChangeKind

The kind of object a netlink message touched.

Owner

Who made a change: a unit (its cgroup), or nobody the kernel could name.

Proto

WatchState

The watch’s state, as .watch carries it.

Functions

fresh 🔒

Fresh: at most FRESH_SECS old and at most AHEAD_SECS ahead.