- New Capabilities: PortPair, Negation, RejectAction,
FamilyWithoutAddress, DenyActionFromConfig, advertised per backend.
- coversDirection isolates DirForward even when output is unowned;
add splitNATDualRow so a concrete-family removal re-adds the opposite
family's NAT translation.
- Resolve ip6tables/ufw ICMPv6 type aliases; ParseNATKind rejects the
"invalid" sentinel as input while JSON round-trips it.
- Sync counts additions on mid-batch failure and uses RuleBatcher.
- NewManager runs a probe loop joining each backend's reason for
diagnosability; services.go drops "generated" from enabled, handles it
on enable, clears start-limit-hit on restart, and matches rc.local by
token.
- nftables: per-source connection limits (meter set), quoted-token
parsing preserving log-prefix spacing, digit-led prefix sanitizing.
- apf/csf: deny-action-from-config with cached STOP settings, port lists
and inexpressible shapes routed through the pre-hook, confKeyApplies
guard against a missing config line.
- atomic config writes fsync before rename and resolve symlinks;
readConfValue is last-assignment-wins; runCommand preserves the exit
code through the wrapped error.
- Move coreos/go-systemd to the maintained v22 module directly.
