docs: record wgcloak v1 release state

docs/IMPLEMENTATION_CHECKLIST.md

@@ -1,9 +1,11 @@
 # Implementation and acceptance checklist
 
-This is an evidence-based coordinator checklist. A checked item identifies
-current code and tests; it is not a claim that the dirty worktree is an
-unconditionally released artifact. The latest evidence was collected on
-2026-09-19 with serial integration tests.
+This evidence-based checklist records the implementation and license baseline
+at commit `5767b90` (`release: finalize wgcloak v1 under GPLv3`). The final
+documentation closeout is the only work that follows that baseline; the gates
+below were run against the committed implementation. Package metadata and
+`LICENSE` use SPDX `GPL-3.0-only`. Optional deferred work is called out
+explicitly and is not treated as an unimplemented v1 transport.
 
 ## Milestones 1–6
 
@@ -31,12 +33,18 @@ unconditionally released artifact. The latest evidence was collected on
   `tests/tls_tcp.rs`, `tests/integration_transports.rs`, and TLS cases in
   `tests/encrypted_runtime.rs`; the TLS/TCP head-of-line tradeoff is documented
   in `docs/PROTOCOL.md`.
-- [ ] **6 — operational polish:** Control, validation, hardened systemd units,
-  capability guidance, deterministic benchmark assets, and fuzz targets are
-  present (`src/control.rs`, `tests/control.rs`, `packaging/systemd/`,
-  `benches/`, `fuzz/`). Leave this milestone open until final clean-checkout
-  gates, bounded cargo-fuzz runs, and the practical datagram cap decision are
-  recorded. Config/certificate reload remains explicitly unsupported.
+- [x] **6 — operational polish:** Control, validation, hardened systemd units,
+  capability guidance, deterministic benchmark assets, fuzz targets, and
+  installation documentation are present (`src/control.rs`, `tests/control.rs`,
+  `packaging/systemd/`, `benches/`, `fuzz/`, `README.md`). The configured
+  default is 1,200 bytes and the validated project ceiling is 16,384 bytes.
+  Oversized-datagram metrics remain visible in aggregate status/statistics;
+  `src/server/mod.rs::record_transport_drop` and
+  `oversized_transport_error_is_counted_once` cover the latest repaired
+  boundary accounting.
+  Config/certificate reload remains explicitly unsupported; cargo-fuzz smoke
+  execution and environment-sensitive network benchmarking are optional
+  deferred validation artifacts.
 
 ## v1 completion criteria (spec §89)
 
@@ -73,8 +81,8 @@ unconditionally released artifact. The latest evidence was collected on
   capability — `User=wgcloak`, hardening, and commented narrow
   `CAP_NET_BIND_SERVICE` guidance in both `packaging/systemd/*.service` files.
 - [x] 14. TOML configuration is clearly validated — `src/config.rs` tests and
-  `tests/server_capabilities.rs` cover role, transport, listener, and datagram
-  boundaries.
+  `tests/server_capabilities.rs` cover role, transport, listener, and the
+  1,200-default/16,384-ceiling datagram boundaries.
 - [x] 15. Meaningful status and statistics are available — `src/control.rs`,
   `tests/control.rs`, `tests/runtime_lifecycle.rs`, and aggregate-stat tests in
   `tests/http3_runtime.rs`.
@@ -95,14 +103,15 @@ unconditionally released artifact. The latest evidence was collected on
 - [x] Fuzz targets exist for direct packets, TLS frames, HTTP/3 parsing, and
   TOML parsing, and `cargo check --manifest-path fuzz/Cargo.toml` passes.
   No fuzzing execution or sanitizer result is claimed because `cargo-fuzz` is
-  not installed on the current host.
-- [ ] `cargo test`, formatting, linting, and documented integration/bench
-  commands pass from a clean checkout. Current dirty-worktree evidence is:
-  `cargo fmt --all -- --check`, `cargo check --all-targets`, strict all-target
-  Clippy, serial `cargo test --tests -- --test-threads=1` (95 passed), and
+  not installed on the current host; this is optional deferred validation.
+- [x] Release gates passed against the committed `5767b90` implementation
+  baseline before this documentation closeout: `cargo fmt --all
+  -- --check`, `cargo check --all-targets`, strict all-target Clippy,
+  `cargo test --tests -- --test-threads=1` (100 passed),
+  `cargo check --manifest-path fuzz/Cargo.toml`, and
   `cargo bench --bench protocol_transports --no-run`.
 - [x] Review confirms no payload/secret logging, no unsafe privilege grant,
   and no accidental WireGuard/routing/firewall coupling. Evidence:
   `docs/SECURITY.md`, hardened systemd templates, source audit, and the
-  authentication/control/secret-file tests. This review does not waive the
-  clean-checkout and fuzz-execution items above.
+  authentication/control/secret-file tests. Config/certificate reload remains
+  an explicit unsupported optional feature.