AD-003 — Original destination via socket-cookie tuple bridge

Decision: Recover the original destination via connect4 recording by socket cookie, then a sockops (TCP_CONNECT_CB) re-key to (src_ip, src_port); the Go relay resolves via getpeername() + tuple-map lookup. Never use SO_COOKIE/SO_ORIGINAL_DST on the accepted socket.
Reason: The accepted socket is a different struct sock (different cookie); the tuple bridge is the only race-free correlation before SYN.
Trade-off: Needs a byte-order-normalised tuple codec and a sockops program in addition to connect4.
Scope: Feature 01.
Date: 2026-09-09
Status: active