• Decision: Original-destination resolver is fail-closed: on a tuple miss, apply a bounded retry, then RST — never forward to a default. Every definitive miss increments a metric and logs the source tuple.
• Reason: No safe default exists for a transparent proxy; forwarding to a default would be an open-relay/SSRF bypass.
• Trade-off: A genuinely un-redirected connection to the relay port is dropped rather than served.
• Scope: Feature 01.
• Date: 2026-09-09
• Status: active