• Decision: Capture with in-process gopacket pcapng + embedded DSB as the default; keep tcpdump as an optional fallback/parity backend. Offer a pcap + separate keylog split mode.
• Reason: DSB makes the capture self-decrypting; pure-Go avoids an external dependency; split mode allows independent retention of ciphertext and secrets.
• Trade-off: Two capture backends to keep at parity.
• Scope: Feature 03.
• Date: 2026-09-09
• Status: active — except the pcap + separate keylog split mode, which is descoped from the MVP (no code path; see 03-capture-harness/spec.md Edge Cases) and deferred to a follow-on.