• Decision: capture.Writer (internal/capture/pcapng.go) flushes pcapgo.NgWriter's internal bufio buffer on a bounded interval (200ms, always immediately on the first packet) and once right after construction (the initial SHB/IDB), instead of only in Close. Makefile's build target gained a LINK_MODE variable controlling CGO_ENABLED for bin/app (static default since commit 1c14582; dynamic opt-in — it was dynamic-default when first introduced).
• Reason: A live rootful pod bring-up (this session) reproduced a real bug: dump.pcapng sat at 0 bytes on disk for an entire session because pcapgo.NgWriter buffers internally and nothing flushed until sidecar teardown (Close) — every prior Verifier pass missed this because the relevant e2e tests are root/tshark-gated and skip in CI/dev sandboxes. Flushing after literally every packet was tried first and reverted: it is a real write(2) syscall per packet, which cannot keep up with a bursty flow (e.g. a TLS handshake) and causes AF_PACKET receive-queue drops — an interval bound gives the same "readable while live" guarantee without that throughput cost. Separately, pod_e2e_test.go's buildSidecarBinary and the documented manual build step both relied on the host's ambient CGO_ENABLED default (dynamic on this box), silently producing a binary that cannot exec inside the musl/Alpine sidecar image unless the operator remembered AD-009's static-build requirement by hand.
• Trade-off: Interval flushing bounds on-disk staleness to ~200ms instead of guaranteeing every packet is immediately visible; LINK_MODE was initially left dynamic-default to avoid silently changing make build's output for non-container use; commit 1c14582 subsequently made static the default, since the project uses no cgo and the container images need it.
• Scope: Feature 03 (internal/capture, Makefile, deploy/podman/).
• Date: 2026-09-17
• Status: active