Replicant v0.9.0 — end-to-end review fixes

A defect release from an end-to-end review of the whole codebase (10 subsystem finders, every finding adversarially verified against the real code — 10 of 17 raised survived). Gates were green before and after.

Minor, not patch: one fix changes rendered output. REP-011 on Check Point now carries the source country it used to drop, so a capture of that technique on that vendor gains a field.

Behaved against its own contract

• Scenario runs bypassed the F-08 send lock. run() held the one-sending-run-per-host lock; run_scenario() did not, so a scenario run sent unlocked and a concurrent replicant run could double the eps cap. Fixed, with a real second-process test.
• Check Point dropped the geovelocity source country, blinding REP-011 on one vendor — a country-keyed rule never fired against Check Point logs, on the technique whose whole signal is the changing country. Now rendered on all three vendors (golden lines unchanged).
• A malformed --duration crashed with a raw traceback (and tore down the Rich menu). Now a clean refusal at the model boundary, so CLI, menu and web all reject it the same way.

Robustness and web hardening

• high_entropy_labels hung forever on an impossible request (reachable via param overrides). Now refuses.
• TLS certificate verification, the secure default, was never tested — flipping it to CERT_NONE would have shipped green. Now guarded, with a positive control.
• A header-token API poller minted a session per request, growing tens of thousands of dead sessions in 12h. Only the browser's URL-token navigation mints a cookie now.
• The run-event stream fan-out had no lock, so a tab subscribing at the instant of a publish could miss the terminal event. Now serialized.
• The Docs link sanitizer allowed protocol-relative URLs ([x](//host)). Now rejected.

The method

Nine of the ten guards were run against the unfixed code and observed to fail before being trusted. The tenth, the stream race, has a window that cannot be forced from Python; its guard is a concurrency load test plus mutual exclusion by construction, and is labelled as such rather than dressed up as a forced-red control.

Verified

992 Python + 172 frontend tests, black / ruff / mypy / tsc clean, 11 CI checks including four installer containers and a real systemd unit. The wheel attached here was built from a clean checkout of this tag and smoke-tested in an empty virtualenv outside the repository.

Unchanged and still true: every timing and delivery claim in this project is loopback only. Replicant has not been tested against a live LogRhythm collector.