v15.3.1 - AI-safe DryRun preview-only + pre-flight quiesce

v15.3.1 — AI-Safe DryRun Preview

Critical fix: -DryRun no longer kills internet (and your Cursor/AI session)

AI Connection Invariant (permanent design rule)

If install or -DryRun kills internet, the user's Cursor/AI session dies too. v15.3.1 enforces:

1. Pre-flight quiesce runs FIRST on every install.ps1 invocation (including -DryRun) via Invoke-PreFlightInternetGuard.
2. -DryRun is read-only preview only — Invoke-InstallDryRunPreview; MainSteps 0–20 never execute.
3. MainSteps 0–6 throws if accidentally called during DryRun (hard guard).

What pre-flight quiesce does (real mutations — restores internet)

• Ends/disables scheduled tasks (WG-KillSwitch, WG-RepairTask, WG-InternetWatchdog, WG-RebootVerify)
• Stops monitor/repair/watchdog PowerShell processes
• Deletes catch-all KS-Block-* rules; disables DNS block rules
• Sets firewall policy blockinbound,allowoutbound
• Registry: KillSwitchArmed=0, 30min grace, clears InstallInProgress
• Clears DNS cache

What -DryRun does now

• Prints step preview list (what would happen)
• Read-only system status (WireGuard present, tunnel, block rules, armed flag)
• Zero downloads, installs, firewall mutations from install steps, monitor, tasks, or WMI

v15.3.0 behavior retained

• KillSwitchArmed gate, manual DNS lockdown, 60min post-install grace, repair fail-open — unchanged.

Test gate

1045+ assertions, 0 ERROR/WARN final line audit (99 files).

Release assets

File	SHA256
WGKillSwitch-v15.3.1-FINAL.zip	7D7C7F9802A5230D23BFF3AA1BFC80F77A3D6908608C53EC470E401BE4EB2490