[blessdyb]

Summary

• replace broad analytics-vendor suffix blocking with 43 reviewed dedicated collectors and tracker-bootstrap endpoints, keeping dashboards, login, billing, docs, administration, and management surfaces reachable
• add exact-host ordinary rules, preserve old stored rules safely, and narrow legacy analytics presets without rewriting the production database
• require the exact system-extension version/build before publishing rules so an older extension cannot widen exact collectors into suffix blocks
• enforce the reviewed tracking inventory in the signed official catalog and CI while retaining signature verification for immutable historical catalogs
• make generated-site release dates deterministic even without Git metadata or stable filesystem mtimes

Verification

• exact-head full macOS suite: 840 tests, 0 failures
• focused matching/upgrade suite: 109 tests, 0 failures
• Developer ID Release and Mac App Store graphs: built successfully; app 0.15.11/58; direct extension 0.15.4/27; universal x86_64/arm64
• real-machine exact-binary acceptance: Live, Rules, and unsaved rule editor rendered against demo.sqlite; no rule saved; only path-verified candidate PID stopped
• production Flowlight remained running; 8,882,229,248-byte traffic database unchanged; SQLite quick_check returned ok
• Xcode project drift, Swift warning, notarization fixture, tracking policy fixture, signed catalog, anti-rollback, localization (1,624/1,624 in all ten languages), site generation, site validation, and git diff checks: passed
• site output proved byte-identical from source copies with deliberately different filesystem mtimes
• independent security review: no High or Medium findings; focused correctness re-review confirmed all reported findings fixed

Product boundary

Hostname filtering blocks dedicated collection surfaces. If collection and product UI share one host, explicit visible paths require HTTPS inspection; pinned or opaque TLS cannot be split safely. First-party/custom-domain proxies remain outside a finite vendor-host list.

🤖 Generated with Claude Code