[asgarihope]

Disconnect, Pause, and Quit must release BiFlow's owned capture before handing the original network back. Incomplete restoration now stays retryable, and Quit or a repeated Stop after a completed handoff no longer kills the returned proxy client.

• Windows cleanup uses native adapter, route, and DNS inspection with GUID checks, numeric adapter state, verified release, and reconnect preparation.
• macOS captures DNS before core startup and records the actual utun with a launch UUID. Durable recovery survives helper restarts and partial failures; restoration verifies the original DHCP/static resolver without guessing a gateway.
• Helper lifecycle operations are serialized through native cleanup. Lifecycle replies have bounded 90-second budgets (180 seconds for Restart), while routine status and frame IO keep short deadlines. Startup and the watchdog retry pending recovery even after the core exits.
• Environment snapshots expose missing native resolvers, disabled owned adapters, unavailable proxy clients, and classified host DNS answers while stopped/paused. No destination-specific rules, hosts entries, DNS mappings, or routing exceptions are added.

Version: 6.2.91. ADRs 0133–0137 document ownership, recovery, and diagnostic policy.

Validation: Windows workspace rustfmt, Clippy with -D warnings, workspace tests, cargo deny, pnpm check/build, and the full mock UI e2e suite passed (41 passed; the opt-in README capture was skipped). Development-profile tests and Apple Silicon helper/core cross-Clippy also passed. The Windows 6.2.89 release and NSIS /WX builds passed; that installation's desktop and both helper copies match the built artifacts, with settings preserved and the stack stopped. The macOS collector uses the shared bounded desktop command runner; the Unix stop fixture waits for explicit child readiness.

Regression coverage includes explicit signal-handler readiness and SIGKILL verification for the graceful-stop fixture, executable native-command fixtures, partial DNS rollback/retry, per-launch tunnel identity, lifecycle serialization, delayed framed IPC replies, Stop followed by Quit/repeated Stop, and diagnostic classification/redaction. Automated tests do not disconnect the host network. Real network transitions on macOS still require native acceptance testing.

CI for 749a354: all seven jobs passed — Windows 2025, macOS 15, Ubuntu 22.04/24.04, frontend, e2e, and security. Verified CI run.