RUST-BUG-079: avoid false plaintext diagnostics

Author: Threepwood-7

crates/emulebb-ed2k/src/ed2k_tcp/diag_event.rs

@@ -57,10 +57,11 @@ pub(super) fn emit_ed2k_tcp_diag_event(record: &Ed2kTcpDumpRecord<'_>) {
         body.insert("payloadHexTruncated".to_string(), json!(truncated));
     }
     // `obfuscated` (C): real on-wire state derived from the transport-mode label.
-    body.insert(
-        "obfuscated".to_string(),
-        json!(transport_mode_is_obfuscated(record.transport_mode)),
-    );
+    // Pre-handshake meta events use `unknown`; omitting the field there avoids
+    // reporting a false plaintext verdict before the transport exists.
+    if let Some(obfuscated) = transport_mode_obfuscated(record.transport_mode) {
+        body.insert("obfuscated".to_string(), json!(obfuscated));
+    }
     body.insert("transportMode".to_string(), json!(record.transport_mode));
     body.insert("flow".to_string(), json!(record.flow));
     body.insert("phase".to_string(), json!(record.phase));
@@ -77,7 +78,22 @@ pub(super) fn emit_ed2k_tcp_diag_event(record: &Ed2kTcpDumpRecord<'_>) {
     );
 }
 
-/// Whether an `Ed2kTransportMode` label denotes an obfuscated on-wire transport.
-fn transport_mode_is_obfuscated(transport_mode: &str) -> bool {
-    transport_mode.contains("obfusc") || transport_mode.contains("crypt")
+/// Whether an `Ed2kTransportMode` label denotes a known obfuscated on-wire transport.
+fn transport_mode_obfuscated(transport_mode: &str) -> Option<bool> {
+    match transport_mode {
+        "unknown" => None,
+        _ => Some(transport_mode.contains("obfusc") || transport_mode.contains("crypt")),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::transport_mode_obfuscated;
+
+    #[test]
+    fn transport_obfuscation_is_omitted_until_mode_is_known() {
+        assert_eq!(transport_mode_obfuscated("unknown"), None);
+        assert_eq!(transport_mode_obfuscated("plaintext"), Some(false));
+        assert_eq!(transport_mode_obfuscated("obfuscated"), Some(true));
+    }
 }

docs/active/INDEX.md

@@ -90,6 +90,7 @@ items.
 | [RUST-BUG-076](items/RUST-BUG-076.md) | Major | DONE | Keep diag_event JSONL records line-atomic across shims |
 | [RUST-BUG-077](items/RUST-BUG-077.md) | Major | DONE | Persist accepted ED2K request blocks before bitmap recovery |
 | [RUST-BUG-078](items/RUST-BUG-078.md) | Major | DONE | Do not immediately downgrade failed obfuscated ED2K peers |
+| [RUST-BUG-079](items/RUST-BUG-079.md) | Minor | DONE | Do not report unknown ED2K TCP transport as plaintext |
 
 ## Refactors (`REF`)
 

docs/active/items/RUST-BUG-079.md

@@ -0,0 +1,45 @@
+---
+id: RUST-BUG-079
+title: Do not report unknown ED2K TCP transport as plaintext
+status: done
+priority: Minor
+category: bug
+workflow: local
+---
+
+# RUST-BUG-079: Do not report unknown ED2K TCP transport as plaintext
+
+## Problem
+
+Live-wire diagnostics showed `native_download` `connect_start` events where the
+structured `diag_event_v1.body.obfuscated` field was `false` while the note still
+contained source metadata such as `obfuscated=true has_user_hash=true`. At that
+phase no transport exists yet, so the on-wire mode is unknown.
+
+This made obfuscation-off parity analysis harder: a source may advertise crypt
+metadata, but the actual transport decision is only known at `connect_ready`.
+Reporting unknown as `false` made pre-handshake diagnostics look like a confirmed
+plaintext verdict.
+
+## Acceptance
+
+- [x] Pre-handshake ED2K TCP meta events with `transportMode="unknown"` omit the
+      on-wire `obfuscated` field.
+- [x] Known plaintext and obfuscated transport modes still emit explicit boolean
+      values.
+- [x] Protocol behavior is unchanged.
+
+## Implementation Notes
+
+- Changed the ED2K TCP `diag_event_v1` mapper to emit `body.obfuscated` only for
+  known transport modes.
+- Kept `body.transportMode` present for every record, including `unknown`.
+- Added unit coverage for unknown, plaintext, and obfuscated mapping.
+
+## Evidence
+
+- Live evidence source:
+  `EMULEBB_WORKSPACE_OUTPUT_ROOT\live-wire\rust-hideme-20260619T001217Z`.
+- In that run, all obfuscation-off native-download `connect_ready` records were
+  plaintext even when some `connect_start` source notes advertised obfuscation
+  metadata.