refactor(socketwatch): carry only the pid and port a socket event is for

[donislawdev]

What and why

SocketEvent carried proto, remote_ip, remote_port and outbound "for the connection log
later". Nothing ever read them, and the review found out why that never hurt: for all four, the
NETWORK-layer packet the engine already holds is a strictly better source. The connection log
takes the remote address, port, proto and direction straight off the packet, and the packet even
distinguishes ICMP, which the SOCKET layer does not. The one thing a packet cannot tell us is the
owning pid - and that is exactly what the event still carries.

So the honest answer to "what do we gain by wiring these up" was: nothing. The Connections table
already shows all of it, from a better source.

Keeping them was not free either. _ipv4() ran per event for nobody, and it decodes IPv4 only
(addr[0] read as a 32-bit int). The first person to "just wire up the field we already have"
would have shipped garbage for IPv6 into a user-visible column, in a tool whose traffic filters all
cover v4 and v6. A dead field with a plausible-looking comment on it is a trap, which is the
shape of drift this project keeps paying for.

What a reviewer should know:

• A deleted test's knowledge was preserved, not dropped. test_ipv4_decodes_high_byte_first
  encoded a real measured finding from the 2026-07-22 spike: WinDivert stores the IPv4 address
  MSB-first in addr[0], and the naive low-byte-first decode rendered 192.168.1.29 as
  29.1.168.192. The decoder is gone, so the test goes with it - but the finding now lives in
  CHANGELOG-INTERNAL.md, with a note to extend it to IPv6 if remote addresses are ever wanted
  again.
• This closes the first PENDING marker added in test(repo): guard prose that has an expiry date #44, so OPEN_PENDING is empty again. The
  code says that empty is its healthy state, so nobody reads it as an unused mechanism.
• The guard reddened on its first real closing, and it was the guard's fault. It flagged this
  repo's own CHANGELOG-INTERNAL.md, which literally names the marker while announcing it. That is
  a false positive: a changelog records what HAPPENED and is dated by nature, so "added a marker
  named X" stays true after X is gone. Fixed by skipping CHANGELOG*.md, and the reasoning is in
  the code next to the skip.
• The narrowed scan was re-verified by mutation, not assumed. Weakening a guard can silently
  disable it, so after the fix a probe marker naming an unlisted stage in an ordinary .md was
  confirmed to still turn the test red, and green again once removed. The scan was narrowed, not
  broken. Both probe files were deleted (git status --untracked-files=all clean).
• Hot path untouched: test_hot_path.py (packet threads must never reach the OS) was run
  explicitly and is green. Net effect on the code is -16 lines.

Checklist

• python -m pytest tests passes locally. (660 tests, 0 failures - one fewer than before,
  which is precisely the deleted _ipv4 test; on an elevated shell, so the two known
  non-admin failures are absent rather than excused. smoke_gui.py: OK.)
• New behaviour has tests (see tests/ for the style). - no new behaviour: dead fields removed
  and the existing test_socketwatch*.py / test_targeting_socketwatch.py suites still cover
  the map and its wiring through the trimmed event.
• UI text goes through i18n keys, with both lang/en.json and lang/pl.json updated. -
  n/a: no UI text.
• User-facing changes noted in CHANGELOG.md; technical ones and new tests in
  CHANGELOG-INTERNAL.md, under [Unreleased]. - internal only (convention 39): the fields
  were never read, so nothing a tester sees changes.
• Commits follow Conventional Commits (type(scope): summary).
• No version bump - the owner closes a version via VERSION.txt.

🤖 Generated with Claude Code