fix: audit round 3 - fail-closed leak, shared asyncio loop, GOST bundling, close-X UX, persona key lookup, +29 tests

CHANGELOG.md

@@ -2,6 +2,40 @@
 
 All meaningful changes to this repository should be recorded here.
 
+## Unreleased — 2026-05-22 (Audit round 3)
+
+### Security
+- **Fail-closed leak detection**: `is_chain_leak()` now treats unknown direct
+  IP as a leak (was: pass-through).  `service.py` retries direct-IP lookup
+  3× with 2 s back-off as a warm-up grace so transient network blips don't
+  cause permanent rotation.
+
+### Reliability
+- **Single asyncio loop in preflight**: removed per-call `asyncio.run()` from
+  the preflight worker thread; one loop is created, drained, and closed.
+- **Close-window UX**: X button now prompts when chain or firewall is still
+  active (tray / full quit / cancel) instead of silently minimizing.
+- **Admin relaunch**: settings persist before the elevated process spawns.
+- **Persona/cookie key lookup**: precomputed `label→key` dicts; label copy
+  changes can no longer break the round-trip.
+
+### Distribution
+- **GOST bundled**: `scripts/prepare_bundled_gost.ps1` downloads and SHA-
+  verifies `gost.exe`, stages it under `proxy_chain_manager/_bundled/`, and
+  PyInstaller bundles it into the exe.  `ensure_gost()` installs from the
+  bundle on first run (no internet required); network fetch is fallback only.
+
+### Tests
+- New suites: `test_config_round_trip`, `test_ban_tester`, `test_gost_util`,
+  `test_fail_closed`, `test_firewall_helpers`.
+- Total: **47 → 82** passing.
+
+### Held by design (audit §12)
+- Signup extension stays on `<all_urls>` — custom signup URLs need it.
+- `verify=False` on httpx probes — broken public-proxy TLS.
+- DNS pass-through in kill-switch — GOST needs system DNS.
+- Authenticode signing — pending Cert provisioning.
+
 ## Unreleased — 2026-05-21 (Audit remediation P0/P1/P2)
 
 ### Security (P0)