# Milestone 5 — Citizenship

## What landed

- **Metered awareness** (`metered` feature, default on): NetworkManager's
  `Metered` property is polled over D-Bus every 30 s; while metered (or
  guessed metered) the daemon serves nothing (connections closed at
  accept) and defers every fetch. Pins stay recorded; mdns
  re-announcements retrigger auto-sync once unmetered. Builds without
  D-Bus via `--no-default-features` (always unmetered then).
  `VARDE_FORCE_METERED=true` forces the state — a manual kill switch and
  the test hook.
- **DSCP CS1** on the endpoint's UDP sockets, best effort. iroh does not
  expose its socket fds, so we match the endpoint's bound ports against
  `/proc/net/udp{,6}` inodes and walk `/proc/self/fd` — Linux-only like
  the daemon itself. Failures are logged at debug and ignored, as the
  spec allows.
- **systemd socket activation**: `LISTEN_FDS` (fd 3) is adopted when
  present, otherwise the daemon binds its own socket — non-systemd
  distros work identically. Readiness is signaled with a hand-rolled
  `sd_notify(READY=1)` (abstract and path sockets), no libsystemd
  dependency. Activation sockets are not unlinked at shutdown; systemd
  owns them.
- **dist/**: hardened system units (`DynamicUser`, `ProtectSystem=strict`,
  `StateDirectory`/`RuntimeDirectory`, `NoNewPrivileges`, restricted
  address families and syscalls), user units, commented example
  `config.toml`, scdoc man pages (`varde.8`, `varde-ctl.1`, validated
  with scdoc), and an explicitly untested `PKGBUILD` skeleton for Arch.

## Decisions

- **Type=notify + Requires=varde.socket** so systemd tracks readiness
  precisely and activation works out of the box; the same binary still
  runs under `ExecStart` alone.
- **Metered gating sits at the two choke points** (connection accept,
  fetch queue) rather than inside the rate limiter, so the posture is
  binary and auditable: metered ⇒ zero bytes moved, period.
- **Polling NM instead of subscribing to PropertiesChanged**: 30 s of
  staleness is acceptable for a background mirror and the code stays
  ~40 lines with graceful degradation when NM or D-Bus is absent.
- `varde-ctl` already had `--json` and human output from milestone 1;
  the polish here was man-page coverage of every command.