Description
At max entries, a novel Zenarmor-first connection is silently refused while a later NetFlow record is admitted without its L7, verdict and enrichment. The public max-entries contract says cap pressure force-emits the oldest entry and is counted, but this path neither evicts nor increments CorrelatorStats.
Acceptance Criteria
- #1 At capacity, a novel Zenarmor-first key causes the oldest eligible entry to be force-emitted and counted before the new enrichment holder is admitted
- #2 A subsequent NetFlow record for that key emits a merged record retaining the Zenarmor contribution
- #3 The cap remains hard and Zenarmor-only entries still never emit on expiry or flush
Definition of Done
- #1 just check
- #2 just gen (if any generated artifact changed) and the diff committed
Implementation Plan
Write a cap=1 regression for NetFlow A, Zenarmor B, NetFlow B; reuse the existing oldest-entry force-emit path for Zenarmor-first admission; run focused correlator tests and the repository gate.
Implementation Notes
Implemented at 2389ac3b. A cap=1 regression failed before the fix and passes after it; full correlator tests and final just check passed.
Final Summary
Fixed at 2389ac3b. Novel Zenarmor-first state at the hard cap now force-evicts and counts the oldest eligible entry, preserves later NetFlow merging, and never emits Zenarmor-only state on expiry or flush. Focused race tests and final just check passed.