Kairos War Room / VPN testing Team room

Product immersion · evidence through 27 Aug 2026 · n=1

Protection can fail silently.

One Mac established real failures in protection truth, lifecycle handling, crash stability and felt responsiveness. It did not establish how often they happen, how many customers they affect, or how much value they destroy.

Read the decision
Protection truthObserved
Connected Provider dead · traffic direct
Disconnected Tunnel still active
App quit Provider and VPN remain
Connected No reachability during Wi-Fi loss

Four different states. One missing source of truth.

Strong

Prioritise protection truth and recovery

Existence is established. The current client has concrete seams that can produce false state, trapped recovery and unsafe lifecycle ambiguity.

Medium

A deterministic repair programme is feasible

The repair sequence is clear enough to build and test. Production incidence and backend contribution remain unknown.

Weak

A distinct asymmetric opportunity

Keep it inside Retention Economics. Do not promote it until prevalence, support load and retained value are measured.

01 · Field evidence

What happened on the machine

Each card separates the observation from the claim it can support. “Observed” means the event happened in this study; it is not a fleet-wide rate.

E026 / E045Observed

The interface lied in both directions

Traffic went direct while the app still said Connected. In another state, the app said Disconnected while the tunnel remained active.

Supports A protection-state truth defect exists.
E015 / E028Observed twice

Two macOS crashes share one fault signature

Both preserved reports show EXC_BAD_ACCESS / SIGSEGV at 0x48 with the same first 18 faulting frames.

Supports A real stability defect. Trigger and incidence remain unknown.
E035 / E046Observed

Quitting the app does not end protection

A normal quit left tun.appex, the tunnel and VPN traffic running. During total Wi-Fi loss, the stale Connected state blackholed traffic.

Boundary The provider recovered when Wi-Fi truly returned. Peer-only failure is still open.
E001–E003Observed once

Payment preceded legible entitlement

The purchase succeeded before the app made plan state clear. State converged after the tour and the user could connect.

Supports One activation contradiction, not an activation failure rate.
E022 / E033Conflicted

“Residential” and location truth did not converge

A London residential exit was classified as Corporate/Hosting. A Lithuanian consumer-ISP exit labelled Vilnius resolved to Kaunas in two services.

Boundary The residential job advantage has not been proven against a calibrated datacenter control.
E047Did not reproduce

Elapsed time alone did not trigger the crash

The app survived 17m52s disconnected and one exact blank-area Lithuania row click. No new crash report appeared.

Next Compare label click versus blank-area click and observe the connected state longer.

02 · Same-hotspot A/B

Throughput held. Responsiveness collapsed.

One direct-versus-Vilnius-residential comparison on the same device and hotspot. Useful as a mechanism signal; not a population benchmark.

Download−12%
Direct 26.9Residential 23.6 Mbps
Upload−33%
Direct 34.6Residential 23.3 Mbps
Base RTT+70%
Direct 83.5 msResidential 141.7 ms
Responsiveness−84%
Direct 55.3 RPMResidential 9.0 RPM

RPM = round trips per minute under load. Higher is better. The residential run retained 88% of download throughput but only 16% of direct responsiveness.

03 · Static source audit

The failure paths are concrete

Public client snapshot 09fa557c…; public node snapshot c45527a…. Static audit identifies mechanisms and repair seams, not production frequency.

  1. 01

    Secondary IP verification can tear down a working tunnel.

    A failed corroboration lookup is coupled to tunnel liveness instead of resolving metadata in the background.

    M
  2. 02

    Recovery has no bounded escape path.

    The client can disable control while connecting, ignore a retry flag and poll teardown without delay, deadline or cancellation.

    M–L
  3. 03

    Status callbacks can overlap without proving a data path.

    Native acceptance, interface state and usable internet are not one serialized truth. “Connected” can arrive before protection is established.

    L
  4. 04

    Apple lifecycle seams can orphan the controller or the tunnel.

    Observers can miss initial or early state, listen too broadly, or reconcile app logout and native tunnel state incompletely.

    L
  5. 05

    WireGuard logs the full configuration after private-key insertion.

    This is a direct security defect and the smallest immediate patch: remove the log and add a secret-log regression test.

    S · first

04 · Product decision

Build the operator.
Do not sell the story yet.

The strongest product shape is a deterministic, local, outcome-verified operator: detect failure, block unsafe fallback, make the safest equivalent repair, and prove route, public IP, DNS and traffic before declaring protection.

Customers should almost never need to talk to Mysterium.

An LLM may translate intent, explain evidence and assemble escalation. It must not decide whether traffic may leak or invent a protection-critical repair.

Product priorityYes

Protection truth and recovery are co-primary gates with entitlement, billing and refund truth.

Standalone top-five opportunityNot yet

Provisional #5 challenger only. Keep it inside #2 Retention Economics.

Immediate patchRemove secret logging

Then serialize state truth before changing teardown and fallback behaviour.

Related working opportunity Field evidence feeds Delight

Delight is the bounded product loop that could act on these failures: detect → contain → recover → verify, then explain only when useful. It stays inside #2 Retention Economics; bounded pilot only; not independently promoted. Open brief →

05 · Promotion contract

The next evidence must change a decision

No more breadth for its own sake. Every remaining test must establish causation, calibrate an instrument, or size the affected population.

A

Complete the decisive failure repro

Induce peer-only failure while Wi-Fi stays healthy. Record provider, route, interface, service state and reachability continuously.

Kairos test lane
B

Calibrate residential value

Run direct → known datacenter → residential on the same blocked-site job, same country, same session.

Kairos test lane
C

Prove interruption safety

Test IPv4, IPv6 and DNS under forced drop, handoff, provider death, app quit and reconnect.

Kairos + MN client owner
D

Size prevalence and retained value

Join incidents by platform/build/failure phase to support contacts, cancellation, LTV and retained revenue.

MN telemetry owner + Kairos
E

Run one feature-flagged pilot

Require faster verified recovery, fewer support contacts, and no protection or retention guardrail regression.

MN product + client engineering
Provisional memo8 Sep
Renewal recommendation15 Sep
Next charge20 Sep

Evidence boundary

This study proves defects, not prevalence.

  • One Mac, one user, one primary hotspot.
  • Several failures were induced; ordinary-use reliability was not measured.
  • Static source establishes possible mechanisms, not backend causes or fleet incidence.
  • DNS pass results are invalid for product attribution because the Mac was manually pinned to Cloudflare DNS.
  • No current dataset yet joins connection incidents to support, churn, LTV or retained revenue.

06 · Machine record

Same conclusion, structured

Visible on purpose. The embedded payload and brief.json carry the same verdict, limits and next gates for agents.

Decision: prioritise protection truth and deterministic recovery; do not promote a standalone asymmetric opportunity.

Evidence cutoff: 2026-08-27. Source is the current Lee-side product immersion record; wider shared-repository absorption is not claimed.

Release policy: living latest during the active study; every deployed change remains recoverable through Git.

Review status: Talos self-review. Claude Fable 5 was quota-unavailable; no Fable review is claimed.