doc: say what fragments do, and stop listing fixed items as open

todo.md had three items in both halves of itself.  Control files being
world-writable, delete 0, and a dead relay leaving half a firewall were
all in "Fixed since the review" as items 10, 11 and 12, and all three
were still sitting in "Worth fixing" underneath.  Anyone working the
open list would have redone them.  Now an item appears in one half or
the other, and the first round's entries are one line each, since the
detail is in the commit and the value of this file is the part that is
still true.

Fragments got a sentence that described the mechanism and not the
consequence.  "Later fragments now match on addresses and protocol
only" reads as though they would pass under an address rule; what
actually happens is that every rule set in fwrules(6) is written in
ports, later fragments match no port, and the datagram does not cross.
That is the right trade against reading ports out of them, which let a
crafted fragment through, but it is a hole in what works and belongs in
BUGS rather than in a changelog line.

man/fw also now says what the served /net contains, which changed
underneath it and was never written down; and it still said the card
was "not undone reliably", when nothing undoes it at all.

design.md gains the whitelist decision next to the others, because the
argument for it is the same one the rule parser already makes and the
next person to add a file to the served tree should meet it.

The mtu comment claimed a card as its reason while sitting in code both
modes use.  Between two stacks there is no card; 1500 is still right,
for a reason worth one sentence.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 45 insertions, 1 deletions

diff --git a/fw/man/fw b/fw/man/fw
index 5a7f592..1b6b1d3 100644
--- a/fw/man/fw
+++ b/fw/man/fw
@@ -126,6 +126,39 @@ A refused write fails, and the diagnostic is what
 .IR dial (2)
 reports to the program that tried it.
 .PP
+The
+.B /net
+it serves is named rather than filtered: protocol directories and their
+conversations, plus
+.BR cs ,
+.BR dns ,
+.BR arp ,
+.BR bootp ,
+.BR iproute ,
+.B ipselftab
+and
+.BR ndb ,
+of which only
+.B cs
+and
+.B dns
+may be written.
+Nothing else is there at all - not a card, not
+.BR ipmux ,
+not
+.BR log ,
+not a protocol's
+.B trans
+file, and not an interface's
+.B data
+or
+.B snoop
+file, each of which is a wire.
+A protocol
+.I fw
+has not been told about is one nobody in the namespace can reach, which
+is the safe way for this list to be out of date.
+.PP
 Because the policy lives in a namespace, each program can have its own.
 Filtering a program's requests is not a boundary by itself - see
 .B CONTAINMENT
@@ -441,7 +474,18 @@ IPv6 extension headers are not walked; such packets are matched on their
 addresses and next-header protocol alone.
 ICMP has no type or code matching.
 .PP
-Taking a card is destructive and is not undone reliably.
+A fragmented datagram does not cross.
+Only the first fragment carries the transport header, so the rest match
+no port, and a rule set written in ports - which is every rule set worth
+writing - denies them.
+The first fragment arrives and the receiver waits for the others until
+it gives up.
+Reading ports out of a later fragment, which is what
+.I fw
+did before, is worse: a fragment whose payload bytes happen to match an
+open connection is then let through.
+.PP
+Taking a card is destructive and is not undone.
 The interface that replaces it is unbound when
 .I fw
 stops, and the address goes with it, so a