doc: say what fragments do, and stop listing fixed items as open

todo.md had three items in both halves of itself.  Control files being
world-writable, delete 0, and a dead relay leaving half a firewall were
all in "Fixed since the review" as items 10, 11 and 12, and all three
were still sitting in "Worth fixing" underneath.  Anyone working the
open list would have redone them.  Now an item appears in one half or
the other, and the first round's entries are one line each, since the
detail is in the commit and the value of this file is the part that is
still true.

Fragments got a sentence that described the mechanism and not the
consequence.  "Later fragments now match on addresses and protocol
only" reads as though they would pass under an address rule; what
actually happens is that every rule set in fwrules(6) is written in
ports, later fragments match no port, and the datagram does not cross.
That is the right trade against reading ports out of them, which let a
crafted fragment through, but it is a hole in what works and belongs in
BUGS rather than in a changelog line.

man/fw also now says what the served /net contains, which changed
underneath it and was never written down; and it still said the card
was "not undone reliably", when nothing undoes it at all.

design.md gains the whitelist decision next to the others, because the
argument for it is the same one the rule parser already makes and the
next person to add a file to the served tree should meet it.

The mtu comment claimed a card as its reason while sitting in code both
modes use.  Between two stacks there is no card; 1500 is still right,
for a reason worth one sentence.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 7 insertions, 3 deletions

diff --git a/fw/src/fw.c b/fw/src/fw.c
index 4dc6d79..70bcc5c 100644
--- a/fw/src/fw.c
+++ b/fw/src/fw.c
@@ -306,9 +306,13 @@ wireup(Wire *w)
 	if(fprint(w->cfd, "bind pkt") < 0)
 		sysfatal("%s: bind pkt: %r", w->net);
 	/*
-	 * pktmedium claims 4096 with no link header; a card is 1514 with
-	 * 14.  Left alone the protected stack emits packets the card
-	 * refuses, and only remote peers capping the MSS hide it.
+	 * pktmedium claims 4096 with no link header, where a card is 1514
+	 * with 14, so a stack behind one of these thinks it may send 4096
+	 * bytes.  In card mode devether then refuses the frame outright;
+	 * between two stacks the packet only has further to go before an
+	 * ether interface refuses it.  Either way 1500 is what the traffic
+	 * will meet in the end, so say so here.  Left alone, the only
+	 * thing hiding it is remote peers capping the MSS.
 	 */
 	if(fprint(w->cfd, "mtu 1500") < 0)
 		fprint(2, "fw: %s: cannot set mtu: %r\n", w->net);