Distinguish pf state-tracking modes with bracketed letter tags

Previously "keep state" and "modulate state" both collapsed to the
same generic "[state]" tag, losing a real distinction: modulate state
hardens TCP ISN generation and synproxy state (not handled at all
before) proxies the handshake against spoofed SYN floods - neither is
just "some tracking is happening." Now [N]/[K]/[M]/[S] map to no/keep/
modulate/synproxy state respectively, documented in a comment since
the mapping isn't self-evident without pf.conf familiarity.

Considered thematic unicode symbols from the font's supported blocks
(Mathematical Operators, Geometric Shapes) instead, but a bracketed
letter is unambiguous without a legend - a clever but obscure glyph
isn't actually more compact once you factor in "what does this mean."

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions