Pulse27 Anti-Tethering Suite — single package, no servers
==========================================================

One tweak containing the complete on-device anti-tethering stack that
iOS exposes to a jailbreak tweak. Nothing in this package makes a
network connection; there is no server component.

Components
----------
1. pulse27ttl65d (root LaunchDaemon)
   - Pins net.inet.ip.ttl (IPv4) and net.inet6.ip6.hlim (IPv6) to the
     target value in /var/jb/etc/pulse27-ttl65.conf (default 65).
   - Re-asserts every 15 seconds; every 2 seconds while Personal
     Hotspot is active (bridge100 up).
   - Writes no logs (output is /dev/null).

2. Pulse27CC.dylib (CommCenter component)
   - Injected into the CommCenter process by substrate/ElleKit
     (filter: Executables = CommCenter).
   - Re-asserts the TTL/HL pin from inside the carrier stack (30s).
   - Runtime discovery: enumerates CommCenter's Objective-C classes
     and methods on the actual firmware and records entitlement /
     tethering / APN / provisioning decision-point candidates to
     /var/jb/etc/pulse27-cc.state (shown by `pulse27ttl` status).
   - Resolves the MSHookMessageEx hook API. The confirmed-target
     table ships empty for iOS 27: hooks are only applied to decision
     points verified by reverse engineering the real build, never
     guessed — a wrong hook inside CommCenter can break telephony.
     The discovery state file is exactly the input used to fill it.

3. pulse27ttl (terminal control tool)
   - `pulse27ttl`          full status: target, current TTL/HL,
                           hotspot state, enforcement interval
   - `pulse27ttl on`       target 65
   - `pulse27ttl off`      target 64 (stock)
   - `pulse27ttl <1-255>`  custom target

Design notes
------------
Modeled on the Android Magisk "Tethering TTL/HL Patcher" architecture:
(1) provisioning/APN layer, (2) TTL/HL layer. This package implements
the TTL/HL layer on-device via sysctl, which is the deepest layer a
tweak package can reach on iOS. The provisioning/APN layer lives in
CommCenter and is patched per iOS build (see the CarrierCrack line);
the kernel forward-path patch requires the jailbreak itself. Both are
roadmap items for when an iOS 27.0.1 jailbreak is available to build
against — they cannot be written blind for a firmware whose binaries
cannot yet be inspected.

Requirements: jailbroken iPhone on iOS 27+ (built and targeted for
iPhone 17 Pro / iPhone18,1 / A19, minimum iOS 27.0).
