docs: describe WFP denial capture - #1420

Clarify schema-failure behavior versus actionable network denials

docs/​logging-access-denied.md:269

This newly documented actionable network-denial behavior contradicts the existing schema-failure paragraph at lines 517–520, which still says “network decisions are not denials.” The implementation records network-provider schema failures diagnostically without setting deniedResourcesTruncated; update that paragraph to describe this behavior without denying the actionable contract introduced here.

Document all networkDecisionReason field values

docs/​logging-access-denied.md:286

The table does not document the serialized networkDecisionReason contract promised by the PR: only directDefaultDeny appears later in an example, leaving consumers unable to discover appIsolationMissingCapability, authoredExplicitDeny, allowExclusion, and proxyContainment. Add the exact field values for every row.

Clarify Tessera is internal-only and absent from public JSON

docs/​logging-access-denied.md:269

The PR description promises to clarify that Tessera is only an internal component name and is not exposed in public JSON, but this section introduces Tessera as a source domain without stating that boundary. This can make readers infer a caller-facing source: "Tessera" field even though the public record below has no such field. Please make the internal-only status explicit here.

Correct schema guidance for native capture with network proxy

docs/​logging-access-denied.md:258

This proxy-mode behavior conflicts with docs/schema.md:259-261, which still says native capture cannot be combined with runtimeConfig.networkProxy. The implementation explicitly accepts capture with a runtime proxy (base_container_runner.rs:3836-3845) while preserving the proxy capability posture (base_container_runner.rs:3128-3153). Please update that schema guidance so callers are not told this supported combination will fall back or fail.

Update schema guidance for guarded-WPR retention fallback

docs/​logging-access-denied.md:582

The canonical configuration guide still states that the guarded-WPR fallback rejects retention (docs/schema.md:255-256), contradicting this new guarantee. The product PlmGuardedCaptureFactory enables trace transfer (src/mxc-sdk/src/core/mxc_engine/guarded_capture.rs:203-210), so please update the schema guidance to document the supported fallback behavior consistently.

Artifact omits required NetworkDecisionV1 properties

docs/​logging-access-denied.md:429

This complete-looking artifact cannot be emitted as shown. An accepted NetworkDecisionV1 must contain all 24 schema properties, and the producer sanitizes the full property list; only timestamp-like entries such as OriginalTimestamp are dropped, so the resulting properties array contains many more entries than ApplicationId and FilterId. Please either show the complete retained array or explicitly mark this as an abridged, non-literal excerpt so consumers do not use it as the expected producer output.

Document distinct ICMP and ICMPv6 endpoint representations

docs/​logging-access-denied.md:367

The ICMP endpoint contract is still ambiguous here because the two public representations intentionally differ. An actionable IPv4 denial uses resource: "icmp://…", an IPv6 denial uses resource: "icmpv6://[…]", but the version-5 networkEndpoint.protocol and the authored policy both use "icmp" for either family (network_extractors.rs:400-433, 751-775). Document both resource schemes so consumers do not copy icmpv6 into the policy protocol or parse IPv6 records as icmp://.