C04-CG: No
Rationale
TCPCL exchanges its recognizable Contact Header before TLS authentication. A valid unauthenticated header elicits the passive peer header, including the dtn! marker. Rejecting malformed headers or later rejecting certificates does not conceal the service from this valid probe. No additional probe-concealment layer is selected.
Assessment method
Documentary review; no new runtime experiment
Source context
Primary specification and bounded profile inference
Outstanding qualification
Capture valid and malformed probes against the selected executable; this documentary No does not claim access through an external firewall.