Win10/11 run TCP timestamps ON (nmap SEQ.TS=A); the windows profile had them OFF, fingerprinting as an ancient stack. Add a windows_server slug (ECN negotiated, CC=Y) and point the server/DC archetypes at it. Introduce the OS_MANGLE map (per-slug egress SYN-ACK shape: window, option order, IP-ID policy) consumed by the new cloak package.