Hey I haver a PR that adds TCP state to open sockets on Darwin I'm thinking about renaming the Linux socket state "close" to "closed", to be consistent with the standards for tcp: https://github.com/facebook/osquery/pull/4253/files#diff-15889620a831d8dfeb21169d5fabc5c2R62 This might break user space queries so does anyone have any other opinion?