test(gate): install iproute2 in the docker lane — without ip every slot is free

This change was already in the working tree when this session started; it is
committed here because it is load-bearing and an uncommitted load-bearing file
is a trap.

netplane.L3SlotFor asks the kernel through `ip link show` and reclaims through
`ip link del`. golang:1.26 ships no iproute2, so in the docker re-exec lane
every slot read as FREE, TestIntegrationL3StaleSlotIsReclaimed stood itself
down rather than pass while proving the opposite of what it claims, and [5/7]
then failed the gate — correctly, since this environment HAS root and
/dev/net/tun and the capability guard is therefore not what skipped it.

Installing it is also what made the concurrent-namespace defect visible at all
(see 06c04c157): with no `ip` on PATH, no `ip link del` was ever issued and the
two test binaries that were destroying shater/generate's TUN looked innocent.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BHw89tdWddzhjUc4bAH4tS

.gitea/workflows/release.yml

@@ -1,36 +1,49 @@
-# Shater v0.2 — build the 4-package signed opkg feed and publish it as a rolling
-# Gitea release consumable as an `src/gz` feed.
+# Shater v0.2 — build the 4-package signed **apk** feed and publish it as
+# per-arch Gitea releases consumable as an apk repository.
 #
-# WHAT CHANGED FROM v0.1
-#   v0.1 shipped 3 packages: xrayctl (SDK-compiled Go) + shater-core +
-#   luci-app-shater (hand-packed data .ipk). v0.2 collapses the runtime into ONE
-#   forked binary and ships 4 packages, all built the canonical SDK way:
+# WHAT WE SHIP
+#   ONE forked binary plus its OpenWrt glue, 4 packages, all built the canonical
+#   SDK way:
 #     - shaterd          PREBUILT static-musl + SPA-embedded + UPX binary. Built
 #                        OUT OF TREE by scripts/build-shaterd.sh (Go + Node + UPX)
 #                        and staged into openwrt/shaterd/files/ BEFORE the SDK
 #                        build; the openwrt/shaterd package just $(INSTALL_BIN)s
-#                        the arch-matched artifact. (arch-specific .ipk)
+#                        the arch-matched artifact. (arch-specific .apk)
 #     - shater-core      data glue, PKGARCH=all
 #     - luci-app-shater  LuCI thin launcher, PKGARCH=all (uses feeds/luci/luci.mk)
 #     - byedpi           ciadpi, C cross-compiled from source by the SDK (arch-specific)
 #
 # TARGET HARDWARE / ARCH MATRIX
 #   x86_64             -> the QEMU testbed VM (generic x86-64).
-#   aarch64_cortex-a53 -> BOTH production routers (BPI-R3 + BPI-R4, mediatek/filogic).
+#   aarch64_cortex-a53 -> BOTH production routers (BPI-R3 mini + BPI-R4,
+#     mediatek/filogic), both on 25.12 with apk-tools 3.
 #     Only shaterd + byedpi are arch-specific; shater-core + luci-app-shater are
-#     PKGARCH=all, so one build of each covers every device. opkg filters by
-#     Architecture at install time, so a single combined feed URL serves all.
+#     PKGARCH=all, so one build of each covers every device — but the RELEASES
+#     are still per-arch (see the release-apk job for why).
 #
-# FEED SIGNING (opkg / usign — OpenWrt 24.10 is opkg, not apk; apk lands at 25.12)
-#   The feed index (Packages) is usign-signed with the SECRET key in the Gitea
-#   repo secret KEY_BUILD; routers verify it with the committed public key
-#   dist/shater-feed.pub (fingerprint 5ac4b177689cb8e0). Do NOT regenerate the
-#   key — that invalidates every deployed router's trust.
+# FORMAT: apk ONLY (25.12+)
+#   The fleet runs OpenWrt/ImmortalWrt 25.12, where opkg is replaced by Alpine
+#   apk (.apk files, binary packages.adb index, EC keys in /etc/apk/keys/). The
+#   old .ipk lane was removed in 2026-07 (docs-shater/DECISIONS.md D22): no
+#   device we serve has an opkg binary at all, so building and signing a second
+#   feed served nobody.
+#
+# FEED SIGNING (EC / apk)
+#   packages.adb is signed with the EC (prime256v1) SECRET key in the Gitea repo
+#   secret KEY_APK; routers verify it with the committed public key
+#   dist/shater-apk.pem (ci/gen-apk-key.sh). Do NOT regenerate the key — that
+#   invalidates every deployed router's trust.
 #
 # AUTO-RELEASE
-#   push a tag `vX.Y.Z` -> versioned release. workflow_dispatch / (optional) main
-#   -> rolling `latest` pre-release (always-fresh feed). Publish uses the Gitea
-#   API via curl (ci/gitea-release.sh) — no external action needed.
+#   The rolling per-arch `apk-latest-<arch>` is published on EVERY run — tag runs
+#   included — and then read back over the API to assert it really serves the
+#   version just built. A tag push `vX.Y.Z` publishes the pinnable per-arch
+#   `apk-vX.Y.Z-<arch>` IN ADDITION. It is not an either/or: it used to be, and
+#   the rolling pointer then froze at 0.2.0 while v0.2.9/v0.2.10 shipped (see the
+#   long comment above the `release-apk` job). Publish uses the Gitea API via curl
+#   (ci/gitea-release.sh) — no external action needed. NOTE: the apk release tags
+#   deliberately do NOT start with `v` so publishing them cannot re-trigger this
+#   workflow's `v*` filter.
 #
 # PACKAGE VERSIONING (bug B4)
 #   PKG_VERSION/PKG_RELEASE are NOT hand-written in the Makefiles any more. They
@@ -41,28 +54,13 @@
 #   exported via $GITHUB_ENV):
 #       tag `vX.Y.Z`         -> X.Y.Z-r1
 #       anything else        -> <nearest tag>-r<commits since it + 1>
-#   and hands them to the SDK builds as SHATER_PKG_VERSION/SHATER_PKG_RELEASE;
+#   and hands them to the SDK build as SHATER_PKG_VERSION/SHATER_PKG_RELEASE;
 #   $SHATER_VERSION (the same numbers, plus the short sha off-tag) is stamped
-#   into the binary's constant.Version. ci/sdk-build*.sh then ASSERT that the
-#   built .ipk/.apk really carry that version, so the failure can never be
-#   silent again. This is also why both build jobs check out with fetch-depth: 0
+#   into the binary's constant.Version. ci/sdk-build-apk.sh then ASSERTS that the
+#   built .apk really carry that version, so the failure can never be silent
+#   again. This is also why the build job checks out with fetch-depth: 0
 #   — `git describe` needs tags and ancestry. `byedpi` is excluded: it keeps
 #   upstream ByeDPI's own PKG_VERSION (see openwrt/byedpi/Makefile).
-#
-# APK LANE (25.12+, ADDITIVE — T2)
-#   The fleet is migrating to BananaWRT 25.12-mtk-vendor (= ImmortalWrt 25.12
-#   base), where opkg is replaced by Alpine apk (.apk, binary packages.adb
-#   index, EC keys in /etc/apk/keys/). The `build-apk` + `release-apk` jobs
-#   below build the SAME 4 packages through the ImmortalWrt 25.12 apk-SDK and
-#   publish PER-ARCH apk repos as releases `apk-latest-<arch>` (rolling) /
-#   `apk-<tag>-<arch>` (versioned). Per-arch because apk filenames carry no
-#   architecture (shaterd-0.2.0-r1.apk would collide across arches in one flat
-#   release) and apk fetches packages relative to the packages.adb URL.
-#   Signed with the EC key in the Gitea secret KEY_APK; trust anchor
-#   dist/shater-apk.pem (ci/gen-apk-key.sh). The usign/opkg lane above is
-#   UNCHANGED and keeps serving the 24.10 fleet. NOTE: the apk release tags
-#   deliberately do NOT start with `v` so publishing them cannot re-trigger
-#   this workflow's `v*` tag filter.
 
 # CACHING (T3 — fast CI)
 #   All caches use actions/cache pinned to v3.3.2: the LAST release speaking the
@@ -80,34 +78,33 @@
 #       (PKG_VERSION/PKG_HASH live there). Stale-safe: the buildroot verifies
 #       PKG_HASH on every dl/ file and re-downloads on mismatch, so restore-keys
 #       prefix fallback is allowed.
-#     - Go module + build cache — key = hash of go.sum; shared by all 4 build
+#     - Go module + build cache — key = hash of go.sum; shared by both build
 #       jobs (each builds both GOARCHes).
 #     - panel/node_modules — key = hash of panel/package-lock.json, exact-only
 #       (a lockfile change MUST miss); on hit build-shaterd.sh gets --fast.
-#     - apt .deb archives for the apk lane's debian:bookworm host-deps
-#       (.cache/apt) — key = hash of ci/sdk-build-apk.sh (the apt list is in it).
-#     - usign binary (.cache/tools) — static helper, fixed key.
+#     - apt .deb archives for the debian:bookworm host-deps of the apk SDK
+#       container (.cache/apt) — key = hash of ci/sdk-build-apk.sh (the apt list
+#       is in it).
 #     - SDK feeds/ git checkouts (.cache/feeds) — the single biggest recurring
 #       cost: `scripts/feeds update -a` cloned base+packages+luci+routing+
 #       telephony EVERY run (~7 min/job; github.com is ~1 MB/s from this
 #       runner — run 51 evidence). The feeds dir is symlinked into the SDK
 #       container from the workspace cache; `feeds update` on an existing clone
 #       is a fast fetch+checkout of the pinned revs. Correctness-safe: update
-#       always checks out feeds.conf's pins, and ci/sdk-build*.sh wipes the
+#       always checks out feeds.conf's pins, and ci/sdk-build-apk.sh wipes the
 #       cache + re-clones fresh if update ever fails on a cached checkout.
-#       Key = lane + SDK release (shared across the two arch jobs of a lane —
-#       same release pins identical feed revs; the sequential runner means the
-#       second arch restores what the first saved). restore-keys lets an SDK
-#       version bump start from the old clones (git fetch delta, not re-clone).
+#       Key = lane + SDK release (shared across the two arch jobs — the same
+#       release pins identical feed revs; the sequential runner means the second
+#       arch restores what the first saved). restore-keys lets an SDK version
+#       bump start from the old clones (git fetch delta, not re-clone).
 #   Act_runner facts this design leans on (verified in run 51 logs):
 #     - the cache backend works: restores/saves confirmed, hashFiles() works;
-#     - docker images (openwrt/sdk, debian:bookworm, runner-images) live on the
-#       PERSISTENT host daemon — "Image is up to date" each run, no re-download;
+#     - docker images (debian:bookworm, runner-images) live on the PERSISTENT
+#       host daemon — "Image is up to date" each run, no re-download;
 #     - each actions/cache SAVE is followed by an exact 3-minute act_runner
 #       stall (node process lingers; hit→no-save→no stall). Steady state saves
 #       nothing, so adding cache entries is fine, but keys that change every
 #       run (e.g. github.sha) would cost +3 min/entry/run — do NOT do that.
-
 name: release
 
 on:
@@ -125,54 +122,49 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  build:
-    name: ${{ matrix.arch }}
+  # ---------------------------------------------------------------------------
+  # THE TEST GATE (2026-07-26). Everything below `needs:` this job, so a red test
+  # stops the release instead of shipping with it.
+  #
+  # WHY IT IS A JOB HERE AND NOT JUST .gitea/workflows/test.yml: a separate
+  # workflow cannot block another one — they run side by side and a red `test`
+  # workflow would have published anyway. Only a `needs:` edge inside THIS
+  # workflow is a gate. test.yml exists too, for fast feedback on `main`; both
+  # call the same scripts/run-tests.sh so they cannot drift.
+  #
+  # WHAT WAS BROKEN: the release tract ran two `go test` invocations in total —
+  # build-shaterd.sh's one-package buildtags check and check-router-tags.sh's
+  # three named tests. 115 of the 116 test files under shater/** had never run in
+  # CI (upstream's .github/workflows/test.yml triggers on branches this fork does
+  # not have, and Gitea ignores .github/workflows entirely once .gitea/workflows
+  # exists). TestDNSFilterRemoteBlocklistHTTPClient shipped red twice.
+  #
+  # WHAT IT COVERS: the whole suite under the SHIPPED build tags
+  # (scripts/router-tags.sh) on linux — the two dimensions that were missing.
+  # transport/wireguard compiles 1 test file without the tag set and 7 with it
+  # (the AmneziaWG ones); shater/generate has 44 test files on linux against 32
+  # elsewhere. Plus a -race pass and the panel's TypeScript tests. Details and
+  # the named, reasoned exclusions are in scripts/run-tests.sh.
+  test:
+    name: test gate
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: x86_64,             sdk: x86_64-24.10.4 }            # testbed VM (generic x86-64)
-          - { arch: aarch64_cortex-a53, sdk: mediatek-filogic-24.10.4 }  # BPI-R3 + BPI-R4 (mediatek/filogic)
     steps:
-      # fetch-depth: 0 — the package version is DERIVED from the git tag
-      # (ci/version.sh: nearest `vX.Y.Z` + commits since it). The default
-      # shallow checkout has neither tags nor ancestry, so `git describe` would
-      # fail and every dispatch build would fall back to 0.0.0.
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
 
-      # scripts/build-shaterd.sh builds the engine via a go.mod
-      # `replace => ./submodules/wireguard-go` (AmneziaWG fork), so that submodule
-      # must be present or `go build` dies with "no such file or directory".
-      # actions/checkout does not fetch submodules by default; init ONLY this one
-      # (clients/apple+android are large and unused here).
+      # go.mod `replace`s wireguard-go to ./submodules/wireguard-go, so without
+      # this even `go list` fails. Same step/reason as in build-apk below.
       - name: Init wireguard-go submodule (awg)
         run: git submodule update --init --depth 1 submodules/wireguard-go
 
-      # THE version step (bug B4). One computation, used by both the binary
-      # (constant.Version) and the three tag-versioned packages, exported to
-      # every later step of this job:
-      #   tag vX.Y.Z -> X.Y.Z-r1 ; off-tag -> <last tag>-r<commits+1>
-      - name: Compute version from git tag
-        run: bash ci/version.sh --env >> "$GITHUB_ENV"
-
-      # Toolchain for scripts/build-shaterd.sh: Go (daemon), Node (Vite SPA), UPX.
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version-file: go.mod   # pins Go 1.24.7 (go.mod `go` line)
-          cache: false              # explicit actions/cache@v3.3.2 below (setup-go's
-                                    # built-in cache uses the new API act_runner lacks)
+          go-version-file: go.mod
+          cache: false              # explicit actions/cache@v3.3.2 below
 
-      - name: Set up Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'        # Vite 5 needs Node 18+; 20 LTS
-
-      # ---- caches (see the header comment for keys + version pin rationale) ----
+      # Same cache key as build-apk: this job runs first, so it warms the module
+      # + build cache the SDK-lane build then restores. (v3.3.2 pin: see header.)
       - name: Cache Go modules + build cache
         uses: actions/cache@v3.3.2
         with:
@@ -183,92 +175,36 @@ jobs:
           restore-keys: |
             go-
 
+      # Node 24, NOT the 20 build-apk uses for the SPA: panel's tests are
+      # TypeScript run directly by `node --test`, and type stripping only exists
+      # from 22.6 — on node 20 `npm test` dies before running a single case.
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
       - name: Cache panel node_modules
-        id: npm-cache
         uses: actions/cache@v3.3.2
         with:
           path: panel/node_modules
           key: npm-${{ hashFiles('panel/package-lock.json') }}
-          # NO restore-keys: node_modules must exactly match the lockfile;
-          # on any lockfile change this misses and `npm ci` runs fresh.
 
-      - name: Cache SDK dl/ (package sources)
-        uses: actions/cache@v3.3.2
-        with:
-          path: .cache/dl
-          key: dl-${{ hashFiles('openwrt/*/Makefile') }}
-          restore-keys: |
-            dl-
+      - name: Panel tests
+        run: bash scripts/run-panel-tests.sh
 
-      # feeds git checkouts (see header): both 24.10.4 arch jobs share one entry
-      # (same release = same feeds.conf.default pins), so derive the release
-      # from the matrix sdk tag (x86_64-24.10.4 -> 24.10.4).
-      - name: Compute feeds cache key
-        id: feedskey
-        run: echo "ver=$(echo '${{ matrix.sdk }}' | sed 's/.*-//')" >> "$GITHUB_OUTPUT"
-
-      - name: Cache SDK feeds checkouts
-        uses: actions/cache@v3.3.2
-        with:
-          path: .cache/feeds
-          key: feeds-opkg-${{ steps.feedskey.outputs.ver }}
-          restore-keys: |
-            feeds-opkg-
-
-      - name: Cache CI tools (usign)
-        uses: actions/cache@v3.3.2
-        with:
-          path: .cache/tools
-          key: tools-usign-v1
-
-      - name: Install UPX
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq upx-ucl
-
-      # Build the SPA-embedded, static-musl, UPX'd shaterd for BOTH arches and
-      # stage dist/shaterd-<a>.upx into openwrt/shaterd/files/. MUST run before
-      # the SDK package build (the openwrt/shaterd package installs the staged
-      # artifact). $SHATER_VERSION (from the version step above) is stamped into
-      # constant.Version, so the binary and the package agree. On an exact
-      # node_modules cache hit, --fast skips the redundant `npm ci`.
-      - name: Build & stage shaterd artifact
-        env:
-          NPM_CACHE_HIT: ${{ steps.npm-cache.outputs.cache-hit }}
-        run: |
-          set -eu
-          FAST=""
-          if [ "${NPM_CACHE_HIT:-}" = "true" ]; then FAST="--fast"; fi
-          echo "shaterd version: $SHATER_VERSION / package ${SHATER_PKG_VERSION}-r${SHATER_PKG_RELEASE} (npm cache hit: ${NPM_CACHE_HIT:-false})"
-          bash scripts/build-shaterd.sh $FAST
-
-      # Compile the 4 packages through the arch-matched OpenWrt SDK and produce a
-      # signed per-arch opkg feed (Packages + Packages.gz + Packages.sig + .ipk).
-      # SHATER_PKG_VERSION/SHATER_PKG_RELEASE reach the package Makefiles through
-      # the SDK container; ci/sdk-build.sh asserts the .ipk really carry them.
-      - name: Build signed feed (SDK)
-        env:
-          KEY_BUILD: ${{ secrets.KEY_BUILD }}
-        run: bash ci/build-feed.sh "${{ matrix.arch }}" "${{ matrix.sdk }}" "out/${{ matrix.arch }}"
-
-      - name: Show feed
-        run: ls -l "out/${{ matrix.arch }}" && cat "out/${{ matrix.arch }}/Packages"
-
-      - name: Upload feed artifact
-        # v4 uses an artifact backend Gitea Actions does not implement
-        # (GHESNotSupportedError); v3 works on Gitea's act_runner.
-        uses: actions/upload-artifact@v3
-        with:
-          name: shater-${{ matrix.arch }}
-          path: out/${{ matrix.arch }}/*
-          if-no-files-found: error
+      - name: Go tests (shipped tags, linux, + race)
+        run: bash scripts/run-tests.sh
 
   # ---------------------------------------------------------------------------
-  # APK lane (additive): the same 4 packages through the ImmortalWrt 25.12
-  # apk-SDK for the 25.12/apk fleet (BananaWRT 25.12-mtk-vendor routers + the
-  # future 25.12 VM). Produces a per-arch apk repo dir: *.apk + EC-signed
-  # packages.adb + shater-apk.pem. Artifact prefix `apkfeed-` (NOT `shater-`)
-  # so the opkg release job's `artifacts/shater-*` glob never picks these up.
+  # Build the 4 packages through the ImmortalWrt 25.12 apk-SDK for the 25.12/apk
+  # fleet (BPI-R3 mini on BananaWRT 25.12-mtk-vendor, BPI-R4 on OpenWrt 25.12,
+  # and the testbed VM). Produces a per-arch apk repo dir: *.apk + EC-signed
+  # packages.adb + shater-apk.pem, uploaded as the artifact `apkfeed-<arch>`.
   build-apk:
     name: apk ${{ matrix.arch }}
+    # THE GATE EDGE. A red test skips this job, which leaves no artifact, which
+    # (with the guards in release-apk) leaves nothing published.
+    needs: test
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -281,8 +217,10 @@ jobs:
           - arch: aarch64_cortex-a53  # BPI-R3 mini (BananaWRT 25.12-mtk-vendor) + BPI-R4
             sdk_url: https://downloads.immortalwrt.org/releases/25.12.1/targets/mediatek/filogic/immortalwrt-sdk-25.12.1-mediatek-filogic_gcc-14.3.0_musl.Linux-x86_64.tar.zst
     steps:
-      # fetch-depth: 0 — see the opkg lane: the package version comes from
-      # `git describe`, which needs tags + ancestry.
+      # fetch-depth: 0 — the package version is DERIVED from the git tag
+      # (ci/version.sh: nearest `vX.Y.Z` + commits since it). The default
+      # shallow checkout has neither tags nor ancestry, so `git describe` would
+      # fail and every dispatch build would fall back to 0.0.0.
       - name: Checkout
         uses: actions/checkout@v4
         with:
@@ -295,8 +233,10 @@ jobs:
       - name: Init wireguard-go submodule (awg)
         run: git submodule update --init --depth 1 submodules/wireguard-go
 
-      # Same single version computation as the opkg lane — both lanes MUST agree
-      # on the version, they package the identical tree.
+      # THE version step (bug B4). One computation, used by both the binary
+      # (constant.Version) and the three tag-versioned packages, exported to
+      # every later step of this job:
+      #   tag vX.Y.Z -> X.Y.Z-r1 ; off-tag -> <last tag>-r<commits+1>
       - name: Compute version from git tag
         run: bash ci/version.sh --env >> "$GITHUB_ENV"
 
@@ -373,11 +313,27 @@ jobs:
           restore-keys: |
             feeds-apk-
 
+      # D23 — the shipped tag set is a TRIMMED subset (scripts/router-tags.sh);
+      # everything else in CI builds with the full upstream set, so without this
+      # step the one combination we actually ship is never exercised. That is how
+      # `with_gvisor` was trimmed while `with_wireguard` stayed and every shipped
+      # binary answered a WireGuard node with "gVisor is not included in this
+      # build" (2026-07-25). The check runs the declared-feature/tag comparison
+      # and then constructs one node of every declared protocol through box.New
+      # UNDER THE SHIPPED TAGS. It runs before the artifact build so a tag trim
+      # that breaks a feature fails the release instead of shipping.
+      - name: Verify the shipped build-tag set (D23)
+        run: bash scripts/check-router-tags.sh
+
       - name: Install UPX
         run: sudo apt-get update -qq && sudo apt-get install -y -qq upx-ucl
 
-      # Same artifact-order contract as the opkg lane: the SPA-embedded shaterd
-      # binary is built OUT of the SDK and staged before the package build.
+      # Artifact-order contract: the SPA-embedded shaterd binary is built OUT of
+      # the SDK and staged into openwrt/shaterd/files/ BEFORE the package build
+      # (the openwrt/shaterd package only installs the staged artifact).
+      # $SHATER_VERSION (from the version step above) is stamped into
+      # constant.Version, so the binary and the package agree. On an exact
+      # node_modules cache hit, --fast skips the redundant `npm ci`.
       - name: Build & stage shaterd artifact
         env:
           NPM_CACHE_HIT: ${{ steps.npm-cache.outputs.cache-hit }}
@@ -409,124 +365,34 @@ jobs:
           if-no-files-found: error
 
   # ---------------------------------------------------------------------------
-  # Publish once both arches are built. Rolling `latest` on dispatch, a versioned
-  # release on a `vX.Y.Z` tag. Self-contained (curl -> Gitea API).
-  release:
-    name: release
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Download all arch feeds
-        uses: actions/download-artifact@v3
-        with:
-          path: artifacts
-
-      - name: Assemble release assets
-        id: assets
-        run: |
-          set -eu
-          mkdir -p release
-          # For each downloaded arch feed: one ready-to-serve tarball + loose ipks.
-          for d in artifacts/shater-*; do
-            [ -d "$d" ] || continue
-            arch="${d#artifacts/shater-}"
-            tar -C "$d" -czf "release/shater-feed-${arch}.tar.gz" .
-            # loose .ipk for direct `opkg install <url>` (dedupe shared _all ipks by name)
-            for ipk in "$d"/*.ipk; do
-              [ -e "$ipk" ] || continue
-              cp -n "$ipk" "release/$(basename "$ipk")"
-            done
-          done
-          # ship the feed's public key so routers can verify (see docs-shater/INSTALL.md)
-          cp -f dist/shater-feed.pub release/shater-feed.pub
-          ls -l release
-          echo "count=$(ls release | wc -l)" >> "$GITHUB_OUTPUT"
-
-      # restore the prebuilt usign binary (skips apt + cmake + clone + build)
-      - name: Cache CI tools (usign)
-        uses: actions/cache@v3.3.2
-        with:
-          path: .cache/tools
-          key: tools-usign-v1
-
-      - name: Install usign (feed signer)
-        run: bash ci/install-usign.sh
-
-      - name: Build & sign combined opkg feed index
-        # One Packages/Packages.gz over ALL loose .ipk (every arch + arch=all),
-        # with basename Filenames. opkg filters by Architecture, so a single
-        # release URL serves every device: BPI routers pick aarch64_cortex-a53 +
-        # all, the x86 testbed picks x86_64 + all. Signed with KEY_BUILD so
-        # routers keep check_signature on. This is what makes the release directly
-        # consumable as an `src/gz` feed (see docs-shater/INSTALL.md).
-        env:
-          KEY_BUILD: ${{ secrets.KEY_BUILD }}
-        run: bash ci/make-index.sh release
-
-      - name: Determine release identity
-        id: rel
-        run: |
-          set -eu
-          if [ "${GITHUB_REF#refs/tags/}" != "$GITHUB_REF" ]; then
-            echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
-            echo "name=shater ${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
-            echo "prerelease=false" >> "$GITHUB_OUTPUT"
-            echo "rolling=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "tag=latest" >> "$GITHUB_OUTPUT"
-            echo "name=shater latest (main)" >> "$GITHUB_OUTPUT"
-            echo "prerelease=true" >> "$GITHUB_OUTPUT"
-            echo "rolling=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Publish Gitea release
-        env:
-          TOKEN: ${{ secrets.RELEASE_TOKEN != '' && secrets.RELEASE_TOKEN || github.token }}
-          TAG: ${{ steps.rel.outputs.tag }}
-          NAME: ${{ steps.rel.outputs.name }}
-          PRERELEASE: ${{ steps.rel.outputs.prerelease }}
-          ROLLING: ${{ steps.rel.outputs.rolling }}
-          BODY: |
-            Automated build. Packages: shaterd + byedpi (per-arch), shater-core +
-            luci-app-shater (arch=all).
-            Targets: x86_64 (testbed) and aarch64_cortex-a53 (BPI-R3 + BPI-R4, mediatek/filogic).
-
-            ── Add as an opkg feed (recommended — then updating is one command) ──
-            This release is itself a SIGNED package feed; opkg filters by
-            architecture, so the same lines work on every device:
-              wget -O /etc/opkg/keys/5ac4b177689cb8e0 https://git.qomar.pw/omar/shater/releases/download/latest/shater-feed.pub
-              echo "src/gz shater https://git.qomar.pw/omar/shater/releases/download/latest" >> /etc/opkg/customfeeds.conf
-              opkg update
-              opkg install luci-app-shater        # pulls shater-core + shaterd too
-            The public-key install is one-time; after it, `opkg update/upgrade`
-            verify the signature with check_signature left on. Full guide: docs-shater/INSTALL.md.
-
-            ── Update (name our packages — never a bare `opkg upgrade`) ──
-              opkg update
-              opkg upgrade shaterd shater-core luci-app-shater byedpi
-
-            ── Or install the loose .ipk directly / from the tarball feed ──
-              wget -O /tmp/f.tgz <this release>/shater-feed-aarch64_cortex-a53.tar.gz
-              mkdir -p /tmp/shater && tar -C /tmp/shater -xzf /tmp/f.tgz
-              opkg install /tmp/shater/luci-app-shater_*_all.ipk
-        run: bash ci/gitea-release.sh release/*
-
-  # ---------------------------------------------------------------------------
-  # Publish the apk lane: ONE release PER ARCH (apk package filenames carry no
-  # arch, and apk fetches `<name>-<ver>.apk` relative to the packages.adb URL —
-  # a flat multi-arch release would collide). Rolling `apk-latest-<arch>` on
-  # dispatch, `apk-<tag>-<arch>` on a version tag. The tags do NOT match the
-  # workflow's `v*` trigger, so publishing them cannot re-trigger the build.
+  # Publish: ONE release PER ARCH (apk package filenames carry no arch, and apk
+  # fetches `<name>-<ver>.apk` relative to the packages.adb URL — a flat
+  # multi-arch release would collide). Every run refreshes the ROLLING pointer
+  # `apk-latest-<arch>`; a `vX.Y.Z` tag run ALSO publishes the pinnable
+  # `apk-vX.Y.Z-<arch>`. The tags do NOT match the workflow's `v*` trigger, so
+  # publishing them cannot re-trigger the build.
+  #
+  # WHY THE ROLLING RELEASE IS PUBLISHED ON TAG RUNS TOO (fixed 2026-07-25):
+  # it used to be an either/or — `TAG=apk-latest-<arch>` on dispatch, ELSE
+  # `TAG=apk-<ver>-<arch>` — so once releases moved to tag pushes the rolling
+  # pointer was never written again. It froze at 0.2.0 (published 2026-07-24)
+  # while v0.2.9/v0.2.10 published fine, and every router whose
+  # /etc/apk/repositories.d/shater.list points at the rolling URL kept getting a
+  # successful, silent `apk update` with nothing new. Rolling is the whole point
+  # of that URL, so it is now written unconditionally and asserted afterwards.
   release-apk:
     name: release apk
-    needs: build-apk
+    needs: [test, build-apk]
     # Publish whatever arch feeds succeeded — do NOT block the aarch64 release
     # when an unrelated arch (e.g. x86_64) fails. download-artifact only fetches
     # artifacts that exist, and the publish loop skips missing apkfeed-* dirs.
-    if: ${{ !cancelled() }}
+    #
+    # `needs.test.result == 'success'` is the second half of the gate. Without
+    # it, `!cancelled()` is true when the test job FAILS (build-apk is then
+    # skipped), this job runs with no artifacts at all, and — see the guard at
+    # the end of the publish step — used to exit 0 having published nothing. Red
+    # tests must SKIP this job, not "succeed" through it.
+    if: ${{ !cancelled() && needs.test.result == 'success' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -537,6 +403,9 @@ jobs:
         with:
           path: artifacts
 
+      # Identity of the VERSIONED release only. The rolling pointer is published
+      # on every run with fixed prerelease=true/rolling=true, so it needs nothing
+      # from here.
       - name: Determine release identity
         id: rel
         run: |
@@ -558,21 +427,47 @@ jobs:
           PRERELEASE: ${{ steps.rel.outputs.prerelease }}
           ROLLING: ${{ steps.rel.outputs.rolling }}
         run: |
-          set -eu
+          set -euo pipefail
+          # Counted, and asserted non-zero at the end. Until 2026-07-26 this loop
+          # was the step's whole body: with no artifacts the glob stayed
+          # unexpanded, `[ -d ... ]` was false, `continue` ran once, the loop
+          # ended and the step exited 0 — "release apk" went GREEN having
+          # published absolutely nothing. Any upstream failure (all arches
+          # failing to build, an artifact-name change, a download-artifact
+          # hiccup) therefore looked like a successful release.
+          published=0
           for d in artifacts/apkfeed-*; do
             [ -d "$d" ] || continue
             arch="${d#artifacts/apkfeed-}"
-            if [ "$VER" = latest ]; then TAG="apk-latest-$arch"; else TAG="apk-$VER-$arch"; fi
+            ROLL="apk-latest-$arch"
+
+            # The version we just built, read straight off the artifact
+            # (`shaterd-<ver>-r<rel>.apk`). NOT recomputed with ci/version.sh:
+            # this job checks out shallow, so it has no tags to describe from.
+            pkg=""
+            for a in "$d"/shaterd-*.apk; do
+              if [ -f "$a" ]; then pkg="$(basename "$a")"; fi
+            done
+            [ -n "$pkg" ] || { echo "[release-apk] ERROR: no shaterd-*.apk in $d"; exit 11; }
+            want="${pkg#shaterd-}"; want="${want%.apk}"
+            echo "[release-apk] arch=$arch built version=$want"
+
             BODY="Automated apk (OpenWrt/ImmortalWrt 25.12+) package repo for \`$arch\`.
           Packages: shaterd + byedpi (per-arch), shater-core + luci-app-shater (arch=all).
+          This build: \`$want\`.
           The index \`packages.adb\` is EC-signed; trust anchor \`shater-apk.pem\` (also in \`dist/\`).
 
-          ── Add as an apk repository ──
-            wget -O /etc/apk/keys/shater-apk.pem https://git.qomar.pw/omar/shater/releases/download/$TAG/shater-apk.pem
+          ── Add as an apk repository (rolling — install once, then just update) ──
+            wget -O /etc/apk/keys/shater-apk.pem https://git.qomar.pw/omar/shater/releases/download/$ROLL/shater-apk.pem
             echo \"https://git.qomar.pw/omar/shater/releases/download/apk-latest-\$(cat /etc/apk/arch)/packages.adb\" > /etc/apk/repositories.d/shater.list
             apk update
             apk add luci-app-shater      # pulls shater-core + shaterd too
             apk add byedpi               # optional: ByeDPI desync egress
+          \`apk-latest-<arch>\` is a MOVING pointer: every release run replaces its
+          assets, so the same repo line keeps serving the newest build. To pin a
+          version instead, point the repo line at
+          \`.../download/apk-vX.Y.Z-\$(cat /etc/apk/arch)/packages.adb\` — then the
+          file must be edited by hand for each upgrade.
           ── Update — ALWAYS name the packages, NEVER a bare \`apk upgrade\` ──
             apk update
             apk upgrade shaterd shater-core luci-app-shater byedpi
@@ -580,9 +475,66 @@ jobs:
           configured repo and can downgrade unrelated system packages; naming them
           upgrades only those (apk-tools 3: \"If list of packages is provided, only
           those packages are upgraded along with needed dependencies\").
-          Full guide: docs-shater/INSTALL.md §6. The opkg/24.10 feed lives in the \`latest\` release."
-            echo "[release-apk] publishing $TAG from $d"
-            TAG="$TAG" NAME="shater apk $VER ($arch)" BODY="$BODY" \
-              PRERELEASE="$PRERELEASE" ROLLING="$ROLLING" \
+          Full guide: docs-shater/INSTALL.md §5."
+
+            # 1) the pinnable versioned release (tag runs only)
+            if [ "$VER" != latest ]; then
+              echo "[release-apk] publishing apk-$VER-$arch from $d"
+              TAG="apk-$VER-$arch" NAME="shater apk $VER ($arch)" BODY="$BODY" \
+                PRERELEASE="$PRERELEASE" ROLLING="$ROLLING" \
+                bash ci/gitea-release.sh "$d"/*
+            fi
+
+            # 2) the rolling pointer — ALWAYS, tag run included. ci/gitea-release.sh
+            #    deletes the existing release before recreating it, so the old
+            #    version's assets are REPLACED, never accumulated (two versions of
+            #    one package in one index would let apk choose, not us).
+            echo "[release-apk] publishing $ROLL from $d"
+            TAG="$ROLL" NAME="shater apk latest ($arch)" BODY="$BODY" \
+              PRERELEASE=true ROLLING=true \
               bash ci/gitea-release.sh "$d"/*
+
+            # 3) ASSERT the rolling release really serves THIS build — same class
+            #    of check as ci/sdk-build-apk.sh's package-version assert, and for
+            #    the same reason: the previous failure mode was silent. Reads the
+            #    published release back over the API and requires our three
+            #    tag-versioned packages at $want, the index, the key — and NO
+            #    left-over package asset at any other version.
+            api="$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY/releases/tags/$ROLL"
+            got="$(curl -fsS -H "Authorization: token $TOKEN" "$api" \
+                   | tr '{},' '\n\n\n' \
+                   | sed -n 's/.*"name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | sort -u)" || {
+              echo "[release-apk] ERROR: cannot read back $ROLL from the API"; exit 12; }
+            echo "[release-apk] $ROLL assets: $(printf '%s ' $got)"
+            # here-string, NOT `printf | grep -q`: under `pipefail` the early
+            # exit of grep -q can SIGPIPE the writer and fail a passing check.
+            for f in "shaterd-$want.apk" "shater-core-$want.apk" \
+                     "luci-app-shater-$want.apk" packages.adb shater-apk.pem; do
+              grep -qxF "$f" <<<"$got" || {
+                echo "[release-apk] ERROR: $ROLL does not contain '$f' after publish."
+                echo "        A router pinned to the rolling URL would have silently"
+                echo "        stayed on its old version with a successful apk update."
+                exit 13; }
+            done
+            stale="$(grep -E '^(shaterd|shater-core|luci-app-shater)-.*\.apk$' <<<"$got" \
+                     | grep -vxF -e "shaterd-$want.apk" -e "shater-core-$want.apk" \
+                                 -e "luci-app-shater-$want.apk" || true)"
+            [ -z "$stale" ] || {
+              echo "[release-apk] ERROR: $ROLL still holds stale package assets:"
+              printf '          %s\n' $stale
+              echo "        Two versions of one package in one feed = apk picks by its"
+              echo "        own rules, not by our intent."
+              exit 14; }
+            echo "[release-apk] OK — $ROLL serves $want"
+            published=$((published + 1))
           done
+
+          # The assert the loop above never had. Zero feeds published is a failed
+          # release, not a quiet success — say so with a non-zero exit.
+          if [ "$published" -eq 0 ]; then
+            echo "[release-apk] ERROR: no apkfeed-* artifact reached this job, so"
+            echo "        NOTHING was published. Downloaded tree:"
+            ls -la artifacts 2>&1 | sed 's/^/          /' || echo "          (no artifacts/ dir at all)"
+            exit 10
+          fi
+          echo "[release-apk] published $published arch feed(s)"

.gitea/workflows/test.yml

@@ -0,0 +1,85 @@
+# Shater — the test gate, on every push to `main`.
+#
+# WHY THIS FILE EXISTS (2026-07-26)
+#   The fork had a full suite and no CI that ran it. Upstream's
+#   .github/workflows/test.yml triggers on `stable`/`testing`/`unstable`; this
+#   repo only has `main`. And Gitea does not read .github/workflows AT ALL once
+#   .gitea/workflows exists — so those files are decoration here. Result: 115 of
+#   the 116 test files under shater/** had never once executed in CI, and
+#   TestDNSFilterRemoteBlocklistHTTPClient stayed red across two published
+#   releases.
+#
+# RELATIONSHIP TO release.yml
+#   This workflow is the FAST FEEDBACK loop on `main`. It is NOT the release
+#   gate: a separate workflow cannot block another one. The gate is the `test`
+#   JOB inside .gitea/workflows/release.yml, which build-apk `needs:` — see the
+#   comment there. Both run the very same scripts/run-tests.sh, so they cannot
+#   drift apart.
+name: test
+
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - '**.md'
+      - 'docs-shater/**'
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: go + panel tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # go.mod has `replace github.com/sagernet/wireguard-go => ./submodules/
+      # wireguard-go`, so WITHOUT this every `go list`/`go test` fails before it
+      # starts. Same step, same reason, as in release.yml's build job.
+      - name: Init wireguard-go submodule (awg)
+        run: git submodule update --init --depth 1 submodules/wireguard-go
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: false              # explicit actions/cache@v3.3.2 below
+
+      # v3.3.2 is the last release speaking the cache API act_runner implements
+      # (see the header of release.yml). Same key as the release build job, so
+      # whichever runs first warms the other.
+      - name: Cache Go modules + build cache
+        uses: actions/cache@v3.3.2
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: go-${{ hashFiles('go.sum') }}
+          restore-keys: |
+            go-
+
+      # Node 24, NOT the 20 the SPA build uses: panel's tests are TypeScript run
+      # through `node --test`, and type stripping only exists from 22.6. On
+      # node 20 `npm test` dies with a syntax error before running anything.
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Cache panel node_modules
+        uses: actions/cache@v3.3.2
+        with:
+          path: panel/node_modules
+          key: npm-${{ hashFiles('panel/package-lock.json') }}
+
+      - name: Panel tests
+        run: bash scripts/run-panel-tests.sh
+
+      - name: Go tests (shipped tags, linux, + race)
+        run: bash scripts/run-tests.sh

.gitignore

@@ -63,7 +63,7 @@ nul
 /venv/
 /test/cache.db
 
-# feed artifacts (tracked public key dist/shater-feed.pub is force-added)
+# feed artifacts (the tracked apk trust anchor dist/shater-apk.pem is force-added)
 /dist/
 
 # local agent config (CLAUDE.md is deliberately tracked; .claude local settings are not)

.gitmodules

@@ -7,4 +7,10 @@
 [submodule "submodules/wireguard-go"]
 	path = submodules/wireguard-go
 	url = https://github.com/Leadaxe/wireguard-go-awg2-lx
-	branch = lx
+	# The pin lives on lx-awg2-v005, NOT on lx: the two are separate lines (42
+	# commits apart one way, 131 the other). `lx` has no hasReserved() gate in
+	# conn/bind_std.go at all, so a `git submodule update --remote` against it
+	# would silently restore the bug where ClientBind/StdNetBind shred the
+	# AmneziaWG magic header and no chain carries traffic. Keep this pointing at
+	# the line the pin is actually on.
+	branch = lx-awg2-v005

CLAUDE.md

@@ -6,61 +6,155 @@
 ## Правила делегирования
 
 1. ЛЮБАЯ реализация (код, тесты, конфиги, рефакторинг, отладка) выполняется
-   субагентами через инструмент Agent с `model: "fable"`. Сам ты правишь файлы
-   только в одном случае: тривиальная правка в 1–2 строки, где постановка
-   задачи дороже самой правки.
+   субагентами через инструмент Agent. Сам ты правишь файлы только в одном
+   случае: тривиальная правка в 1–2 строки, где постановка задачи дороже самой
+   правки.
 
-2. Перед делегированием ты сам исследуешь код настолько, чтобы написать
-   точное ТЗ. В каждом задании субагенту обязательно указывай:
-   - контекст: что это за проект и над чем идёт работа;
-   - конкретные файлы и функции, которые нужно менять (пути, а не «найди сам»);
+2. **Модель выбирает исполнитель задачи, а не привычка.** `fable` — быстрый и
+   дешёвый, годится для механической работы с ясным контрактом. `opus` — для
+   всего, где нужно рассуждение: поиск причины, аудит, дизайн, работа в чужом
+   коде. Если у `fable` кончилась квота — молча переходи на `opus`, это не повод
+   останавливать работу. Не спрашивай владельца, какую модель брать.
+
+3. Перед делегированием ты сам исследуешь код настолько, чтобы написать точное
+   ТЗ. В каждом задании субагенту обязательно указывай:
+   - контекст: что за проект и над чем идёт работа;
+   - конкретные файлы и функции (пути, а не «найди сам»);
    - контракт: сигнатуры, форматы данных, инварианты, что менять НЕЛЬЗЯ;
-   - definition of done: как проверить, что задача выполнена
-     (какие команды/тесты прогнать и какой ожидается результат);
-   - что вернуть в финальном ответе: список изменённых файлов, результаты
-     проверок, найденные проблемы и принятые решения.
+   - definition of done: какие команды прогнать и какой ждать результат;
+   - что вернуть: изменённые файлы, результаты проверок, найденные проблемы,
+     принятые решения.
 
-3. Скиллы: при постановке задачи посмотри список доступных скиллов и ЯВНО
-   перечисли в ТЗ, какие скиллы субагент обязан вызвать через инструмент Skill
-   до начала работы (например: «сначала вызови Skill "openwrt-procd-services"
-   и следуй ему»). Субагент не видит наш диалог и сам не догадается — пиши
-   названия скиллов прямо в текст задания.
+4. **Скиллы использовать по максимуму — и тебе, и агентам.** Это не
+   формальность: в них лежит выстраданное знание по ровно тем предметным
+   областям, в которых мы работаем, и игнорировать их — значит переоткрывать
+   чужие грабли. См. раздел «Скиллы» ниже.
 
-4. Независимые задачи запускай ПАРАЛЛЕЛЬНО — несколько вызовов Agent в одном
-   сообщении, каждый с `model: "fable"`. Зависимые — последовательно, передавая
-   в следующее ТЗ результаты предыдущего.
+5. Независимые задачи запускай ПАРАЛЛЕЛЬНО — несколько вызовов Agent в одном
+   сообщении. Зависимые — последовательно, передавая результаты предыдущего.
+   **Делишь файлы между параллельными агентами явно** и пишешь каждому, кто ещё
+   работает в дереве и что трогать нельзя. Запрещай им `git stash`,
+   `git checkout <файл>`, `git reset` — в этом проекте агент уже сносил правки
+   соседа через `git stash push`.
 
-5. Приёмка: результат каждого субагента ты проверяешь сам (читаешь diff
-   ключевых мест, гоняешь проверки из definition of done). Если результат
-   не принят — не переделывай сам, а верни задачу: доработку заказывай тому же
-   агенту через SendMessage (у него сохранён контекст), а не новым спавном.
+6. Приёмка: результат каждого субагента ты проверяешь сам — читаешь diff
+   ключевых мест, гоняешь проверки из definition of done. Не принимай отчёт на
+   слово: сегодня отчёт «тесты зелёные» дважды сопровождался тестом, который
+   ничего не прибивал. Если результат не принят — не переделывай сам, а верни
+   задачу тому же агенту через SendMessage (у него сохранён контекст).
 
-6. Финальный отчёт пользователю: что сделано, кем (сколько агентов),
-   что проверено, что осталось.
+7. Финальный отчёт владельцу: что сделано, сколько агентов, что проверено,
+   **что осталось непроверенным и почему** — последнее так же важно.
+
+## Инженерные стандарты
+
+Это не пожелания. Каждый пункт здесь появился после того, как его отсутствие
+стоило рабочего дня.
+
+- **Тест обязан быть проверен мутацией.** Откатить фикс → показать, что тест
+  падает, и с каким текстом → вернуть фикс. Тест, не падающий на сломанном коде,
+  не тест, а украшение.
+
+- **Прибор без контроля не доказывает ничего.** Отрицательный результат чего-то
+  стоит, только если показано, что этот же прибор умеет дать положительный.
+  «Утечки не нашли» прибором, который не мог её увидеть, — это не результат.
+
+- **Опровержение ценнее согласия.** В каждом ТЗ прямо разрешай субагенту
+  сказать «твоя версия неверна» и требуй доказательства, а не вежливости.
+  Лучшие результаты этого проекта приходили именно так.
+
+- **Не обещать непроверенного.** Комментарий, предупреждение и текст в панели —
+  это утверждения о поведении. Если поведение не проверено, так и писать.
+  Формально верная фраза, которая читается как «работает», — тоже ложь.
+
+- **Умолчание падает в восстановимую сторону.** Открытый `default:` в разборе
+  вариантов — источник целого класса дефектов: неучтённое значение уходит туда,
+  где дороже всего ошибиться. Списки делать положительными и закрытыми.
+
+- **Проверка присутствия обязана покрывать всё, что ставит её Apply-двойник.**
+  Иначе идемпотентный быстрый путь становится ловушкой: «всё на месте» при
+  отсутствующем маршруте.
+
+- **Никакого молчаливого скипа.** Тест, который не выполнился, обязан быть
+  назван поимённо в выводе гейта. Однажды CI гонял два теста из 116 файлов, и
+  все считали, что покрыто.
+
+## Скиллы
+
+**Правило: если задача касается области, по которой есть скилл, — скилл
+вызывается ДО начала работы, а не после того, как что-то не заработало.**
+Это относится и к тебе, и к каждому субагенту.
+
+Субагент не видит наш диалог и сам не догадается, что скиллы существуют.
+Поэтому **в каждом ТЗ перечисляй поимённо**, какие скиллы он обязан вызвать
+через инструмент Skill: «сначала вызови Skill "openwrt-nftables" и Skill
+"openwrt-networking", следуй им». Требуй в отчёте сказать, что именно из скилла
+он применил, — так видно, вызвал он его или упомянул.
+
+Соответствие областей этого проекта и скиллов:
+
+| Трогаешь | Обязательные скиллы |
+|---|---|
+| `/etc/config/*`, `uci`, uci-defaults, парсер модели | `openwrt-uci` |
+| nftables, fw4, зоны, метки, tproxy, kill-switch | `openwrt-nftables` |
+| интерфейсы, мосты, VLAN, policy routing, `ip rule`, sysctl, dnsmasq | `openwrt-networking` |
+| init-скрипты, procd, respawn, service triggers, boot armor | `openwrt-procd-services` |
+| перехват трафика целиком (tproxy + маршрутизация + DNS) | `openwrt-transparent-proxy` |
+| сборка пакетов, SDK, фид, CI, подпись, `apk`/`opkg` | `openwrt-package-build-ci`, `openwrt-native-packages` |
+| LuCI-приложение, ubus/rpcd, ucode | `openwrt-luci-plugin`, `openwrt-ubus-rpcd`, `openwrt-ucode` |
+| панель (React/TS) | `react-expert`, `frontend-design:frontend-design` |
+| Go: конкурентность, каналы, профилирование, идиоматика | `fullstack-dev-skills:golang-pro` |
+| TypeScript | `fullstack-dev-skills:typescript-pro` |
+| стратегия тестирования, покрытие, тестовые данные | `fullstack-dev-skills:test-master` |
+| поиск причины по логам и трассам | `fullstack-dev-skills:debugging-wizard` |
+| проверка в браузере, скриншоты | `fullstack-dev-skills:playwright-expert` |
+| ревью | `review`, `fullstack-dev-skills:code-reviewer` |
+| безопасность | `security-review`, `fullstack-dev-skills:security-reviewer` |
+| графики и визуализация данных | `dataviz` |
+
+Список неполный — **смотри доступные скиллы под задачу**, а не только в эту
+таблицу. Если скилл выглядит смежным, дешевле вызвать его и не воспользоваться,
+чем не вызвать и потом отлаживать то, что там уже описано.
+
+## Проверки
+
+- **Гейт:** `bash scripts/run-tests.sh` — Linux в Docker, боевой набор тегов,
+  `-race`, и шаг, требующий вердикта по имени для привилегированных тестов.
+  Зелёный гейт — необходимое условие, но не достаточное: он не видит стыков с
+  ядром, procd и nftables.
+- **Стенд:** сервер `local_openwrt` в ssh-manager — ImmortalWrt 25.12.1 той же
+  ревизии, что боевой роутер. Сюда — всё, что касается init-скриптов, nft,
+  policy routing, TUN.
+- **Боевой роутер:** `mini_router` (BPI-R3), через него идёт весь домашний
+  трафик. Перед изменением конфигурации — резервная копия. Проверять приборно,
+  а не по логу: лог может печатать одно и то же в честном и в ложном случае.
+
+## Релиз и деплой
+
+- Тег → CI (Gitea Actions) → apk-фид → установка на роутер.
+- **Обновлять только поимённо**, никогда не `apk upgrade` целиком:
+  `apk upgrade shaterd shater-core luci-app-shater byedpi`.
+- **Не трогать кеш CI-раннера** — сборка растянется на часы.
+- Число тегов на порцию работы — на твоё усмотрение, если владелец не сказал
+  иначе.
 
 ## Фронтенд (admin panel)
 
 Дизайн-направление ЗАФИКСИРОВАНО: **Faceplate** (панель сетевого железа).
-Полная спека, токены, компоненты и ссылка на живой эталон — в
-[`docs-shater/DESIGN.md`](docs-shater/DESIGN.md). Эталон:
-https://claude.ai/code/artifact/9f7c07e8-d8ac-4ae1-b113-5b25d0ba5dd2
+Спека, токены и компоненты — в [`docs-shater/DESIGN.md`](docs-shater/DESIGN.md).
+Эталон: https://claude.ai/code/artifact/9f7c07e8-d8ac-4ae1-b113-5b25d0ba5dd2
 
-- **Стек:** Vite + React + TypeScript, лёгкий (SPA встраивается в бинарь —
-  без тяжёлых зависимостей). Расположение: папка `panel/` в корне.
-- **Порядок работ:**
-  1. Сам (оркестратор) скаффолдишь `panel/`, переносишь токены из
-     `docs-shater/DESIGN.md` в `panel/src/tokens.css` один-в-один и задаёшь каркас
-     компонентов. Это фундамент — делай аккуратно сам или отдай ОДНОМУ агенту.
-  2. Дизайн-систему в компоненты: `<Faceplate> <Module> <Toggle> <Led>
-     <SegMeter> <QueryLog>` + кнопки — строго по эталону.
-  3. Страницы раздаёшь ПАРАЛЛЕЛЬНО Opus-агентам (`model: "opus"`), по одной на
-     агента: Overview, Nodes/Subscriptions, Routing rules, DNS/Blocklists,
-     Devices, Apply/Rollback.
-- **В КАЖДОМ ТЗ агенту обязательно:** ссылка на `docs-shater/DESIGN.md` и на эталон;
-  требование сначала вызвать Skill `react-expert` и Skill
-  `frontend-design:frontend-design` и следовать им; список готовых компонентов,
-  которые он ДОЛЖЕН переиспользовать (не изобретать заново); какие токены и
-  семантические цвета применять; DoD — страница совпадает с языком эталона,
-  адаптив + фокус + reduced-motion соблюдены.
-- **Не отходить от Faceplate.** Любой новый экран наследует ту же визуальную
-  систему. Оранжевый — только акцент; семантика good/warn/crit — отдельно.
+- **Стек:** Vite + React + TypeScript в `panel/`. SPA встраивается в бинарь —
+  тяжёлые зависимости недопустимы.
+- **Панель целиком на английском.** Ни одного символа кириллицы в `panel/src`.
+- **В КАЖДОМ ТЗ на панель:** ссылка на `DESIGN.md` и на эталон; требование
+  сначала вызвать Skill `react-expert` и Skill
+  `frontend-design:frontend-design`; список существующих компонентов, которые
+  надо ПЕРЕИСПОЛЬЗОВАТЬ (`<Faceplate> <Module> <Toggle> <Led> <SegMeter>
+  <QueryLog>` и кнопки), а не изобретать заново; какие токены и семантические
+  цвета применять; DoD — совпадение с языком эталона, адаптив, фокус,
+  `prefers-reduced-motion`.
+- Оранжевый — только акцент; семантика good/warn/crit — отдельно.
+- **Панель не должна врать про состояние.** Значение, которое движок примет,
+  не может рисоваться как «never matches»; настройка, которой управляет другая
+  подсистема, не может описываться так, будто управляет ею.

README.en.md

@@ -24,7 +24,8 @@ The engine is a **fork of [sing-box](https://github.com/SagerNet/sing-box) via
 [sing-box-lx](https://github.com/Leadaxe/sing-box-lx)**, compiled into a single Go
 binary `shaterd` together with the control plane, DNS filter, stats aggregator and
 the web panel itself. Broad protocol set: VLESS/VMess/Trojan/Shadowsocks,
-Reality/XTLS, WireGuard, **AmneziaWG 2.0**, Hysteria2, TUIC, XHTTP, MASQUE/CONNECT-IP.
+Reality/XTLS, WireGuard, **AmneziaWG 2.0**, Hysteria2, TUIC, XHTTP — exactly what
+`shater/parse` can read and `shater/registry` registers in the engine.
 
 A thin **LuCI launcher** (mini-dashboard + "Open panel" button) hands the browser a
 single-use token into the standalone SPA the daemon serves on its own port
@@ -32,13 +33,15 @@ single-use token into the standalone SPA the daemon serves on its own port
 
 ## Highlights
 
-- Transparent **TPROXY** data plane (TCP + UDP), SNI/Host/QUIC sniffing, no DNS leaks.
+- Transparent **TPROXY** data plane (TCP + UDP), SNI/Host/QUIC sniffing, no DNS leaks
+  — `:53` interception is on by default and covers the queries a client sends to the
+  router itself, not just the ones aimed around it (`globals.dns_intercept`, D24).
 - First-match routing by source / destination / list / geo / client → outbound /
   selector / chain / direct / block; node groups with balancer/observatory;
   multi-hop chains; per-rule egress.
 - **Fail-closed kill-switch** (dead group → block, never a silent direct leak); own
-  `inet shater` nft table; atomic apply with `nft -c` validation and commit-confirm
-  auto-rollback.
+  `inet shater` nft table; atomic apply with `nft -c` validation. Commit-confirm
+  auto-rollback exists but **ships OFF** (`confirm_timeout=0`) — arm it yourself.
 - **DNS filtering & blocklists** with flexible sources (inline / file / url /
   geosite), compiled `.srs` matcher; Block-DoH/DoT to stop filter bypass.
 - Subscriptions (Clash / sing-box / Xray-JSON) and manual nodes; node health board.
@@ -49,32 +52,40 @@ Full list with MVP/T1/T2 tags — [`docs-shater/FEATURES.md`](docs-shater/FEATUR
 
 ## Install
 
-Two signed feeds. Pick by the router's OpenWrt version. Verbatim commands and the
-manual `.ipk`/`.apk` install are in [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md).
-
-**opkg (OpenWrt 24.10):**
+One signed **apk** feed (OpenWrt / ImmortalWrt / BananaWRT **25.12+**), one
+release per arch. Verbatim commands, the manual `.apk` install and the
+rolling-vs-pinned choice are in
+[`docs-shater/INSTALL.md`](docs-shater/INSTALL.md).
 
 ```sh
-wget -O /etc/opkg/keys/5ac4b177689cb8e0 \
-  https://git.qomar.pw/omar/shater/releases/download/latest/shater-feed.pub
-echo "src/gz shater https://git.qomar.pw/omar/shater/releases/download/latest" \
-  >> /etc/opkg/customfeeds.conf
-opkg update && opkg install luci-app-shater   # -> shater-core -> shaterd
-```
-
-**apk (OpenWrt / ImmortalWrt / BananaWRT 25.12+):**
-
-```sh
-wget -O /etc/apk/keys/shater-apk.pem \
-  "https://git.qomar.pw/omar/shater/releases/download/apk-latest-$(cat /etc/apk/arch)/shater-apk.pem"
-echo "https://git.qomar.pw/omar/shater/releases/download/apk-latest-$(cat /etc/apk/arch)/packages.adb" \
-  > /etc/apk/repositories.d/shater.list
+wget -O /etc/apk/keys/shater-apk.pem   "https://git.qomar.pw/omar/shater/releases/download/apk-latest-$(cat /etc/apk/arch)/shater-apk.pem"
+echo "https://git.qomar.pw/omar/shater/releases/download/apk-latest-$(cat /etc/apk/arch)/packages.adb"   > /etc/apk/repositories.d/shater.list
 apk update && apk add luci-app-shater         # -> shater-core -> shaterd
 ```
 
+`apk-latest-<arch>` is a moving pointer refreshed by every release run — install
+once and `apk update && apk upgrade shaterd shater-core luci-app-shater byedpi`
+keeps the router current. Point the repo line at `apk-vX.Y.Z-<arch>` instead to
+pin a build; that file then has to be edited by hand for every upgrade.
+
 shater ships **inert** (globals off) so install never breaks connectivity. After
-configuring nodes/rules: `uci set shater.globals.enabled=1 && uci commit shater`,
-then `shaterd apply` and `shaterd confirm`.
+configuring nodes/rules:
+
+```sh
+uci set shater.globals.enabled=1
+uci set shater.globals.confirm_timeout=120   # commit-confirm ships OFF — arm it
+uci commit shater
+shaterd apply && shaterd confirm
+```
+
+Without that middle line `shaterd apply` arms no auto-rollback (and says so), so an
+apply that costs you SSH/LuCI access has to be undone by hand.
+
+Once an enabled, fail-closed config has been applied, `/etc/init.d/shater-armor`
+loads a saved fail-closed plane at **boot**, before the daemon exists: LAN→WAN
+forwarding is blocked until `shaterd` applies, while SSH/LuCI/the panel stay
+reachable on purpose (the chain hooks `forward` only). What arms it, what refuses
+to arm, and how to switch it off — `INSTALL.md` §4.
 
 ## Build from source
 
@@ -83,6 +94,15 @@ then `shaterd apply` and `shaterd confirm`.
 into `openwrt/shaterd/files/`. Details in
 [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md).
 
+`bash scripts/run-tests.sh` is the test gate: the whole suite under the **shipped**
+build tags (`scripts/router-tags.sh`), on linux (it re-execs in Docker from a
+non-linux host), with `-race`, plus three machine checks against a silent skip —
+the tag set may only add test files, every package with tests must report `ok` by
+name, and every `TestIntegration*` must produce a verdict by name.
+`scripts/check-router-tags.sh` separately proves no feature declared in
+`FEATURES.md` lost a build tag it needs. A green gate is necessary but not
+sufficient: it does not see the kernel, procd or nftables seams.
+
 ## Repository layout
 
 | Path | What |
@@ -91,16 +111,17 @@ into `openwrt/shaterd/files/`. Details in
 | `panel/` | Admin SPA (Vite + React + TS) and its Go server |
 | `openwrt/` | Packages: `shaterd`, `shater-core`, `luci-app-shater`, `byedpi` |
 | `docs-shater/` | Product documentation |
-| `scripts/`, `ci/`, `.gitea/workflows/` | Build script, feed/release scripts, CI |
+| `scripts/`, `ci/`, `.gitea/workflows/` | Build script, apk feed/release scripts, CI |
 | `SPECS/`, `docs-lx/` | Engine-fork constitution/specs and feature-config reference |
 | `docs/`, `mkdocs.yml` | **Upstream** sing-box docs (mkdocs) — kept as-is |
 | `adapter/ cmd/ dns/ route/ option/ protocol/ transport/ …` | sing-box-lx engine tree |
 
 ## CI, upstream & license
 
-CI (`.gitea/workflows/release.yml`) builds all 4 packages and publishes signed
-feeds: opkg (usign, key `5ac4b177689cb8e0`) and apk (EC key `shater-apk.pem`). A
-`vX.Y.Z` tag → versioned release; `workflow_dispatch` → rolling `latest`.
+CI (`.gitea/workflows/release.yml`) builds all 4 packages and publishes a signed
+per-arch apk repo (EC key `shater-apk.pem`). A `vX.Y.Z` tag → the pinnable
+`apk-vX.Y.Z-<arch>`; every run also refreshes the rolling `apk-latest-<arch>` and
+asserts over the API that it really serves the version just built.
 
 The engine is the **sing-box-lx** fork — a thin downstream of upstream sing-box that
 lives by **rebase, never merge**; its constitution is

README.md

@@ -10,7 +10,7 @@
 
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue.svg)](LICENSE)
 ![targets: x86_64 · aarch64_cortex-a53](https://img.shields.io/badge/targets-x86__64%20%C2%B7%20aarch64__cortex--a53-brightgreen.svg)
-![feeds: opkg 24.10 · apk 25.12](https://img.shields.io/badge/feeds-opkg%2024.10%20%C2%B7%20apk%2025.12-orange.svg)
+![feed: apk 25.12+](https://img.shields.io/badge/feed-apk%2025.12%2B-orange.svg)
 
 ---
 
@@ -27,7 +27,8 @@ BananaWRT** (Banana Pi BPI-R3, BPI-R4 и совместимые). Он проз
 Go-бинарь `shaterd` вместе с control-plane, DNS-фильтром, агрегатором статистики и
 самой веб-панелью. За счёт sing-box поддерживается широкий и актуальный набор
 протоколов: VLESS/VMess/Trojan/Shadowsocks, Reality/XTLS, WireGuard,
-**AmneziaWG 2.0**, Hysteria2, TUIC, XHTTP, MASQUE/CONNECT-IP.
+**AmneziaWG 2.0**, Hysteria2, TUIC, XHTTP — ровно то, что умеет разобрать
+`shater/parse` и что регистрирует `shater/registry` в движке.
 
 Интеграция в OpenWrt — тонкий **LuCI-лаунчер**: мини-дашборд и кнопка «Открыть
 панель», которая по одноразовому токену передаёт браузер в полноценную SPA-панель,
@@ -50,8 +51,10 @@ Go-бинарь `shaterd` вместе с control-plane, DNS-фильтром,
 - **Fail-closed kill-switch**: мёртвая группа → block, а не тихая утечка мимо
   прокси; собственная nft-таблица `inet shater` и свои марки/таблицы, fw4 не
   трогаем.
-- Атомарный apply с валидацией движком и `nft -c`, **commit-confirm** с
-  авто-откатом к последней рабочей конфигурации.
+- Атомарный apply с валидацией движком и `nft -c`. **Commit-confirm** с
+  авто-откатом к последней рабочей конфигурации есть, но **на стоковой установке
+  выключен**: `confirm_timeout` поставляется нулём, и apply не вооружает ничего,
+  пока вы не зададите окно (см. «Включение»).
 - Идемпотентный reconcile из hotplug/boot под flock; management-bypass
   (SSH/LuCI/LAN) всегда в обход.
 
@@ -121,49 +124,25 @@ flowchart TB
 
 Путь трафика: LAN-клиент → `nft tproxy` (mark → tproxy-порт) → tproxy-inbound
 sing-box (сниффинг SNI/Host/QUIC) → маршрут по правилу → outbound/selector/chain
-(проксировано) · direct (flow-offload) · block. Подробные диаграммы (auth-handoff,
-data-plane, DNS-flow, apply-flow) — в [`docs-shater/ARCHITECTURE.md`](docs-shater/ARCHITECTURE.md).
+(проксировано) · direct (обычный маршрут, без туннеля) · block. TPROXY несёт
+только TCP и UDP; ICMP и остальные протоколы — через отдельные опциональные
+механизмы (`l3_tunnel`, `untunnelable_egress`, ARCHITECTURE §3a). Подробные
+диаграммы (auth-handoff, data-plane, DNS-flow, apply-flow) — в
+[`docs-shater/ARCHITECTURE.md`](docs-shater/ARCHITECTURE.md).
 
 ---
 
 ## Установка
 
-shater поставляется двумя подписанными фидами. Выберите по версии OpenWrt на роутере:
-
-- **OpenWrt 24.10** → фид **opkg** (`.ipk`, `Packages.gz`, ключ usign).
-- **OpenWrt / ImmortalWrt / BananaWRT 25.12+** → фид **apk** (`.apk`, `packages.adb`,
-  EC-ключ).
+shater поставляется одним подписанным **apk-фидом** (OpenWrt / ImmortalWrt /
+BananaWRT **25.12+**: `.apk`, индекс `packages.adb`, EC-ключ в `/etc/apk/keys/`).
+Старый opkg-фид (`.ipk`, 24.10) снят — оба наших роутера на 25.12 с apk-tools 3,
+бинаря `opkg` там просто нет (`docs-shater/DECISIONS.md` D22).
 
 Пакеты ставятся по зависимостям: `shaterd` → `shater-core` → `luci-app-shater`
 (+ опциональный `byedpi`). `shaterd` подтягивается автоматически как зависимость.
 
-### Путь A — фид opkg (OpenWrt 24.10)
-
-```sh
-# 1) доверяем ключу фида — ИМЯ файла обязано равняться отпечатку usign-ключа.
-wget -O /etc/opkg/keys/5ac4b177689cb8e0 \
-  https://git.qomar.pw/omar/shater/releases/download/latest/shater-feed.pub
-
-# 2) добавляем фид (один URL обслуживает все арки).
-echo "src/gz shater https://git.qomar.pw/omar/shater/releases/download/latest" \
-  >> /etc/opkg/customfeeds.conf
-
-# 3) обновляемся и ставим (shaterd подтянется как зависимость).
-opkg update
-opkg install luci-app-shater        # -> shater-core -> shaterd
-opkg install byedpi                 # опционально: ByeDPI desync-egress
-```
-
-Обновление — **только наши пакеты, никогда голый `opkg upgrade`** (без аргументов
-он тянет обновления и на системные пакеты, это классический способ окирпичить
-роутер):
-
-```sh
-opkg update
-opkg upgrade shaterd shater-core luci-app-shater byedpi
-```
-
-### Путь B — фид apk (OpenWrt / ImmortalWrt / BananaWRT 25.12+)
+### Фид apk
 
 `/etc/apk/arch` сам выбирает нужный per-arch релиз (apk-релизы раздельны по арке):
 
@@ -198,13 +177,22 @@ apk upgrade shaterd shater-core luci-app-shater byedpi
 only those packages are upgraded along with needed dependencies»*. Проверить
 установленные версии: `apk list -I shaterd shater-core luci-app-shater byedpi`.
 
+> **Роллинг или фиксация — это выбор URL в `shater.list`.** `apk-latest-<arch>`
+> — движущийся указатель: каждый релизный прогон заменяет его ассеты, поэтому
+> «поставил и забыл»: `apk update` сам видит новую сборку. `apk-vX.Y.Z-<arch>` —
+> фиксация на конкретной сборке: роутер не получит ничего нового, пока
+> `/etc/apk/repositories.d/shater.list` не отредактируют руками — на каждом
+> роутере и на каждый релиз. На `mini_router` сознательно прописан
+> версионированный URL, и ручная правка — его цена. Подробнее —
+> [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md) §5.1.
+
 > Версии пакетов CI берёт из git-тега (`vX.Y.Z` → `X.Y.Z-r1`, сборка вне тега →
 > `X.Y.Z-r<коммитов+1>`), поэтому каждая новая сборка действительно видна
 > менеджеру пакетов как новая. Подробности — `docs-shater/INSTALL.md` §2.1.
 
-> Полные инструкции — раздельная установка из `.ipk`/`.apk` вручную, закрепление
-> версии (`vX.Y.Z` / `apk-vX.Y.Z-<arch>`), совместимость с BananaWRT
-> `25.12-mtk-vendor` — в [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md).
+> Полные инструкции — ручная установка из `.apk`, фиксация версии
+> (`apk-vX.Y.Z-<arch>`), совместимость с BananaWRT `25.12-mtk-vendor` — в
+> [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md).
 
 ### Включение
 
@@ -213,15 +201,32 @@ shater ставится **инертным** (globals выключены), чт
 
 ```sh
 uci set shater.globals.enabled=1
+# Предохранитель: commit-confirm поставляется ВЫКЛЮЧЕННЫМ (confirm_timeout=0),
+# и без этой строки apply ничем не подстрахован. 120 с — окно на проверку связи.
+uci set shater.globals.confirm_timeout=120
 uci commit shater
-shaterd apply        # apply + вооружить commit-confirm на живом демоне
-shaterd confirm      # подтвердить (отменяет авто-откат)
+shaterd apply        # применить и вооружить авто-откат на 120 с
+shaterd confirm      # подтвердить в пределах окна (отменяет авто-откат)
 ```
 
+`shaterd apply` печатает, вооружил ли он что-нибудь, и почему нет: при
+`confirm_timeout=0` он прямо говорит, что автоматического отката НЕТ. Оставить
+ноль — сознательный выбор: тогда apply, отрезавший вам SSH/LuCI, придётся
+откатывать руками.
+
 `/etc/init.d/shater enable && /etc/init.d/shater start` поднимает демона под procd.
 Кнопка «Открыть панель» в LuCI чеканит одноразовый токен и передаёт браузер в
 панель (`:8088` по умолчанию).
 
+После первого же применённого включённого fail-closed конфига появляется
+**загрузочная защита**: `/etc/init.d/shater-armor` (START=21) грузит сохранённый
+fail-closed план ещё до старта демона, закрывая те секунды между поднятием LAN и
+первым apply, когда роутер форвардил трафик в WAN открытым. Форвардинг LAN→WAN
+заблокирован, пока `shaterd` не применит конфиг; SSH, LuCI и панель при этом
+доступны **намеренно** — цепочка вешается только на `forward`. Чем защита
+вооружается, когда отказывается вооружаться и как её снять —
+[`docs-shater/INSTALL.md`](docs-shater/INSTALL.md) §4.
+
 ---
 
 ## Сборка из исходников
@@ -244,6 +249,28 @@ arm64}` с musl-static набором тегов (`CGO_ENABLED=0 GOOS=linux`), s
 (набор build-тегов, почему `shaterd` — prebuilt-пакет, порядок CI) — в
 [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md).
 
+### Проверка
+
+```sh
+bash scripts/run-tests.sh            # полный гейт
+bash scripts/run-tests.sh --no-race  # без -race, для локального цикла
+```
+
+Гейт гоняет весь набор **под теми же build-тегами, с которыми собирается
+роутерный бинарь** (`scripts/router-tags.sh`), на Linux (с не-Linux хоста — сам
+перезапускается в Docker), с `-race`, и содержит три машинные проверки против
+молчаливого скипа: набор тегов может только ДОБАВЛЯТЬ тест-файлы; каждый пакет с
+тестами обязан отчитаться `ok` поимённо; каждый `TestIntegration*` обязан выдать
+вердикт по имени. Причина такая: до 2026-07 релизный тракт не гонял почти ничего
+— 115 тест-файлов из 116 под `shater/**` в CI не исполнялись ни разу.
+
+Отдельно `scripts/check-router-tags.sh` проверяет, что ни одна заявленная в
+`FEATURES.md` фича не потеряла нужный ей build-тег.
+
+Зелёный гейт — необходимое, но не достаточное условие: он не видит стыков с
+ядром, procd и nftables. Это проверяется на стенде (см.
+[`docs-shater/CONTEXT.md`](docs-shater/CONTEXT.md)).
+
 ---
 
 ## Структура репозитория
@@ -258,8 +285,8 @@ arm64}` с musl-static набором тегов (`CGO_ENABLED=0 GOOS=linux`), s
 | `openwrt/` | Пакеты: `shaterd`, `shater-core`, `luci-app-shater`, `byedpi` |
 | `docs-shater/` | Документация продукта (см. таблицу ниже) |
 | `scripts/` | `build-shaterd.sh` — сборка ship-артефакта |
-| `ci/` | Скрипты сборки фидов и релизов (SDK, usign/EC, Gitea API) |
-| `.gitea/workflows/` | `release.yml` — CI: сборка пакетов + подписанные фиды opkg/apk |
+| `ci/` | Скрипты сборки apk-фида и релизов (SDK, EC-подпись, Gitea API) |
+| `.gitea/workflows/` | `release.yml` — CI: сборка пакетов + подписанный apk-фид |
 | `SPECS/` | Конституция форка движка и спеки (Spec Kit) |
 | `docs-lx/` | Справочник конфигурации фич движка (`lx-config.md`, `.ru.md`) |
 | `lx-test/`, `submodules/` | Примеры конфигов движка и submodule AmneziaWG-рантайма |
@@ -273,16 +300,17 @@ arm64}` с musl-static набором тегов (`CGO_ENABLED=0 GOOS=linux`), s
 CI на **Gitea Actions** (`.gitea/workflows/release.yml`) собирает все 4 пакета и
 публикует **подписанные фиды**:
 
-- **opkg (24.10):** один комбинированный релиз, подписан usign-ключом (публичный
-  `dist/shater-feed.pub`, отпечаток `5ac4b177689cb8e0`; секрет — в Gitea-secret
-  `KEY_BUILD`).
-- **apk (25.12+):** параллельная линия, **по релизу на арку**, подписан EC-ключом
-  (`dist/shater-apk.pem`; секрет — `KEY_APK`).
+- **apk (25.12+)** — единственный формат: **по релизу на арку**, индекс
+  `packages.adb` подписан EC-ключом (публичный `dist/shater-apk.pem`; секрет — в
+  Gitea-secret `KEY_APK`).
 
-Триггеры: push тега **`vX.Y.Z`** → версионный релиз; `workflow_dispatch` →
-плавающий `latest`/`apk-latest-<arch>` (всегда свежий фид). Публикация — через
-Gitea API (`ci/gitea-release.sh`). Ключи **никогда не перегенерируются** — это
-инвалидировало бы доверие на всех развёрнутых роутерах.
+Триггеры: push тега **`vX.Y.Z`** → версионный релиз `apk-vX.Y.Z-<arch>`;
+`workflow_dispatch` → только роллинг. Роллинг `apk-latest-<arch>` обновляется
+**на каждом прогоне**, включая теговый, и после публикации проверяется через API:
+в нём обязаны лежать наши три пакета ровно собранной версии и ни одного ассета
+другой версии. Публикация — через Gitea API (`ci/gitea-release.sh`). Ключ
+**никогда не перегенерируется** — это инвалидировало бы доверие на всех
+развёрнутых роутерах.
 
 ---
 
@@ -291,7 +319,10 @@ Gitea API (`ci/gitea-release.sh`). Ключи **никогда не переге
 shater вкомпилирует **форк движка sing-box-lx** — тонкий downstream апстрима
 [SagerNet/sing-box](https://github.com/SagerNet/sing-box), добавляющий набор
 клиентских фич (XHTTP, AmneziaWG 2.0, MASQUE, расширения наблюдаемости) за
-build-тегами и живущий **ребейзом на каждый upstream-тег, а не merge**. Форк
+build-тегами и живущий **ребейзом на каждый upstream-тег, а не merge**. Это набор
+самого форка, а не shater: MASQUE/CONNECT-IP мы намеренно **не регистрируем** —
+`shater/generate` его не порождает, а отказ от него и остального незадействованного
+зоопарка экономит ~6 МБ бинаря и столько же RAM на роутере (`shater/registry`). Форк
 разрабатывается по Spec Kit; неизменяемые принципы — в
 [`SPECS/CONSTITUTION.md`](SPECS/CONSTITUTION.md), справочник фич движка — в
 [`docs-lx/lx-config.ru.md`](docs-lx/lx-config.ru.md).
@@ -307,7 +338,7 @@ build-тегами и живущий **ребейзом на каждый upstre
 | Документ | О чём |
 |----------|-------|
 | [`docs-shater/CONTEXT.md`](docs-shater/CONTEXT.md) | **Начните здесь** — контекст проекта, история v0.1→v0.2, testbed/инфра |
-| [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md) | Сборка ship-артефакта и установка обоих фидов (opkg/apk) |
+| [`docs-shater/INSTALL.md`](docs-shater/INSTALL.md) | Сборка ship-артефакта и установка apk-фида (роллинг/фиксация) |
 | [`docs-shater/ARCHITECTURE.md`](docs-shater/ARCHITECTURE.md) | One-binary дизайн, auth-handoff, data/DNS/apply-потоки (диаграммы) |
 | [`docs-shater/FEATURES.md`](docs-shater/FEATURES.md) | Полный список фич с тегами MVP/T1/T2 |
 | [`docs-shater/ROADMAP.md`](docs-shater/ROADMAP.md) | Фазовый план |

SPECS/007-AWG_OVER_WIREGUARD_DETOUR_GUARD/SPEC.md

@@ -3,7 +3,33 @@
 | Поле | Значение |
 |------|----------|
 | Тип | B (bug) |
-| Статус | C (complete) |
+| Статус | C (complete) — guard **снят** (см. баннер ниже) |
+
+> ## ⛔️ Guard снят (2026-07-26) — первопричина к shater не относится
+> **Оба guard'а (Start-guard в `protocol/wireguard/endpoint.go` и
+> selector-guard в `protocol/group/awg_selector_guard.go`) удалены**, вместе с
+> их adapter-хуками (`OutboundManager.ConsumersOf`, `AmneziaWGSuspendable`).
+> Апстрим снял их коммитом `5fa3a0a17`; сюда снятие приехало отдельно.
+>
+> **Почему.** Зависание было **Android-специфичным** (`Libbox.newService` не
+> возвращал управление). Android для shater не платформа и ей не станет —
+> мы собираем роутерный бинарь под OpenWrt/aarch64. При этом лекарство для
+> самой AWG-за-detour связки у нас уже есть: reserved-clear gate в
+> `ClientBind` (`d971eb85e` + пин сабмодуля `7d15f33`), без которого AWG не
+> поднимался вообще ни за каким detour'ом. Мы носили и лекарство, и запрет
+> на его применение.
+>
+> **Чем это было плохо на практике.** Guard отказывал **молча**: не ошибкой,
+> а `started=false`, после чего каждый дозвон падал с «WireGuard is not ready
+> yet». Конфигурация «AmneziaWG за WireGuard-хопом» выглядела не как
+> отклонённая, а как «нода почему-то не работает».
+>
+> **Регрессия:** `protocol/wireguard/awg_over_wireguard_start_lx_test.go`
+> (`with_gvisor && with_awg`) — AWG-эндпоинт с `detour` на outbound типа
+> `wireguard` доходит до PostStart и поднимает `started`. До снятия guard'а
+> тест краснел.
+>
+> **Осталось:** сквозной прогон на железе (AWG поверх реального WG-хопа).
 
 Отклонять (по образцу ядрового запрета «empty direct detour») конфигурацию, где
 AmneziaWG-endpoint (источник с AWG-полями) имеет `detour` на **любой

adapter/judgeflow_icmp_lx_test.go

@@ -0,0 +1,145 @@
+// lx:begin l3-honest-drop
+package adapter
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/sagernet/sing-tun"
+	"github.com/sagernet/sing-tun/gtcpip/header"
+
+	"github.com/stretchr/testify/require"
+)
+
+// judgeFlowRouter answers PreMatch with a canned verdict; JudgeFlow reads
+// nothing else off the Router.
+type judgeFlowRouter struct {
+	Router
+	result PreMatchResult
+}
+
+func (r *judgeFlowRouter) PreMatch(InboundContext, []byte) PreMatchResult { return r.result }
+
+// judgeFlowPort is the tun.Port half of a FlowOutbound. inet4 is what
+// PortAddresses reports for IPv4 — the one field the two ICMP consumers in
+// sing-tun disagree about (see the comment on
+// TestJudgeFlowICMPToBoundPortStaysAFlow).
+type judgeFlowPort struct {
+	Outbound
+	inet4 netip.Addr
+}
+
+func (o *judgeFlowPort) Tag() string  { return "wg-out" }
+func (o *judgeFlowPort) Type() string { return "wireguard" }
+func (o *judgeFlowPort) PortAddresses() (netip.Addr, netip.Addr) {
+	return o.inet4, netip.Addr{}
+}
+func (o *judgeFlowPort) PortMTU() uint32                     { return 1420 }
+func (o *judgeFlowPort) AttachReturn(tun.Return) error       { return nil }
+func (o *judgeFlowPort) DetachReturn(tun.Return) error       { return nil }
+func (o *judgeFlowPort) WritePackets(packets [][]byte) error { return nil }
+
+// judgeFlowNonPort is a FlowOutbound-shaped result that is NOT a tun.Port — the
+// interface drift the second line of defense in JudgeFlow exists for.
+type judgeFlowNonPort struct {
+	Outbound
+}
+
+func (o *judgeFlowNonPort) Tag() string  { return "drifted" }
+func (o *judgeFlowNonPort) Type() string { return "drifted" }
+
+func judgeFlow(t *testing.T, protocol uint8, result PreMatchResult) tun.FlowVerdict {
+	t.Helper()
+	return JudgeFlow(
+		&judgeFlowRouter{result: result},
+		"l3-in", "tun", protocol,
+		netip.MustParseAddrPort("192.168.1.2:1234"),
+		netip.MustParseAddrPort("1.1.1.1:1234"),
+		nil,
+	)
+}
+
+const (
+	judgeFlowICMP = uint8(header.ICMPv4ProtocolNumber)
+	judgeFlowTCP  = uint8(header.TCPProtocolNumber)
+)
+
+// TestJudgeFlowICMPToBoundPortStaysAFlow is the guard on the ONE fix that must
+// not be made here.
+//
+// sing-tun has two ICMP consumers with different requirements on the port:
+//
+//   - ForwardDispatcher.createFlow (flow_dispatch.go) needs only a VALID port
+//     address — it NATs the echo identifier and rewrites the source to that
+//     address. This is the path every unfragmented LAN ping takes, and it is
+//     what makes ping-through-WireGuard/AWG work at all.
+//   - ICMPForwarder.installFlow (stack_gvisor_icmp.go) additionally requires the
+//     address to be UNSPECIFIED, because it writes the packet to the port
+//     unmodified. A WireGuard endpoint reports its concrete interface address
+//     (transport/wireguard/port.go), so installFlow declines and HandlePacket
+//     falls through to forging the echo reply.
+//
+// The tempting fix — "for ICMP, refuse ActionFlow when PortAddresses() is not
+// unspecified, so the verdict becomes a drop and the forgery is unreachable" —
+// is applied HERE, in the one function both consumers share, with byte-identical
+// arguments from either. It would therefore kill the working path too: every
+// ping through WireGuard/AWG, fragmented or not, would drop, and l3_tunnel would
+// carry nothing but `direct`. Keep this test failing loudly if anyone tries.
+func TestJudgeFlowICMPToBoundPortStaysAFlow(t *testing.T) {
+	t.Parallel()
+	port := &judgeFlowPort{inet4: netip.MustParseAddr("10.2.0.2")}
+	verdict := judgeFlow(t, judgeFlowICMP, PreMatchResult{Action: PreMatchFlow, Outbound: port})
+	require.Equal(t, tun.ActionFlow, verdict.Action,
+		"ICMP to a WireGuard/AWG endpoint must stay a flow: the forward dispatcher NATs it by echo identifier and this is the whole point of l3_tunnel")
+	require.Same(t, tun.Port(port), verdict.Port)
+}
+
+// The `direct` shape: an unspecified port address. Both consumers accept it.
+func TestJudgeFlowICMPToUnspecifiedPortStaysAFlow(t *testing.T) {
+	t.Parallel()
+	port := &judgeFlowPort{inet4: netip.IPv4Unspecified()}
+	verdict := judgeFlow(t, judgeFlowICMP, PreMatchResult{Action: PreMatchFlow, Outbound: port})
+	require.Equal(t, tun.ActionFlow, verdict.Action)
+	require.Same(t, tun.Port(port), verdict.Port)
+}
+
+// PreMatchDrop is the honest verdict and must arrive as ActionDrop: it is the
+// only value (besides Reject) that stops ICMPForwarder.HandlePacket before the
+// Echo -> EchoReply rewrite.
+func TestJudgeFlowICMPDropReachesTheStackAsDrop(t *testing.T) {
+	t.Parallel()
+	verdict := judgeFlow(t, judgeFlowICMP, PreMatchResult{Action: PreMatchDrop})
+	require.Equal(t, tun.ActionDrop, verdict.Action)
+}
+
+// The second line of defense: a PreMatchFlow whose outbound is not a tun.Port
+// must not degrade ICMP to ActionAccept, because Accept is the forged reply.
+func TestJudgeFlowICMPNonPortOutboundDrops(t *testing.T) {
+	t.Parallel()
+	verdict := judgeFlow(t, judgeFlowICMP, PreMatchResult{Action: PreMatchFlow, Outbound: &judgeFlowNonPort{}})
+	require.Equal(t, tun.ActionDrop, verdict.Action,
+		"FlowOutbound and tun.Port are distinct interfaces; a drift between them must not silently re-enable the echo forger")
+}
+
+func TestJudgeFlowTCPNonPortOutboundAccepts(t *testing.T) {
+	t.Parallel()
+	verdict := judgeFlow(t, judgeFlowTCP, PreMatchResult{Action: PreMatchFlow, Outbound: &judgeFlowNonPort{}})
+	require.Equal(t, tun.ActionAccept, verdict.Action,
+		"for TCP, falling back to Accept is upstream behaviour and must stay untouched")
+}
+
+// TCP keeps every mapping it had, including the Continue -> Accept default that
+// is a forgery only for ICMP.
+func TestJudgeFlowTCPContinueStaysAccept(t *testing.T) {
+	t.Parallel()
+	verdict := judgeFlow(t, judgeFlowTCP, PreMatchResult{Action: PreMatchContinue})
+	require.Equal(t, tun.ActionAccept, verdict.Action)
+}
+
+func TestJudgeFlowTCPBypassStaysBypass(t *testing.T) {
+	t.Parallel()
+	verdict := judgeFlow(t, judgeFlowTCP, PreMatchResult{Action: PreMatchBypass})
+	require.Equal(t, tun.ActionBypass, verdict.Action)
+}
+
+// lx:end l3-honest-drop

adapter/outbound.go

@@ -45,30 +45,8 @@ type OutboundManager interface {
 	Default() Outbound
 	Remove(tag string) error
 	Create(ctx context.Context, router Router, logger log.ContextLogger, tag string, outboundType string, options any) error
-	// lx:begin awg
-	// ConsumersOf returns the tags of outbounds that depend on (detour through)
-	// the given tag — the reverse of Dependencies(). Used by the selector guard to
-	// walk up to AmneziaWG consumers when a group switches to a WireGuard member.
-	ConsumersOf(tag string) []string
-	// lx:end awg
 }
 
-// lx:begin awg
-// AmneziaWGSuspendable is implemented by an AmneziaWG endpoint so the selector
-// guard can suspend it (bring its device down) when a group it detours through
-// switches to a WireGuard member — AmneziaWG inside a WireGuard tunnel hangs the
-// kernel on Android. The marker lives in adapter so protocol/group can act on it
-// without importing protocol/wireguard.
-type AmneziaWGSuspendable interface {
-	// IsAmneziaWG reports whether this endpoint runs AmneziaWG (has AWG params).
-	IsAmneziaWG() bool
-	// SuspendAmneziaWG brings the device down so no junk handshake is sent. It is
-	// idempotent and safe to call on a not-yet-started or already-suspended endpoint.
-	SuspendAmneziaWG()
-}
-
-// lx:end awg
-
 // lx:begin idle-suspend
 // IdleSuspendable is implemented by a WG/AWG endpoint so the router's idle tick
 // (SPEC 020) can suspend it when it is idle and unreachable, without importing

adapter/outbound/manager.go

@@ -208,21 +208,6 @@ func (m *Manager) Outbound(tag string) (adapter.Outbound, bool) {
 	return m.endpoint.Get(tag)
 }
 
-// lx:begin awg
-// ConsumersOf returns a copy of the tags that detour through tag (reverse of
-// Dependencies()), built from the dependByTag ledger populated at Create time.
-func (m *Manager) ConsumersOf(tag string) []string {
-	m.access.RLock()
-	defer m.access.RUnlock()
-	consumers := m.dependByTag[tag]
-	if len(consumers) == 0 {
-		return nil
-	}
-	return append([]string(nil), consumers...)
-}
-
-// lx:end awg
-
 func (m *Manager) Default() adapter.Outbound {
 	m.access.RLock()
 	defer m.access.RUnlock()

adapter/router.go

@@ -75,7 +75,18 @@ func JudgeFlow(router Router, inbound string, inboundType string, network uint8,
 	case PreMatchFlow:
 		port, isPort := result.Outbound.(tun.Port)
 		if !isPort {
+			// lx:begin l3-honest-drop
+			// Second line of defense behind route.(*Router).preMatchFlow: a
+			// PreMatchFlow result already implies the outbound is an
+			// adapter.FlowOutbound, but FlowOutbound and tun.Port are distinct
+			// interfaces, and a drift between them must not degrade ICMP to
+			// ActionAccept — the TUN stack would then forge the echo reply
+			// itself instead of admitting the tunnel cannot carry the packet.
+			if networkName == N.NetworkICMP {
+				return tun.FlowVerdict{Action: tun.ActionDrop}
+			}
 			return tun.FlowVerdict{Action: tun.ActionAccept}
+			// lx:end l3-honest-drop
 		}
 		verdict := tun.FlowVerdict{Action: tun.ActionFlow, Port: port, UDPTimeout: result.UDPTimeout, NewTracker: result.NewTracker}
 		if result.Destination.IsValid() {

ci/build-feed-apk.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
-# ci/build-feed-apk.sh — build the signed **apk** feed for ONE arch (the 25.12
-# lane — additive next to ci/build-feed.sh, which stays the opkg/24.10 lane).
+# ci/build-feed-apk.sh — build the signed **apk** feed for ONE arch (25.12+;
+# the only packaging lane shater has — see docs-shater/DECISIONS.md D22).
 #
 # Usage:  ci/build-feed-apk.sh <ARCH> <SDK_URL> <OUTDIR>
 #   e.g.  ci/build-feed-apk.sh aarch64_cortex-a53 \
@@ -10,14 +10,14 @@
 # This is the per-arch entrypoint the Gitea workflow's `build-apk` job calls.
 # It runs on the CI RUNNER and:
 #   1. asserts the prebuilt shaterd binary for this arch was already staged by
-#      scripts/build-shaterd.sh (same artifact-order contract as the opkg lane);
-#   2. drives a plain `debian:bookworm` container (workspace shared via
-#      `--volumes-from`, same trick as ci/build-feed.sh) that downloads the
-#      ImmortalWrt 25.12 apk-SDK tarball and runs ci/sdk-build-apk.sh in it:
-#      compile the 4 packages as .apk, then `apk mkndx --sign` the per-arch
-#      `packages.adb` index. Unlike the usign lane (index signed on the runner),
-#      apk indexing NEEDS the SDK's host `apk` tool, so index+sign happen inside
-#      the container.
+#      scripts/build-shaterd.sh (the artifact-order contract);
+#   2. drives a plain `debian:bookworm` container (the job's workspace volume is
+#      shared into it with `--volumes-from $(hostname)`; a bare `-v $PWD:...`
+#      points at a host path that does not exist under act_runner's DinD) that
+#      downloads the ImmortalWrt 25.12 apk-SDK tarball and runs
+#      ci/sdk-build-apk.sh in it: compile the 4 packages as .apk, then
+#      `apk mkndx --sign` the per-arch `packages.adb` index. Indexing NEEDS the
+#      SDK's host `apk` tool, so index+sign happen inside the container.
 #
 # Why the ImmortalWrt SDK (not openwrt/sdk images): the 25.12 fleet runs
 # BananaWRT 25.12-mtk-vendor = ImmortalWrt 25.12 base (target mediatek/filogic,
@@ -25,9 +25,9 @@
 # mediatek-filogic 25.12 tag — hence the official SDK tarball.
 #
 # Env:
-#   KEY_APK   EC (prime256v1) PRIVATE key PEM (Gitea repo secret — the apk analog
-#             of KEY_BUILD). If set, packages.adb carries an embedded signature
-#             verifiable by dist/shater-apk.pem (routers: /etc/apk/keys/).
+#   KEY_APK   EC (prime256v1) PRIVATE key PEM (Gitea repo secret). If set,
+#             packages.adb carries an embedded signature verifiable by
+#             dist/shater-apk.pem (routers: /etc/apk/keys/).
 #             If unset, an UNSIGNED index is produced (warning; not shippable —
 #             apk signatures are effectively mandatory).
 set -eu
@@ -56,10 +56,9 @@ fi
 chmod +x "$REPO"/ci/*.sh 2>/dev/null || true
 
 # --- 0.4) package version from the git tag ------------------------------------
-# Same contract as the opkg lane (ci/build-feed.sh): the workflow puts these in
-# the job env via `ci/version.sh --env >> $GITHUB_ENV`; recompute here when run
-# standalone. Passed into the container below and re-exported to the
-# unprivileged build user in ci/sdk-build-apk.sh.
+# The workflow puts these in the job env via `ci/version.sh --env >>
+# $GITHUB_ENV`; recompute here when run standalone. Passed into the container
+# below and re-exported to the unprivileged build user in ci/sdk-build-apk.sh.
 if [ -z "${SHATER_PKG_VERSION:-}" ] || [ -z "${SHATER_PKG_RELEASE:-}" ]; then
   eval "$(sh "$REPO/ci/version.sh" --env)"
 fi
@@ -73,7 +72,7 @@ echo "[apk-feed] package version: ${SHATER_PKG_VERSION}-r${SHATER_PKG_RELEASE}"
 #         SDK; PKG_HASH still verifies every file, so stale = re-downloaded.
 #   apt/  debian:bookworm .deb archives for the host-deps install.
 # The nested container runs the build as an unprivileged user -> must be writable
-# (same reason as the chmod 0777 "$OUT" in ci/build-feed.sh).
+# (same reason as the chmod 0777 "$OUT" above).
 CACHE="$REPO/.cache"
 mkdir -p "$CACHE/sdk" "$CACHE/dl" "$CACHE/apt"
 chmod -R a+rwX "$CACHE/dl" "$CACHE/apt" 2>/dev/null || true
@@ -96,8 +95,8 @@ sh "$REPO/ci/fetch-sdk.sh" "$SDK_URL" "$SDK_TAR"
 
 # --- 1) SDK build + index + sign inside a debian container -------------------
 # `--volumes-from $(hostname)` shares THIS job container's workspace volume into
-# the nested container (see ci/build-feed.sh for why a bare -v does not work on
-# the act_runner DinD setup).
+# the nested container: a bare `-v $PWD:...` points at a host path that does not
+# exist under the act_runner DinD setup.
 echo "[apk-feed] SDK build arch=$ARCH (ImmortalWrt 25.12 apk-SDK)"
 docker pull -q debian:bookworm
 docker run --rm --volumes-from "$(hostname)" \

ci/build-feed.sh

@@ -1,106 +0,0 @@
-#!/bin/sh
-# ci/build-feed.sh — build the signed opkg feed for ONE arch.
-#
-# Usage:  ci/build-feed.sh <ARCH> <SDK_DOCKER_TAG> <OUTDIR>
-#   e.g.  ci/build-feed.sh x86_64             x86_64-24.10.4          out/x86_64
-#         ci/build-feed.sh aarch64_cortex-a53 mediatek-filogic-24.10.4 out/aarch64_cortex-a53
-#
-# This is the reusable per-arch entrypoint the Gitea workflow calls. It runs on
-# the CI RUNNER and:
-#   1. asserts the prebuilt shaterd binary for this arch was already staged by
-#      scripts/build-shaterd.sh (into openwrt/shaterd/files/) — proving artifact
-#      order: SPA+shaterd build BEFORE the SDK package build;
-#   2. drives the arch-matched `openwrt/sdk` docker image to compile all 4
-#      packages (ci/sdk-build.sh) and collect their .ipk into OUTDIR;
-#   3. builds + usign-signs the opkg `Packages` index over OUTDIR
-#      (ci/install-usign.sh + ci/make-index.sh; signs iff $KEY_BUILD is set).
-#
-# Env:
-#   KEY_BUILD   usign SECRET key (Gitea repo secret). If set, the feed index is
-#               signed and verifiable by dist/shater-feed.pub (fp 5ac4b177689cb8e0).
-#               If unset, an UNSIGNED feed is produced (make-index warns).
-set -eu
-
-ARCH="${1:?arch required (x86_64 | aarch64_cortex-a53)}"
-SDK_TAG="${2:?sdk docker tag required (e.g. x86_64-24.10.4)}"
-OUT="${3:?output dir required}"
-
-REPO="$(cd "$(dirname "$0")/.." && pwd)"
-mkdir -p "$OUT"; OUT="$(cd "$OUT" && pwd)"
-# $OUT is created here as ROOT on the runner, but the nested `openwrt/sdk`
-# container runs as the unprivileged `buildbot` (uid 1000) — so it must be able
-# to write the collected .ipk into $OUT. World-writable is set HERE (a chmod
-# from inside the container, as buildbot, cannot fix a root-owned dir).
-chmod 0777 "$OUT"
-
-# --- 0) the prebuilt shaterd binary must already be staged for this arch ------
-case "$ARCH" in
-  x86_64)             sfx=amd64 ;;
-  aarch64_cortex-a53) sfx=arm64 ;;
-  *) echo "[feed] ERROR: unsupported ARCH '$ARCH'"; exit 2 ;;
-esac
-if [ ! -f "$REPO/openwrt/shaterd/files/shaterd-$sfx.upx" ]; then
-  echo "[feed] ERROR: openwrt/shaterd/files/shaterd-$sfx.upx not staged."
-  echo "        Run scripts/build-shaterd.sh BEFORE ci/build-feed.sh." >&2
-  exit 3
-fi
-
-chmod +x "$REPO"/ci/*.sh 2>/dev/null || true
-
-# --- 0.4) package version from the git tag ------------------------------------
-# The workflow normally puts these in the job env (ci/version.sh --env >>
-# $GITHUB_ENV); recompute here when this script is run standalone so a manual
-# `ci/build-feed.sh ...` produces the same versions as CI. They are handed to the
-# SDK container below and read by openwrt/*/Makefile (bug B4 — versions used to
-# be hand-written literals that nobody bumped, so v0.2.2…v0.2.6 all shipped as
-# 0.2.0-r3 and no router could ever see an update).
-if [ -z "${SHATER_PKG_VERSION:-}" ] || [ -z "${SHATER_PKG_RELEASE:-}" ]; then
-  eval "$(sh "$REPO/ci/version.sh" --env)"
-fi
-echo "[feed] package version: ${SHATER_PKG_VERSION}-r${SHATER_PKG_RELEASE}"
-
-# --- 0.5) persistent dl/ (package source tarballs) ----------------------------
-# Workspace dir restored/saved by actions/cache in the workflow and shared into
-# the nested SDK container via --volumes-from; becomes CONFIG_DOWNLOAD_FOLDER
-# there (ci/sdk-build.sh). PKG_HASH still verifies every file, so a stale cache
-# can never produce a wrong build. Must be writable by the container's
-# unprivileged buildbot user (same reason as the $OUT chmod above).
-DL_DIR="$REPO/.cache/dl"
-mkdir -p "$DL_DIR"
-chmod -R a+rwX "$DL_DIR" 2>/dev/null || true
-
-# --- 0.6) persistent feeds/ git checkouts -------------------------------------
-# Workspace dir restored/saved by actions/cache (key: feeds-opkg-<release>) and
-# symlinked over the SDK's feeds/ inside the container (ci/sdk-build.sh), so
-# `scripts/feeds update -a` fetches deltas instead of re-cloning base+packages+
-# luci from scratch (~7 min/run on this runner's slow github.com link).
-# Top-level chmod only: the contents are created by the container's uid-1000
-# build user and restored with the same ownership (tar-as-root preserves it).
-FEEDS_CACHE="$REPO/.cache/feeds/opkg"
-mkdir -p "$FEEDS_CACHE"
-chmod a+rwX "$REPO/.cache" "$REPO/.cache/feeds" "$FEEDS_CACHE" 2>/dev/null || true
-
-# --- 1) SDK package build (4 packages) in the arch-matched SDK image ----------
-# We drive the `openwrt/sdk` docker image directly (not openwrt/gh-action-sdk):
-# on a self-hosted Gitea act_runner the marketplace action fetch can be
-# unavailable, and we need a CLEAN single-feed layout. `--volumes-from
-# $(hostname)` shares THIS job container's workspace volume into the nested SDK
-# container — a bare `-v $PWD:...` points at a host path that does not exist
-# under the act_runner DinD setup. (Requires the job to run inside a container,
-# which Gitea Actions does by default.)
-echo "[feed] SDK build arch=$ARCH image=openwrt/sdk:$SDK_TAG"
-docker pull "openwrt/sdk:$SDK_TAG"
-docker run --rm --volumes-from "$(hostname)" \
-  -e ARCH="$ARCH" -e REPO="$REPO" -e OUT="$OUT" -e DL_DIR="$DL_DIR" \
-  -e FEEDS_CACHE="$FEEDS_CACHE" \
-  -e SHATER_PKG_VERSION="$SHATER_PKG_VERSION" \
-  -e SHATER_PKG_RELEASE="$SHATER_PKG_RELEASE" \
-  "openwrt/sdk:$SDK_TAG" \
-  sh "$REPO/ci/sdk-build.sh"
-
-# --- 2) index + sign the per-arch feed (usign, KEY_BUILD passed through) -------
-sh "$REPO/ci/install-usign.sh"
-KEY_BUILD="${KEY_BUILD:-}" bash "$REPO/ci/make-index.sh" "$OUT"
-
-echo "[feed] done arch=$ARCH -> $OUT"
-ls -l "$OUT"

ci/gen-apk-key.sh

@@ -2,24 +2,21 @@
 # ci/gen-apk-key.sh — generate the Shater **apk** feed signing keypair (25.12 lane).
 #
 # apk (OpenWrt/ImmortalWrt 25.12+) verifies package indexes with EC keys
-# (prime256v1 PEM), NOT usign — the existing usign identity
-# (dist/shater-feed.pub, fp 5ac4b177689cb8e0) keeps signing the opkg/24.10 feed
-# and is NOT touched by this script. This generates a SEPARATE, second identity:
+# (prime256v1 PEM). This is the ONLY feed identity shater has since the opkg
+# lane was removed (D22) — the old usign key is history, not a second lane.
 #
 #   dist/shater-apk.key   EC PRIVATE key.  NEVER commit (dist/ is gitignored).
 #                         Paste its full PEM contents into the Gitea repo secret
-#                         KEY_APK (the apk analog of the usign secret KEY_BUILD).
-#                         Then delete the local file (or keep it in a password
-#                         manager as the offline backup — losing it means every
-#                         deployed router must re-trust a new key).
-#   dist/shater-apk.pem   PUBLIC key. Commit it next to shater-feed.pub:
+#                         KEY_APK. Then delete the local file (or keep it in a
+#                         password manager as the offline backup — losing it
+#                         means every deployed router must re-trust a new key).
+#   dist/shater-apk.pem   PUBLIC key. Commit it:
 #                             git add -f dist/shater-apk.pem
 #                         (-f because /dist/ is gitignored). Routers install it
 #                         as /etc/apk/keys/shater-apk.pem.
 #
 # Run ONCE. Refuses to overwrite: regenerating the key invalidates the trust of
-# every router that already installed shater-apk.pem (same rule as D7 for the
-# usign key).
+# every router that already installed shater-apk.pem (see D22).
 set -eu
 
 REPO="$(cd "$(dirname "$0")/.." && pwd)"

ci/install-usign.sh

@@ -1,60 +0,0 @@
-#!/bin/bash
-# Make `usign` available on the CI runner so ci/make-index.sh can sign the opkg
-# feed index. The OpenWrt SDK ships usign, but the index/signing step runs on the
-# bare runner (outside the SDK container), so we build the tiny standalone tool
-# from source (no libubox — it is intentionally dependency-free so it can
-# bootstrap a build system). No-op if usign is already on PATH.
-#
-# Ported unchanged from Shater v0.1 (ci/install-usign.sh): usign is
-# format-agnostic and the signing story is identical for the v0.2 4-package feed.
-#
-# CI cache: a previously-built binary is reused from $USIGN_CACHE (default:
-# <repo>/.cache/tools — a workspace dir the workflow persists via actions/cache),
-# skipping the apt + cmake + clone + build (~1 min). After a fresh build the
-# binary is copied there so the NEXT run hits the cache. usign is a tiny static
-# helper with no versioned protocol — a stale cached binary cannot mis-sign.
-set -eu
-
-REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-TOOLS="${USIGN_CACHE:-$REPO_ROOT/.cache/tools}"
-
-# place <binary> — install onto PATH (system-wide if we can, else ~/bin)
-place() {
-  local SUDO=""; [ "$(id -u)" = 0 ] || SUDO="sudo"
-  if $SUDO install -m0755 "$1" /usr/local/bin/usign 2>/dev/null; then
-    :
-  else
-    mkdir -p "$HOME/bin"
-    install -m0755 "$1" "$HOME/bin/usign"
-    echo "$HOME/bin" >> "${GITHUB_PATH:-/dev/null}"
-    export PATH="$HOME/bin:$PATH"
-  fi
-}
-
-if command -v usign >/dev/null 2>&1; then
-  echo "[usign] already present: $(command -v usign)"
-  exit 0
-fi
-
-if [ -x "$TOOLS/usign" ]; then
-  place "$TOOLS/usign"
-  echo "[usign] restored from cache: $(command -v usign || echo "$HOME/bin/usign")"
-  exit 0
-fi
-
-SUDO=""; [ "$(id -u)" = 0 ] || SUDO="sudo"
-if ! command -v cmake >/dev/null 2>&1 || ! command -v cc >/dev/null 2>&1; then
-  $SUDO apt-get update -qq
-  $SUDO apt-get install -y -qq cmake gcc git
-fi
-
-tmp="$(mktemp -d)"
-# Canonical source; fall back to the GitHub mirror if git.openwrt.org is flaky.
-git clone --depth 1 https://git.openwrt.org/project/usign.git "$tmp/usign" \
-  || git clone --depth 1 https://github.com/openwrt/usign.git "$tmp/usign"
-( cd "$tmp/usign" && cmake -DCMAKE_BUILD_TYPE=Release . >/dev/null && make >/dev/null )
-
-place "$tmp/usign/usign"
-# seed the cache for the next run (best-effort)
-mkdir -p "$TOOLS" 2>/dev/null && install -m0755 "$tmp/usign/usign" "$TOOLS/usign" 2>/dev/null || true
-echo "[usign] built: $(command -v usign || echo "$HOME/bin/usign")"

ci/make-index.sh

@@ -1,39 +0,0 @@
-#!/bin/bash
-# Build the opkg feed index (Packages + Packages.gz) with SHA256 for a dir of
-# .ipk files, then optionally usign-sign it if $KEY_BUILD (the Gitea repo secret)
-# is set and usign is present. Arg $1 = feed dir.
-#
-# Ported from Shater v0.1 (ci/make-index.sh), unchanged. It is package-count and
-# package-name agnostic: it indexes whatever .ipk are in the dir, so it serves
-# BOTH the per-arch feed built by ci/build-feed.sh AND the combined release feed
-# assembled in the release job (shaterd + byedpi per-arch, shater-core +
-# luci-app-shater = _all). opkg filters by Architecture at install time, so one
-# combined URL serves every device.
-#
-# Feed format: opkg `src/gz` (.ipk + text Packages index, usign signature).
-# OpenWrt 24.10 (our SDK) still uses opkg; apk arrives at 25.12. The committed
-# trust anchor dist/shater-feed.pub is a usign (Ed25519) key, matching this.
-set -euo pipefail
-OUT="${1:?feed dir required}"; cd "$OUT"
-: > Packages
-for ipk in *.ipk; do
-  [ -e "$ipk" ] || continue
-  ctrl=$(tar -xzOf "$ipk" ./control.tar.gz | tar -xzO ./control)
-  sz=$(wc -c < "$ipk"); sha=$(sha256sum "$ipk" | cut -d' ' -f1)
-  printf '%s\n' "$ctrl" | sed '/^[[:space:]]*$/d' >> Packages
-  printf 'Filename: %s\nSize: %s\nSHA256sum: %s\n\n' "$ipk" "$sz" "$sha" >> Packages
-done
-gzip -kf Packages
-
-if [ -n "${KEY_BUILD:-}" ]; then
-  # Signing was requested — a missing/broken signer must FAIL the build, not
-  # silently ship an unsigned feed that routers with check_signature on reject.
-  command -v usign >/dev/null 2>&1 || { echo "[index] ERROR: KEY_BUILD set but usign not found" >&2; exit 1; }
-  umask 077; printf '%s\n' "$KEY_BUILD" > /tmp/usign.sec
-  usign -S -m Packages -s /tmp/usign.sec || { rm -f /tmp/usign.sec; echo "[index] ERROR: usign signing failed" >&2; exit 1; }
-  rm -f /tmp/usign.sec
-  echo "[index] signed -> Packages.sig ($(head -1 Packages.sig))"
-else
-  echo "[index] no KEY_BUILD -> UNSIGNED feed (opkg needs check_signature off, or set the secret)"
-fi
-echo "[index] contents:"; ls -l

ci/sdk-build-apk.sh

@@ -10,7 +10,6 @@
 # the target fleet (BananaWRT 25.12-mtk-vendor = ImmortalWrt 25.12 base, its
 # distfeeds even point at downloads.immortalwrt.org/releases/25.12-SNAPSHOT) is
 # ImmortalWrt — so we extract the official ImmortalWrt SDK tarball ourselves.
-# Same --volumes-from workspace-sharing pattern as ci/sdk-build.sh (opkg lane).
 #
 # The OpenWrt buildsystem refuses to run as root, so the SDK build itself runs
 # as an unprivileged `build` user created here.
@@ -36,8 +35,8 @@ echo "[apk-sdk] package version: ${SHATER_PKG_VERSION:-<unset -> Makefile fallba
 test -f "$REPO/openwrt/shaterd/Makefile" || {
   echo "[apk-sdk] ERROR: feed not mounted ($REPO/openwrt/shaterd/Makefile missing)"; ls -la "$REPO" || true; exit 9; }
 
-# The prebuilt shaterd artifact must already be staged for this arch (same
-# contract as the opkg lane — scripts/build-shaterd.sh runs first).
+# The prebuilt shaterd artifact must already be staged for this arch
+# (artifact-order contract — scripts/build-shaterd.sh runs first).
 case "$ARCH" in
   x86_64)             sfx=amd64 ;;
   aarch64_cortex-a53) sfx=arm64 ;;
@@ -113,7 +112,7 @@ export HOME=/home/build
 cd "$SDKDIR"
 
 # Register this repo's openwrt/ as a src-link feed named `shater` (absolute
-# path required) — identical to the opkg lane (ci/sdk-build.sh).
+# path required).
 cp -f feeds.conf.default feeds.conf
 grep -q '^src-link shater ' feeds.conf || echo "src-link shater $REPO/openwrt" >> feeds.conf
 

ci/sdk-build.sh

@@ -1,143 +0,0 @@
-#!/bin/sh
-# Runs INSIDE an `openwrt/sdk:<target>-<ver>` container (CWD = SDK root
-# /builder). The job's workspace is shared into this container via
-# `docker run --volumes-from`, so the repo is visible at $REPO and output goes
-# to $OUT (a dir under the repo, hence also visible to the runner afterwards).
-#
-# Unlike Shater v0.1 (which compiled ONLY xrayctl in the SDK and hand-packed the
-# pure-data packages with tar), v0.2 builds ALL FOUR packages the canonical way,
-# via the SDK feed + `make package/<p>/compile`:
-#
-#   shaterd          prebuilt binary — Build/Compile only VALIDATES that
-#                    openwrt/shaterd/files/shaterd-<amd64|arm64>.upx was staged
-#                    by scripts/build-shaterd.sh on the runner BEFORE this ran.
-#                    (arch-specific .ipk: RSTRIP/STRIP disabled — packed ELF.)
-#   shater-core      PKGARCH=all data glue (procd init, sysctl, uci-defaults).
-#   luci-app-shater  PKGARCH=all LuCI thin launcher — its Makefile does
-#                    `include $(TOPDIR)/feeds/luci/luci.mk`, so the `luci` feed
-#                    MUST be updated first (that is what creates feeds/luci/luci.mk).
-#   byedpi           arch-specific C — the SDK cross-compiles ciadpi from the
-#                    upstream tarball (needs network for PKG_SOURCE_URL).
-#
-# Env (required): ARCH, REPO, OUT.
-set -eu
-ARCH="${ARCH:?ARCH env required}"
-REPO="${REPO:?REPO env required}"
-OUT="${OUT:?OUT env required}"
-mkdir -p "$OUT"
-
-echo "[sdk] arch=$ARCH repo=$REPO out=$OUT"
-# Package version, derived from the git tag by ci/version.sh and handed in by
-# ci/build-feed.sh. openwrt/{shaterd,shater-core,luci-app-shater}/Makefile read
-# these straight out of the environment ($(if $(SHATER_PKG_VERSION),...)); make
-# imports every environment variable as a variable, and it propagates through
-# `make package/<p>/compile`, the metadata dump and the sub-makes alike.
-# byedpi deliberately keeps its own upstream version (see its Makefile).
-echo "[sdk] package version: ${SHATER_PKG_VERSION:-<unset -> Makefile fallback>}-r${SHATER_PKG_RELEASE:-?}"
-test -f "$REPO/openwrt/shaterd/Makefile" || {
-  echo "[sdk] ERROR: feed not mounted ($REPO/openwrt/shaterd/Makefile missing)"; ls -la "$REPO" || true; exit 9; }
-
-# The prebuilt shaterd artifact must already be staged for this arch.
-case "$ARCH" in
-  x86_64)             sfx=amd64 ;;
-  aarch64_cortex-a53) sfx=arm64 ;;
-  *) echo "[sdk] ERROR: unsupported ARCH '$ARCH'"; exit 2 ;;
-esac
-test -f "$REPO/openwrt/shaterd/files/shaterd-$sfx.upx" || {
-  echo "[sdk] ERROR: openwrt/shaterd/files/shaterd-$sfx.upx not staged."
-  echo "        scripts/build-shaterd.sh must run on the runner before the SDK build."; exit 3; }
-
-# --- register this repo's openwrt/ as a src-link feed named `shater` ---------
-# src-link REQUIRES an absolute path; $REPO/openwrt is exactly a feed root (it
-# contains the 4 package dirs and nothing else that looks like a package).
-cp -f feeds.conf.default feeds.conf
-grep -q '^src-link shater ' feeds.conf || echo "src-link shater $REPO/openwrt" >> feeds.conf
-
-# Update metadata for ALL feeds: our `shater` feed + the SDK defaults (base,
-# luci, packages, routing, telephony). We need `luci` for feeds/luci/luci.mk and
-# `base`/`packages` for the runtime deps (kmod-nft-tproxy, kmod-nft-socket,
-# ip-full, rpcd, luci-base) to resolve.
-#
-# Persistent feeds checkouts: $FEEDS_CACHE (a workspace dir the runner restores
-# via actions/cache, shared into this container via --volumes-from) replaces
-# the SDK's ephemeral feeds/ dir, so `feeds update` git-fetches deltas instead
-# of re-cloning base+packages+luci every run (~7 min on the runner's slow
-# github.com link). Correctness-safe: update always checks out feeds.conf's
-# pinned revisions; if it ever fails on a cached checkout (e.g. a force-pushed
-# upstream), the cache is wiped and the update retried with fresh clones.
-if [ -n "${FEEDS_CACHE:-}" ] && mkdir -p "$FEEDS_CACHE" 2>/dev/null; then
-  rm -rf feeds
-  ln -s "$FEEDS_CACHE" feeds
-  echo "[sdk] feeds/ -> $FEEDS_CACHE (persistent cache)"
-fi
-echo "[sdk] feeds update -a"
-if ! ./scripts/feeds update -a; then
-  [ -L feeds ] || { echo "[sdk] ERROR: feeds update failed"; exit 8; }
-  echo "[sdk] WARNING: feeds update failed on cached checkouts — wiping cache, cloning fresh"
-  find "$FEEDS_CACHE" -mindepth 1 -maxdepth 1 -exec rm -rf {} + 2>/dev/null || true
-  ./scripts/feeds update -a
-fi
-
-echo "[sdk] feeds install (prefer shater feed)"
-./scripts/feeds install -p shater shaterd shater-core byedpi luci-app-shater
-
-# Select our packages, then defconfig. `make package/<p>/compile` builds the
-# explicit target regardless, but selecting first makes deps visible to defconfig.
-for p in shaterd shater-core byedpi luci-app-shater; do
-  echo "CONFIG_PACKAGE_$p=m" >> .config
-done
-# Route source downloads through OpenWrt's fast CDN mirror FIRST — sourceware.org
-# (elfutils) and other upstreams intermittently stall mid-transfer, and curl's
-# --connect-timeout doesn't cover a stalled stream, so the SDK download hangs the
-# build. LOCALMIRROR is tried before each package's own PKG_SOURCE_URL. (lx CI)
-echo 'CONFIG_LOCALMIRROR="https://sources.cdn.openwrt.org"' >> .config
-# Persistent dl/ across runs: $DL_DIR is a workspace dir the runner restores via
-# actions/cache (see ci/build-feed.sh). Correctness-safe: the buildroot verifies
-# PKG_HASH on every file already in dl/ and re-downloads on mismatch, so a stale
-# cache can never leak a wrong source into the build.
-if [ -n "${DL_DIR:-}" ]; then
-  echo "CONFIG_DOWNLOAD_FOLDER=\"$DL_DIR\"" >> .config
-fi
-echo "[sdk] defconfig"
-make defconfig >/dev/null
-
-# --- compile the 4 packages --------------------------------------------------
-for p in shaterd shater-core byedpi luci-app-shater; do
-  echo "[sdk] === build $p ==="
-  make "package/$p/compile" V=s -j"$(nproc)"
-done
-
-# --- collect ONLY our 4 packages' .ipk (per-arch shaterd/byedpi + _all core/luci)
-# NOT `find bin -name '*.ipk'`: the openwrt/sdk image ships HUNDREDS of prebuilt
-# kmod/base .ipk under bin/, which a blanket copy would pull into the feed and
-# get signed under OUR key. Match each package's own `<name>_<ver>_<arch>.ipk`.
-found=0
-for p in shaterd shater-core byedpi luci-app-shater; do
-  for ipk in $(find bin -type f -name "${p}_*.ipk"); do
-    cp -f "$ipk" "$OUT/"; found=$((found+1))
-  done
-done
-[ "$found" -ge 4 ] || { echo "[sdk] ERROR: expected >=4 of OUR .ipk, collected $found"; echo "[sdk] (all .ipk under bin/:)"; find bin -type f -name '*.ipk' | head -20; exit 4; }
-
-# --- assert the tag-derived version actually reached the packages -------------
-# The whole point of B4 is that a WRONG-but-plausible version ships silently. The
-# env -> make hand-off has several layers (docker -e, make's env import, the
-# metadata dump), so verify the result instead of trusting it: every one of our
-# three tag-versioned packages must be named `<name>_<ver>-r<rel>_<arch>.ipk`.
-# byedpi is excluded on purpose — it keeps upstream ByeDPI's own version.
-if [ -n "${SHATER_PKG_VERSION:-}" ] && [ -n "${SHATER_PKG_RELEASE:-}" ]; then
-  want="${SHATER_PKG_VERSION}-r${SHATER_PKG_RELEASE}"
-  for p in shaterd shater-core luci-app-shater; do
-    ls "$OUT/${p}_${want}_"*.ipk >/dev/null 2>&1 || {
-      echo "[sdk] ERROR: $p was not built as version '$want'."
-      echo "        SHATER_PKG_VERSION/SHATER_PKG_RELEASE did not reach the package"
-      echo "        Makefile — the build would have shipped a stale version (bug B4)."
-      echo "[sdk] collected:"; ls -1 "$OUT" | sed 's/^/          /'
-      exit 12; }
-  done
-  echo "[sdk] version check OK — our 3 packages are $want"
-fi
-
-chmod -R a+rwX "$OUT" 2>/dev/null || true
-echo "[sdk] OK arch=$ARCH — collected $found of our .ipk:"
-ls -l "$OUT"

ci/version.sh

@@ -6,9 +6,9 @@
 # PKG_VERSION/PKG_RELEASE used to be hand-written literals in the four package
 # Makefiles, and nobody remembered to bump them: v0.2.2 … v0.2.6 all shipped as
 # `shaterd 0.2.0-r3` with DIFFERENT binaries inside (v0.2.6's ELF is 5 491 616 B
-# vs r2's 5 488 336 B). Since both opkg and apk offer an upgrade only when the
-# feed's version string differs from the installed one, `apk update` saw nothing
-# new and the routers could not be updated through the normal path at all.
+# vs r2's 5 488 336 B). Since apk offers an upgrade only when the feed's version
+# string differs from the installed one, `apk update` saw nothing new and the
+# routers could not be updated through the normal path at all.
 #
 # So the version is now DERIVED, in CI, from the git tag, and the package
 # Makefiles only carry a fallback for manual/offline builds.
@@ -21,14 +21,12 @@
 #    rolling `latest`)
 #   no tag / no git at all   -> PKG_VERSION=0.0.0   PKG_RELEASE=1  (+ warning)
 #
-# Both managers compare `<upstream>-r<rel>` the same way: the dotted upstream
-# part first (numerically, component by component), the `r<rel>` only as a
-# tie-break. Verified against the real tools, not from memory:
-#   apk-tools 3.0.3 (`apk version -t`) and apk-tools 2.14.6:
+# apk compares `<upstream>-r<rel>` as: the dotted upstream part first
+# (numerically, component by component), the `r<rel>` only as a tie-break.
+# Verified against the real tool, not from memory —
+# apk-tools 3.0.3 (`apk version -t`) and apk-tools 2.14.6:
 #       0.2.6-r1  > 0.2.0-r3      0.2.6-r12 > 0.2.6-r1
 #       0.2.7-r1  > 0.2.6-r12     0.0.0-r1  < 0.2.0-r3
-#   opkg 38eccbb1 from openwrt/rootfs:x86-64-24.10.4 (`opkg compare-versions`):
-#       identical results (opkg implements the Debian algorithm).
 # That is exactly the ordering this scheme needs:
 #   * a release always outranks every rolling build that preceded it
 #     (0.2.7-r1 > 0.2.6-rN for any N — the dotted part decides), and

common/dialer/udp_fragment_df_darwin_lx_test.go

@@ -0,0 +1,35 @@
+//go:build darwin
+
+package dialer
+
+import (
+	"syscall"
+	"testing"
+
+	"golang.org/x/sys/unix"
+)
+
+// udpSocketDFSet reports whether the socket has "don't fragment" forced on
+// (control.DisableUDPFragment sets IP_DONTFRAG=1 on darwin).
+func udpSocketDFSet(t *testing.T, sysConn syscall.Conn) bool {
+	t.Helper()
+	rawConn, err := sysConn.SyscallConn()
+	if err != nil {
+		t.Fatal(err)
+	}
+	var (
+		value   int
+		sockErr error
+		ctrlErr error
+	)
+	ctrlErr = rawConn.Control(func(fd uintptr) {
+		value, sockErr = unix.GetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_DONTFRAG)
+	})
+	if ctrlErr != nil {
+		t.Fatal(ctrlErr)
+	}
+	if sockErr != nil {
+		t.Fatal(sockErr)
+	}
+	return value != 0
+}

common/dialer/udp_fragment_df_linux_lx_test.go

@@ -0,0 +1,36 @@
+//go:build linux
+
+package dialer
+
+import (
+	"syscall"
+	"testing"
+
+	"golang.org/x/sys/unix"
+)
+
+// udpSocketDFSet reports whether the socket has "don't fragment" forced on
+// (control.DisableUDPFragment sets IP_MTU_DISCOVER=IP_PMTUDISC_DO on linux,
+// the same flag the user-visible failure was traced to on android).
+func udpSocketDFSet(t *testing.T, sysConn syscall.Conn) bool {
+	t.Helper()
+	rawConn, err := sysConn.SyscallConn()
+	if err != nil {
+		t.Fatal(err)
+	}
+	var (
+		value   int
+		sockErr error
+		ctrlErr error
+	)
+	ctrlErr = rawConn.Control(func(fd uintptr) {
+		value, sockErr = unix.GetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_MTU_DISCOVER)
+	})
+	if ctrlErr != nil {
+		t.Fatal(ctrlErr)
+	}
+	if sockErr != nil {
+		t.Fatal(sockErr)
+	}
+	return value == unix.IP_PMTUDISC_DO
+}

common/dialer/udp_fragment_df_other_lx_test.go

@@ -0,0 +1,14 @@
+//go:build !darwin && !linux && !windows
+
+package dialer
+
+import (
+	"syscall"
+	"testing"
+)
+
+func udpSocketDFSet(t *testing.T, _ syscall.Conn) bool {
+	t.Helper()
+	t.Skip("DF socket-flag introspection implemented for darwin, linux and windows only")
+	return false
+}

common/dialer/udp_fragment_df_windows_lx_test.go

@@ -0,0 +1,43 @@
+//go:build windows
+
+package dialer
+
+import (
+	"syscall"
+	"testing"
+
+	"golang.org/x/sys/windows"
+)
+
+// IP_MTU_DISCOVER on windows (ws2ipdef.h); control.DisableUDPFragment sets it to
+// IP_PMTUDISC_DO, the same "don't fragment" state the linux helper checks.
+const (
+	windowsIPMTUDiscover = 71
+	windowsPMTUDiscDo    = 1
+)
+
+// udpSocketDFSet reports whether the socket has "don't fragment" forced on.
+// shater addition: upstream ships linux + darwin only, so the whole suite
+// skipped on the dev host — where it is the one platform we can actually run it
+// on before the router build.
+func udpSocketDFSet(t *testing.T, sysConn syscall.Conn) bool {
+	t.Helper()
+	rawConn, err := sysConn.SyscallConn()
+	if err != nil {
+		t.Fatal(err)
+	}
+	var (
+		value   int
+		sockErr error
+	)
+	ctrlErr := rawConn.Control(func(fd uintptr) {
+		value, sockErr = windows.GetsockoptInt(windows.Handle(fd), windows.IPPROTO_IP, windowsIPMTUDiscover)
+	})
+	if ctrlErr != nil {
+		t.Fatal(ctrlErr)
+	}
+	if sockErr != nil {
+		t.Skip("IP_MTU_DISCOVER is not readable on this host: ", sockErr)
+	}
+	return value == windowsPMTUDiscDo
+}

common/dialer/udp_fragment_lx_test.go

@@ -0,0 +1,99 @@
+// lx: regression tests for the udp_fragment / UDPFragmentDefault
+// plumbing. The WireGuard endpoint (and MASQUE outbound) rely on
+// UDPFragmentDefault=true reaching the real UDP socket as "DF clear": with DF
+// set, an outer datagram larger than the path MTU is silently dropped instead
+// of fragmented, which blackholes nested tunnels (AWG-over-AWG, MASQUE-over-AWG)
+// and AWG s4 transport junk. These tests assert the socket flag itself, on both
+// paths a WireGuard bind can take: the dialer (ClientBind, detour case) and the
+// listener control (StdNetBind via WireGuardControl, no-detour case).
+package dialer
+
+import (
+	"context"
+	"net"
+	"syscall"
+	"testing"
+
+	"github.com/sagernet/sing-box/option"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+)
+
+func dialUDPForDF(t *testing.T, options option.DialerOptions) syscall.Conn {
+	t.Helper()
+	d, err := NewDefault(context.Background(), options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	conn, err := d.DialContext(context.Background(), N.NetworkUDP, M.ParseSocksaddr("127.0.0.1:9"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = conn.Close() })
+	sysConn, isSysConn := conn.(syscall.Conn)
+	if !isSysConn {
+		t.Fatalf("dialed UDP conn %T does not expose SyscallConn", conn)
+	}
+	return sysConn
+}
+
+func listenUDPForDF(t *testing.T, options option.DialerOptions) syscall.Conn {
+	t.Helper()
+	d, err := NewDefault(context.Background(), options)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// WireGuardControl() is the listener control conn.StdNetBind installs on the
+	// socket a no-detour WireGuard endpoint sends its outer datagrams from — the
+	// exact socket the DF default decides the fate of.
+	listenConfig := net.ListenConfig{Control: d.WireGuardControl()}
+	packetConn, err := listenConfig.ListenPacket(context.Background(), "udp4", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = packetConn.Close() })
+	sysConn, isSysConn := packetConn.(syscall.Conn)
+	if !isSysConn {
+		t.Fatalf("listened UDP conn %T does not expose SyscallConn", packetConn)
+	}
+	return sysConn
+}
+
+// Upstream default: no UDPFragmentDefault, no udp_fragment → DF is set on both
+// the dial and listener paths. Pins the baseline the endpoint fix opts out of.
+func TestUDPFragmentDFByDefault_LX(t *testing.T) {
+	if !udpSocketDFSet(t, dialUDPForDF(t, option.DialerOptions{})) {
+		t.Fatal("default dialer must set DF on dialed UDP sockets")
+	}
+	if !udpSocketDFSet(t, listenUDPForDF(t, option.DialerOptions{})) {
+		t.Fatal("default dialer must set DF on listener-control UDP sockets")
+	}
+}
+
+// UDPFragmentDefault=true (what the WireGuard endpoint and MASQUE outbound now
+// set) → DF clear on both paths, so oversize outer datagrams fragment instead
+// of vanishing.
+func TestUDPFragmentDefaultClearsDF_LX(t *testing.T) {
+	options := option.DialerOptions{UDPFragmentDefault: true}
+	if udpSocketDFSet(t, dialUDPForDF(t, options)) {
+		t.Fatal("UDPFragmentDefault=true must leave DF clear on dialed UDP sockets")
+	}
+	if udpSocketDFSet(t, listenUDPForDF(t, options)) {
+		t.Fatal("UDPFragmentDefault=true must leave DF clear on listener-control UDP sockets")
+	}
+}
+
+// Explicit user config always wins over the protocol default, in both
+// directions.
+func TestUDPFragmentExplicitOverride_LX(t *testing.T) {
+	fragmentOff := false
+	options := option.DialerOptions{UDPFragment: &fragmentOff, UDPFragmentDefault: true}
+	if !udpSocketDFSet(t, dialUDPForDF(t, options)) {
+		t.Fatal("udp_fragment=false must set DF even when the protocol default allows fragmentation")
+	}
+	fragmentOn := true
+	options = option.DialerOptions{UDPFragment: &fragmentOn}
+	if udpSocketDFSet(t, dialUDPForDF(t, options)) {
+		t.Fatal("udp_fragment=true must leave DF clear even without a protocol default")
+	}
+}

common/httpclient/http3_race_lx_test.go

@@ -0,0 +1,223 @@
+//go:build with_quic
+
+package httpclient
+
+import (
+	"context"
+	stdTLS "crypto/tls"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/sagernet/quic-go"
+	"github.com/sagernet/quic-go/http3"
+	sbTLS "github.com/sagernet/sing-box/common/tls"
+	"github.com/sagernet/sing-box/option"
+	"github.com/sagernet/sing/common/logger"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+)
+
+// raceProbePayload is large enough that it cannot ride along in the response
+// headers: the caller has to read the body off the QUIC stream AFTER
+// roundTripHTTP3Race has returned. That is the whole point of the test.
+const raceProbePayload = 64 * 1024
+
+var _ N.Dialer = (*plainDialer)(nil)
+
+type plainDialer struct{}
+
+func (d *plainDialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	return (&net.Dialer{}).DialContext(ctx, network, destination.String())
+}
+
+func (d *plainDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
+	return net.ListenUDP("udp", nil)
+}
+
+// splitDialer sends the HTTP/3 racer and the HTTP/2 racer to two different
+// listeners, so a test can decide which one of them wins without having to bind
+// a TCP and a UDP socket on the same port number.
+type splitDialer struct {
+	udp M.Socksaddr
+	tcp M.Socksaddr
+}
+
+func (d *splitDialer) DialContext(ctx context.Context, network string, _ M.Socksaddr) (net.Conn, error) {
+	destination := d.tcp
+	if network == N.NetworkUDP {
+		destination = d.udp
+	}
+	return (&net.Dialer{}).DialContext(ctx, network, destination.String())
+}
+
+func (d *splitDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
+	return net.ListenUDP("udp", nil)
+}
+
+func startH3Server(t *testing.T, handler http.Handler) M.Socksaddr {
+	t.Helper()
+	certificate, err := sbTLS.GenerateKeyPair(nil, nil, nil, "localhost")
+	if err != nil {
+		t.Fatal(err)
+	}
+	listener, err := quic.ListenAddrEarly("127.0.0.1:0", &stdTLS.Config{
+		Certificates: []stdTLS.Certificate{*certificate},
+		NextProtos:   []string{http3.NextProtoH3},
+		MinVersion:   stdTLS.VersionTLS13,
+	}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	server := &http3.Server{Handler: handler}
+	go server.ServeListener(listener)
+	t.Cleanup(func() {
+		server.Close()
+		listener.Close()
+	})
+	return M.ParseSocksaddr(listener.Addr().String())
+}
+
+func newRaceProbeTransport(t *testing.T, serverAddr M.Socksaddr) (*http3FallbackTransport, string) {
+	return newRaceProbeTransportWithDialer(t, &plainDialer{}, serverAddr)
+}
+
+func newRaceProbeTransportWithDialer(t *testing.T, dialer N.Dialer, serverAddr M.Socksaddr) (*http3FallbackTransport, string) {
+	t.Helper()
+	baseTLSConfig, err := sbTLS.NewClient(context.Background(), logger.NOP(), "localhost", option.OutboundTLSOptions{
+		Enabled:    true,
+		Insecure:   true,
+		ServerName: "localhost",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	h2Fallback, err := newHTTP2FallbackTransport(dialer, baseTLSConfig, option.HTTP2Options{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	inner, err := newHTTP3FallbackTransport(dialer, baseTLSConfig, h2Fallback, option.QUICOptions{}, 300*time.Millisecond)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { inner.Close() })
+	return inner.(*http3FallbackTransport), "https://" + serverAddr.String() + "/probe"
+}
+
+// TestHTTP3RaceWinnerBodyStaysReadable pins that the response handed back by the
+// HTTP/3 race is a LIVE response: its body must still be readable after
+// roundTripHTTP3Race returns. Cancelling the context the winner was issued on
+// resets its QUIC stream, so a "successful" round trip would hand the caller a
+// response it can never read.
+func TestHTTP3RaceWinnerBodyStaysReadable(t *testing.T) {
+	payload := make([]byte, raceProbePayload)
+	for i := range payload {
+		payload[i] = byte(i)
+	}
+	serverAddr := startH3Server(t, http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		writer.Header().Set("Content-Type", "application/octet-stream")
+		writer.Write(payload)
+	}))
+	transport, url := newRaceProbeTransport(t, serverAddr)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+	defer cancel()
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// No cached HTTP/3 connection yet and a bodyless GET is replayable, so this
+	// takes the racing path.
+	response, err := transport.RoundTrip(request)
+	if err != nil {
+		t.Fatal("round trip: ", err)
+	}
+	defer response.Body.Close()
+	if response.ProtoMajor != 3 {
+		t.Fatalf("expected the HTTP/3 racer to win, got HTTP/%d.%d", response.ProtoMajor, response.ProtoMinor)
+	}
+	body, err := io.ReadAll(response.Body)
+	if err != nil {
+		t.Fatalf("the race winner's body died with the race: %v (read %d of %d bytes)", err, len(body), len(payload))
+	}
+	if len(body) != len(payload) {
+		t.Fatalf("short body: got %d bytes, want %d", len(body), len(payload))
+	}
+}
+
+// TestHTTP3RaceFallbackWinnerBodyStaysReadableAndH3LoserIsCancelled covers the
+// other half of the race: the HTTP/2 fallback wins, so its body must survive the
+// race, and the HTTP/3 racer that lost must be torn down instead of being left
+// to run to completion on the caller's behalf.
+func TestHTTP3RaceFallbackWinnerBodyStaysReadableAndH3LoserIsCancelled(t *testing.T) {
+	payload := make([]byte, raceProbePayload)
+	for i := range payload {
+		payload[i] = byte(i)
+	}
+
+	h3Started := make(chan struct{}, 1)
+	h3Cancelled := make(chan struct{}, 1)
+	// The HTTP/3 handler never answers, so the fallback wins on the timer.
+	h3Addr := startH3Server(t, http.HandlerFunc(func(_ http.ResponseWriter, request *http.Request) {
+		select {
+		case h3Started <- struct{}{}:
+		default:
+		}
+		<-request.Context().Done()
+		select {
+		case h3Cancelled <- struct{}{}:
+		default:
+		}
+	}))
+
+	h2Server := httptest.NewUnstartedServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+		writer.Header().Set("Content-Type", "application/octet-stream")
+		writer.Write(payload)
+	}))
+	h2Server.EnableHTTP2 = true
+	h2Server.StartTLS()
+	t.Cleanup(h2Server.Close)
+
+	transport, _ := newRaceProbeTransportWithDialer(t, &splitDialer{
+		udp: h3Addr,
+		tcp: M.ParseSocksaddr(h2Server.Listener.Addr().String()),
+	}, h3Addr)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+	defer cancel()
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://localhost:443/probe", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	response, err := transport.RoundTrip(request)
+	if err != nil {
+		t.Fatal("round trip: ", err)
+	}
+	if response.ProtoMajor != 2 {
+		t.Fatalf("expected the HTTP/2 fallback to win, got HTTP/%d.%d", response.ProtoMajor, response.ProtoMinor)
+	}
+	body, err := io.ReadAll(response.Body)
+	if err != nil {
+		t.Fatalf("the fallback winner's body died with the race: %v (read %d of %d bytes)", err, len(body), len(payload))
+	}
+	response.Body.Close()
+	if len(body) != len(payload) {
+		t.Fatalf("short body: got %d bytes, want %d", len(body), len(payload))
+	}
+
+	select {
+	case <-h3Started:
+	case <-time.After(5 * time.Second):
+		t.Fatal("the HTTP/3 racer never reached the server, the test proves nothing about cancelling it")
+	}
+	select {
+	case <-h3Cancelled:
+	case <-time.After(5 * time.Second):
+		t.Fatal("the losing HTTP/3 request was left running after the fallback won")
+	}
+}

common/httpclient/http3_transport.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	stdTLS "crypto/tls"
 	"errors"
+	"io"
 	"net/http"
 	"sync"
 	"time"
@@ -168,32 +169,65 @@ func (t *http3FallbackTransport) roundTripHTTP3(request *http.Request) (*http.Re
 	return t.roundTripHTTP3Race(request, authority)
 }
 
+// cancelOnBodyClose releases a racer's context when the caller is done with the
+// response it won. The race cannot release it on the way out: the body is read
+// after RoundTrip returns, and the context the request was issued on is what
+// keeps its stream alive.
+type cancelOnBodyClose struct {
+	io.ReadCloser
+	cancel     context.CancelFunc
+	cancelOnce sync.Once
+}
+
+func (b *cancelOnBodyClose) Close() error {
+	err := b.ReadCloser.Close()
+	b.cancelOnce.Do(b.cancel)
+	return err
+}
+
+func withCancelOnBodyClose(response *http.Response, cancel context.CancelFunc) *http.Response {
+	if response == nil || response.Body == nil {
+		cancel()
+		return response
+	}
+	response.Body = &cancelOnBodyClose{ReadCloser: response.Body, cancel: cancel}
+	return response
+}
+
 func (t *http3FallbackTransport) roundTripHTTP3Race(request *http.Request, authority string) (*http.Response, error) {
-	ctx, cancel := context.WithCancel(request.Context())
-	defer cancel()
 	type result struct {
 		response *http.Response
 		err      error
 		h3       bool
 	}
 	results := make(chan result, 2)
-	startRoundTrip := func(request *http.Request, useH3 bool) {
-		request = request.WithContext(ctx)
-		var (
-			response *http.Response
-			err      error
-		)
-		if useH3 {
-			response, err = t.h3Transport.RoundTrip(request)
-		} else {
-			response, err = t.h2FallbackRoundTrip(request)
-		}
-		results <- result{response: response, err: err, h3: useH3}
+	// Each racer runs on a context of its own. A context shared by both cannot be
+	// cancelled when one of them wins: quic-go and net/http reset the winner's
+	// stream on cancellation, so the caller would be handed a response whose body
+	// stops mid-read with H3_REQUEST_CANCELLED. Only losers are cancelled here;
+	// the winner's cancel travels with its body and fires on Close.
+	startRoundTrip := func(useH3 bool) context.CancelFunc {
+		ctx, cancel := context.WithCancel(request.Context())
+		raceRequest := cloneRequestForRetry(request).WithContext(ctx)
+		go func() {
+			var (
+				response *http.Response
+				err      error
+			)
+			if useH3 {
+				response, err = t.h3Transport.RoundTrip(raceRequest)
+			} else {
+				response, err = t.h2FallbackRoundTrip(raceRequest)
+			}
+			results <- result{response: response, err: err, h3: useH3}
+		}()
+		return cancel
 	}
 	goroutines := 1
 	received := 0
+	var fallbackCancel context.CancelFunc
+	h3Cancel := startRoundTrip(true)
 	drainRemaining := func() {
-		cancel()
 		for range goroutines - received {
 			go func() {
 				loser := <-results
@@ -203,7 +237,6 @@ func (t *http3FallbackTransport) roundTripHTTP3Race(request *http.Request, autho
 			}()
 		}
 	}
-	go startRoundTrip(cloneRequestForRetry(request), true)
 	timer := time.NewTimer(t.fallbackDelay)
 	defer timer.Stop()
 	var (
@@ -215,20 +248,28 @@ func (t *http3FallbackTransport) roundTripHTTP3Race(request *http.Request, autho
 		case <-timer.C:
 			if goroutines == 1 {
 				goroutines++
-				go startRoundTrip(cloneRequestForRetry(request), false)
+				fallbackCancel = startRoundTrip(false)
 			}
 		case raceResult := <-results:
 			received++
 			if raceResult.err == nil {
+				winnerCancel := fallbackCancel
 				if raceResult.h3 {
 					t.clearH3Broken(authority)
+					winnerCancel = h3Cancel
+					if fallbackCancel != nil {
+						fallbackCancel()
+					}
+				} else {
+					h3Cancel()
 				}
 				drainRemaining()
-				return raceResult.response, nil
+				return withCancelOnBodyClose(raceResult.response, winnerCancel), nil
 			}
 			if raceResult.h3 {
 				t.markH3Broken(authority)
 				h3Err = raceResult.err
+				h3Cancel()
 				if goroutines == 1 {
 					goroutines++
 					if !timer.Stop() {
@@ -237,14 +278,21 @@ func (t *http3FallbackTransport) roundTripHTTP3Race(request *http.Request, autho
 						default:
 						}
 					}
-					go startRoundTrip(cloneRequestForRetry(request), false)
+					fallbackCancel = startRoundTrip(false)
 				}
 			} else {
 				fallbackErr = raceResult.err
+				if fallbackCancel != nil {
+					fallbackCancel()
+				}
 			}
 			if received < goroutines {
 				continue
 			}
+			h3Cancel()
+			if fallbackCancel != nil {
+				fallbackCancel()
+			}
 			drainRemaining()
 			switch {
 			case h3Err != nil && fallbackErr != nil:

common/tlsspoof/integration_test.go

@@ -25,6 +25,21 @@ func requireRoot(t *testing.T) {
 	}
 }
 
+// requireTCPDump skips when tcpdump is not installed.
+//
+// The same honesty this package's callers demand of a health reading: a missing
+// INSTRUMENT is "not checked", never "broken". Without it every test in this
+// file fails on `cmd.Start()` — sixteen red results that say nothing about the
+// code and hide any real failure among them — on a machine where the only thing
+// wrong is that a capture tool is absent. requireRoot has always drawn that line
+// for privileges; this draws it for the tool.
+func requireTCPDump(t *testing.T) {
+	t.Helper()
+	if _, err := exec.LookPath("tcpdump"); err != nil {
+		t.Skip("integration test requires tcpdump on PATH; install it to run this suite")
+	}
+}
+
 func tcpdumpObserver(t *testing.T, iface string, port uint16, needle string, do func(), wait time.Duration) bool {
 	t.Helper()
 	return tcpdumpObserverMulti(t, iface, port, []string{needle}, do, wait)[needle]
@@ -36,6 +51,9 @@ func tcpdumpObserver(t *testing.T, iface string, port uint16, needle string, do
 // the wire.
 func tcpdumpObserverMulti(t *testing.T, iface string, port uint16, needles []string, do func(), wait time.Duration) map[string]bool {
 	t.Helper()
+	// Every capture in this file funnels through here, so one guard covers the
+	// whole suite and no future test can forget it.
+	requireTCPDump(t)
 	ctx, cancel := context.WithTimeout(context.Background(), wait)
 	defer cancel()
 	cmd := exec.CommandContext(ctx, "tcpdump", "-i", iface, "-n", "-A", "-l",

common/urltest/board_capacity_lx_test.go

@@ -0,0 +1,141 @@
+// lx:begin health-board
+
+package urltest
+
+import (
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/sagernet/sing-box/adapter"
+)
+
+// captureEvictions swaps the eviction notice sink for the duration of a test and
+// returns a func that reads back everything reported.
+func captureEvictions(t *testing.T) func() []string {
+	t.Helper()
+	var (
+		mu   sync.Mutex
+		msgs []string
+	)
+	orig := boardEvictionLog
+	boardEvictionLog = func(m string) {
+		mu.Lock()
+		msgs = append(msgs, m)
+		mu.Unlock()
+	}
+	t.Cleanup(func() { boardEvictionLog = orig })
+	return func() []string {
+		mu.Lock()
+		defer mu.Unlock()
+		return append([]string(nil), msgs...)
+	}
+}
+
+// TestBoardHoldsAGenerationWithoutEvicting is the "what it holds" half of the
+// bound. A live generation on this box is ~1200 tags (≈380 nodes plus their
+// per-group egress copies and chain hops); the board must carry that — and a
+// second generation's worth of overlap during a subscription rename — with no
+// eviction at all, or the ceiling would be silently degrading real health data.
+func TestBoardHoldsAGenerationWithoutEvicting(t *testing.T) {
+	read := captureEvictions(t)
+	s := NewHistoryStorage()
+
+	const generation = 1200
+	for gen := 0; gen < 2; gen++ {
+		for i := 0; i < generation; i++ {
+			s.StoreURLTestHistory("gen"+strconv.Itoa(gen)+"-node-"+strconv.Itoa(i),
+				&adapter.URLTestHistory{LastOK: time.Now(), Delay: 20})
+		}
+	}
+	if got := s.Evicted(); got != 0 {
+		t.Fatalf("two full generations (%d tags) evicted %d entries; the board must hold them",
+			2*generation, got)
+	}
+	if msgs := read(); len(msgs) != 0 {
+		t.Fatalf("unexpected eviction notices: %v", msgs)
+	}
+	// Everything is still readable.
+	if s.LoadURLTestHistory("gen0-node-0") == nil {
+		t.Fatalf("the first tag of the first generation was lost without an eviction")
+	}
+}
+
+// TestBoardEvictsOldestAndSaysSo is the "what happens when it overflows" half.
+// Overflow must (a) actually bound the map, (b) drop the LEAST RECENTLY MEASURED
+// tags — on this box, exactly the ones no config names any more — and (c) be
+// audible: a silent eviction is a health board quietly forgetting nodes it is
+// still being asked about.
+func TestBoardEvictsOldestAndSaysSo(t *testing.T) {
+	read := captureEvictions(t)
+	s := NewHistoryStorage()
+
+	base := time.Now().Add(-24 * time.Hour)
+	// Stale generation first: measured a day ago, nothing since.
+	const stale = 1500
+	for i := 0; i < stale; i++ {
+		s.StoreURLTestHistory("stale-"+strconv.Itoa(i),
+			&adapter.URLTestHistory{LastOK: base.Add(time.Duration(i) * time.Millisecond), Delay: 30})
+	}
+	if s.Evicted() != 0 {
+		t.Fatalf("evicted before the ceiling was reached")
+	}
+	// Now push past the ceiling with fresh measurements.
+	for i := 0; i <= maxBoardEntries; i++ {
+		s.StoreURLTestHistory("fresh-"+strconv.Itoa(i),
+			&adapter.URLTestHistory{LastOK: time.Now(), Delay: 15})
+	}
+
+	if got := s.Evicted(); got == 0 {
+		t.Fatalf("board grew past %d entries without evicting anything — it is still unbounded", maxBoardEntries)
+	}
+	s.access.RLock()
+	size := len(s.delayHistory)
+	s.access.RUnlock()
+	if size > maxBoardEntries {
+		t.Fatalf("board holds %d entries, above the %d ceiling", size, maxBoardEntries)
+	}
+
+	// The day-old generation is what went, not the fresh one.
+	if s.LoadURLTestHistory("stale-0") != nil {
+		t.Fatalf("the oldest observation survived while newer ones were dropped")
+	}
+	if s.LoadURLTestHistory("fresh-"+strconv.Itoa(maxBoardEntries)) == nil {
+		t.Fatalf("the newest measurement was evicted")
+	}
+
+	msgs := read()
+	if len(msgs) == 0 {
+		t.Fatalf("entries were evicted with no notice — eviction must never be silent")
+	}
+	m := msgs[0]
+	for _, want := range []string{"health board full", "evicted", "re-probed"} {
+		if !strings.Contains(m, want) {
+			t.Fatalf("eviction notice %q does not say %q", m, want)
+		}
+	}
+}
+
+// TestBoardEvictionThroughMarkFailed pins the OTHER write path. MarkFailed is how
+// a dead node is recorded, and a flood of dead renamed nodes is exactly the shape
+// of the leak — so it has to prune too, not just the success path.
+func TestBoardEvictionThroughMarkFailed(t *testing.T) {
+	captureEvictions(t)
+	s := NewHistoryStorage()
+	for i := 0; i <= maxBoardEntries; i++ {
+		s.MarkFailed("dead-" + strconv.Itoa(i))
+	}
+	s.access.RLock()
+	size := len(s.delayHistory)
+	s.access.RUnlock()
+	if size > maxBoardEntries {
+		t.Fatalf("MarkFailed grew the board to %d, above the %d ceiling", size, maxBoardEntries)
+	}
+	if s.Evicted() == 0 {
+		t.Fatalf("MarkFailed never prunes — the failure path is still unbounded")
+	}
+}
+
+// lx:end health-board

common/urltest/board_lx.go

@@ -10,11 +10,128 @@
 package urltest
 
 import (
+	"sort"
+	"strconv"
+	"sync"
 	"time"
 
 	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/log"
 )
 
+// --- board capacity ---------------------------------------------------------
+//
+// The board is the one structure in the daemon whose key space is chosen by
+// somebody else. Its keys are outbound TAGS, and on this box a tag is a node
+// NAME straight out of the subscription — plus the derived per-group egress
+// copies ("group-<g>-m<i>-<node>") and per-chain hop copies the probe planner
+// creates for the same nodes. Providers rename their nodes freely, so a daily
+// subscription refresh introduces a whole new generation of keys, while the
+// store itself is pinned to the ENGINE's context (shater/engine.New) and so
+// outlives every generation and every Apply — by design, so health survives a
+// config change.
+//
+// Nothing ever removed a key. DeleteURLTestHistory exists but no shater path
+// calls it (only daemon/ and clashapi/, which this fork does not run), so the
+// map was strictly append-only for the life of the process — and the process is
+// expected to live for months.
+//
+// The arithmetic: ~380 nodes, and a config with a couple of egress-bound groups
+// plus a handful of chains puts a LIVE generation at roughly 380 base tags +
+// 2x380 group copies + ~100 chain copies ≈ 1200 keys. One new generation per day
+// is ~440k keys a year, at ~200 B per entry (map bucket + a tag string that is
+// routinely 30-50 B with flag emoji, + a 56 B URLTestHistory) ≈ 88 MB of a
+// 512 MB box — spent entirely on nodes that no longer exist.
+const (
+	// maxBoardEntries is the hard ceiling. 4096 is ~3.4 live generations, so the
+	// board comfortably holds the current config plus the overlap while a
+	// subscription refresh swaps names, and still costs under a megabyte. A tighter
+	// bound would start evicting tags the running config actually uses; a looser one
+	// would stop being a bound in any useful sense.
+	maxBoardEntries = 4096
+	// keepBoardEntries is the prune target: drop a quarter at a time so the
+	// O(n log n) selection is amortised over ~1024 inserts instead of running on
+	// every probe once the board is full.
+	keepBoardEntries = 3072
+)
+
+// boardEvictionLog reports an eviction. A package var so tests can capture it;
+// production leaves it writing to the process log, which under procd is the same
+// syslog/logsink stream every other daemon line lands in.
+//
+// Eviction is NEVER silent. It is not free either: an evicted tag reverts to
+// "untested" and its next probe re-measures it, so a board that evicts entries
+// belonging to the LIVE config is a board whose ceiling is too low — and the only
+// way anyone finds that out is this line.
+var boardEvictionLog = func(msg string) { boardLogger().Warn(msg) }
+
+// pruneLocked drops the least-recently-OBSERVED entries when the board exceeds
+// maxBoardEntries. "Least recently observed" is max(LastOK, LastFail): the entry
+// nothing has measured for the longest is, on this box, precisely a tag that no
+// longer exists in any config — a renamed node, a removed group copy, a retired
+// chain hop. Caller holds access.
+func (s *HistoryStorage) pruneLocked() {
+	if len(s.delayHistory) <= maxBoardEntries {
+		return
+	}
+	type kv struct {
+		tag  string
+		seen time.Time
+	}
+	all := make([]kv, 0, len(s.delayHistory))
+	for tag, h := range s.delayHistory {
+		seen := h.LastOK
+		if h.LastFail.After(seen) {
+			seen = h.LastFail
+		}
+		all = append(all, kv{tag, seen})
+	}
+	sort.Slice(all, func(i, j int) bool { return all[i].seen.Before(all[j].seen) })
+	drop := len(all) - keepBoardEntries
+	var oldest time.Time
+	for i := 0; i < drop; i++ {
+		if i == 0 {
+			oldest = all[i].seen
+		}
+		delete(s.delayHistory, all[i].tag)
+	}
+	s.evicted += uint64(drop)
+
+	msg := "urltest: health board full (" + strconv.Itoa(maxBoardEntries) + " tags) — evicted " +
+		strconv.Itoa(drop) + " least-recently-measured entries (" + strconv.FormatUint(s.evicted, 10) +
+		" total since start); they revert to untested and will be re-probed"
+	if !oldest.IsZero() {
+		msg += "; oldest observation was " + time.Since(oldest).Truncate(time.Second).String() + " ago"
+	}
+	boardEvictionLog(msg)
+}
+
+// Evicted reports how many entries the capacity bound has dropped since the store
+// was created. Nonzero means the board reached maxBoardEntries at least once.
+func (s *HistoryStorage) Evicted() uint64 {
+	if s == nil {
+		return 0
+	}
+	s.access.RLock()
+	defer s.access.RUnlock()
+	return s.evicted
+}
+
+// boardLogger is the process-wide fallback logger for eviction notices. The store
+// is built from a plain constructor with no logger in sight (box.New, the daemon,
+// shater/engine all call NewHistoryStorage()), so rather than change that
+// signature everywhere the notice goes to the standard logger — which on the
+// router is the daemon's own stderr, i.e. the same sink logsink owns.
+var (
+	boardLogOnce sync.Once
+	boardLog     log.ContextLogger
+)
+
+func boardLogger() log.ContextLogger {
+	boardLogOnce.Do(func() { boardLog = log.StdLogger() })
+	return boardLog
+}
+
 // HealthVerdict classifies a stored history entry at read time.
 type HealthVerdict int
 
@@ -54,6 +171,7 @@ func (s *HistoryStorage) MarkFailed(tag string) {
 		updated.Delay = previous.Delay
 	}
 	s.delayHistory[tag] = updated
+	s.pruneLocked()
 	s.notifyUpdated()
 	s.access.Unlock()
 }

common/urltest/probegate_lx.go

@@ -0,0 +1,61 @@
+package urltest
+
+// lx: health board §5.C — the reachability half of "should this be probed".
+//
+// # Two different reasons not to probe, and why they cannot be one flag
+//
+// A group's OWN probing schedule is stood down for two unrelated reasons, and
+// conflating them breaks one of the two:
+//
+//   - NOT USED — no enabled routing rule reaches this group, so probing it
+//     measures a path nothing travels. That is a property of the CONFIG, it is
+//     decided once when the config is generated, and it travels in the config
+//     itself (option.URLTestOutboundOptions.SelfCheck). It cannot change while
+//     the box runs, because the rules cannot change while the box runs.
+//
+//   - NOT REACHABLE RIGHT NOW — the group is a hop of a chain and a hop in
+//     FRONT of it is currently dead. Every member of this group dials through
+//     that hop, so every probe would fail inside it: the measurement would be
+//     about the broken hop, and would be recorded against this one. That is a
+//     property of the WORLD, it changes minute by minute, and it must be
+//     re-asked every time rather than baked into the config — a hop that comes
+//     back must resume probing on its own, with no reapply and nobody pressing
+//     anything.
+//
+// ProbeGate is the second one. It is deliberately a QUESTION asked at the
+// moment of probing and never a stored answer: there is no flag to set, so
+// there is no flag to forget to clear.
+//
+// The gate governs the group's own SCHEDULE only — the warm-up sweep and the
+// ticker. An explicit check (a human, an API call) is a deliberate request and
+// is never refused, exactly as with SelfCheck.
+type ProbeGate interface {
+	// ProbeAllowed reports whether the outbound tagged tag may run its own
+	// scheduled probe right now.
+	//
+	// Implementations MUST answer true when they do not know: a gate that
+	// refuses on missing information would silence probing precisely when the
+	// system has the least idea what is going on, and nothing would ever
+	// measure its way out of that. A nil ProbeGate means "no gate" and every
+	// probe proceeds.
+	ProbeAllowed(tag string) bool
+
+	// ProbeWhenIdle reports whether the outbound tagged tag must keep measuring
+	// even when no traffic is passing through it.
+	//
+	// A urltest group normally probes only while it is in use: Touch arms the
+	// ticker on a dial, and the idle timeout stops it again. That is right for a
+	// group whose readings matter only while somebody is dialling it, and wrong
+	// for one the routing config REACHES: a rule that matches rarely — a narrow
+	// domain list, say — is in force the whole time, so the health of its target
+	// is a live question the whole time. Letting it go quiet means the panel
+	// reports "untested" about a rule that is armed, and the first real request
+	// pays a cold probe instead of picking an already-known-good member.
+	//
+	// Unlike ProbeAllowed, the safe answer here is FALSE when nothing is known.
+	// This one ADDS work, and a gate that claimed it on missing information would
+	// keep every group in the process probing forever — not a default anybody
+	// asked for. Absent gate, unknown tag, nothing configured yet: false, and the
+	// idle timeout behaves exactly as it always has.
+	ProbeWhenIdle(tag string) bool
+}

common/urltest/urltest.go

@@ -21,6 +21,10 @@ type HistoryStorage struct {
 	access       sync.RWMutex
 	delayHistory map[string]*adapter.URLTestHistory
 	updateHooks  []*observable.Subscriber[struct{}]
+	// evicted counts entries dropped by the capacity bound (board_lx.go). The map
+	// is keyed by outbound tags chosen by a subscription provider, so it needs a
+	// ceiling; see the comment on maxBoardEntries.
+	evicted uint64
 }
 
 func NewHistoryStorage() *HistoryStorage {
@@ -71,6 +75,11 @@ func (s *HistoryStorage) StoreURLTestHistory(tag string, history *adapter.URLTes
 	}
 	// lx:end health-board
 	s.delayHistory[tag] = history
+	// lx:begin health-board — the map is keyed by provider-chosen tags and the
+	// store outlives every engine generation, so it must bound itself here: no
+	// shater path ever calls DeleteURLTestHistory. See maxBoardEntries.
+	s.pruneLocked()
+	// lx:end health-board
 	s.notifyUpdated()
 	s.access.Unlock()
 }

dist/shater-feed.pub

@@ -1,2 +0,0 @@
-untrusted comment: shater feed signing key
-RWRaxLF3aJy44JbcxSFujtrFFEQ8lIsnTkd1K5TdjIhdlC2c0wa0fv4V

dns/transport/https.go

@@ -10,6 +10,7 @@ import (
 	"net/url"
 	"strconv"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/sagernet/sing-box/adapter"
@@ -171,6 +172,73 @@ func (t *HTTPSTransport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS
 	return response, nil
 }
 
+// requestBuffer owns the pooled buffer that backs one DoH query.
+//
+// Both transports behind HTTPSTransportWrapper write the request body on a
+// goroutine of their own and return from RoundTrip as soon as the response
+// HEADERS arrive: net/http's write loop is still copying out of the body a
+// bufferful at a time (4 KiB of write buffer, or io.Copy's 32 KiB once it hands
+// the body to the connection), and http2's writeRequestBody has read only the
+// first max-frame-size bytes of it. Returning the buffer to the pool at that
+// point handed live memory to the next caller while the query was still going
+// out — everything past that first copy left the router as whatever that caller
+// had written there. A data race, and a memory-disclosure primitive aimed at the
+// resolver. Measured, not reasoned: with the write parked mid-query the bytes on
+// the wire diverge from the bytes we packed at exactly one copy buffer in.
+//
+// Ownership is counted rather than handed over once, because a retry holds two
+// bodies at a time and the two transports order that differently:
+// http.Transport.rewindBody CLOSES the old body before asking GetBody for a
+// new one, while http2's shouldRetryRequest asks GetBody first and closes the
+// old body on a goroutine. exchange keeps a count of its own until RoundTrip
+// returns — the only window in which either can call GetBody — so neither
+// ordering can free the buffer under the other. If a transport ever fails to
+// close a body, the count never reaches zero and the buffer is simply not
+// reused: garbage, not corruption.
+type requestBuffer struct {
+	buffer *buf.Buffer
+	raw    []byte
+	refs   atomic.Int32
+}
+
+func newRequestBuffer(buffer *buf.Buffer, raw []byte) *requestBuffer {
+	holder := &requestBuffer{buffer: buffer, raw: raw}
+	holder.refs.Store(1)
+	return holder
+}
+
+// body hands out a reader over the packed query as one more owner. It refuses
+// once the buffer is back in the pool, so a late caller gets an error instead
+// of a reader over memory that now belongs to somebody else.
+func (b *requestBuffer) body() (*pooledRequestBody, bool) {
+	for {
+		refs := b.refs.Load()
+		if refs < 1 {
+			return nil, false
+		}
+		if b.refs.CompareAndSwap(refs, refs+1) {
+			return &pooledRequestBody{Reader: bytes.NewReader(b.raw), owner: b}, true
+		}
+	}
+}
+
+func (b *requestBuffer) release() {
+	if b.refs.Add(-1) == 0 {
+		b.buffer.Release()
+	}
+}
+
+type pooledRequestBody struct {
+	*bytes.Reader
+	owner    *requestBuffer
+	closeOne sync.Once
+}
+
+func (b *pooledRequestBody) Close() error {
+	b.closeOne.Do(b.owner.release)
+	return nil
+}
+
 func (t *HTTPSTransport) exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg, error) {
 	exMessage := *message
 	exMessage.Id = 0
@@ -181,11 +249,31 @@ func (t *HTTPSTransport) exchange(ctx context.Context, message *mDNS.Msg) (*mDNS
 		requestBuffer.Release()
 		return nil, err
 	}
-	request, err := http.NewRequestWithContext(ctx, http.MethodPost, t.destination.String(), bytes.NewReader(rawMessage))
+	queryBuffer := newRequestBuffer(requestBuffer, rawMessage)
+	// Drops the count exchange holds once RoundTrip is done with the request;
+	// the bodies handed to the transport keep their own until it closes them.
+	defer queryBuffer.release()
+	requestBody, _ := queryBuffer.body() // cannot fail: the count above is ours
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, t.destination.String(), requestBody)
 	if err != nil {
-		requestBuffer.Release()
+		requestBody.Close()
 		return nil, err
 	}
+	// http.NewRequestWithContext infers both only for the body types it knows,
+	// and pooledRequestBody is not one of them. Upstream got them for free from
+	// *bytes.Reader; GetBody is what lets a POST be replayed when a pooled
+	// connection turns out to have been closed under us. Being unknown to
+	// net/http also costs one packet on the HTTP/1.1 leg: isKnownInMemoryReader
+	// no longer recognises the body, so the request headers are flushed before
+	// the query instead of travelling with it.
+	request.ContentLength = int64(len(rawMessage))
+	request.GetBody = func() (io.ReadCloser, error) {
+		retryBody, ok := queryBuffer.body()
+		if !ok {
+			return nil, E.New("DoH request buffer already released")
+		}
+		return retryBody, nil
+	}
 	request.Header = t.headers.Clone()
 	request.Header.Set("Content-Type", MimeType)
 	request.Header.Set("Accept", MimeType)
@@ -193,7 +281,6 @@ func (t *HTTPSTransport) exchange(ctx context.Context, message *mDNS.Msg) (*mDNS
 	currentTransport := t.transport
 	t.transportAccess.Unlock()
 	response, err := currentTransport.RoundTrip(request)
-	requestBuffer.Release()
 	if err != nil {
 		return nil, err
 	}

dns/transport/https_requestbuffer_lx_test.go

@@ -0,0 +1,541 @@
+package transport
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/dns"
+	"github.com/sagernet/sing/common/buf"
+	"github.com/sagernet/sing/common/logger"
+	M "github.com/sagernet/sing/common/metadata"
+
+	mDNS "github.com/miekg/dns"
+	"golang.org/x/net/http2"
+)
+
+// The request body of a DoH query is backed by a POOLED buffer. Neither
+// transport behind HTTPSTransportWrapper is done with that body when RoundTrip
+// returns: net/http hands the request to a write loop of its own and returns as
+// soon as the response HEADERS have been read, and golang.org/x/net/http2 writes
+// the body on the goroutine that runs writeRequest while roundTrip waits on
+// respHeaderRecv. Returning the buffer to the pool at that point hands live
+// memory to the next caller while the query is still being written to the wire,
+// and what goes out is whatever that next caller put there.
+//
+// Both tests below force a window that is normally microseconds wide to stay
+// open, and drain the pool while it is open:
+//
+//   - HTTP/1.1: the client connection stops accepting writes past the request
+//     headers, so net/http's write loop is parked having copied only the first
+//     io.Copy buffer (32 KiB) of the query.
+//   - HTTP/2: the server pins a 1 KiB stream receive window and does not read
+//     the body, so writeRequestBody is parked in awaitFlowControl having copied
+//     only the first max-frame-size bytes of the query.
+//
+// In both, the server sends the response HEADERS first and withholds the
+// response BODY until the pool has been drained, so Exchange has returned from
+// RoundTrip — and released the buffer, on the broken build — while the query is
+// still going out.
+//
+// Both queries are padded past the transport's copy buffer on purpose. Below it
+// the transport lifts the whole query out of the pooled buffer in a single Read
+// that RACES the release rather than provably following it, and a test built on
+// that race would be a coin toss. The ownership defect is the same at every
+// size; only its deterministic proof needs the padding.
+
+const (
+	// Past io.Copy's 32 KiB buffer, which is the granularity net/http moves a
+	// request body at (persistConnWriter.ReadFrom -> io.Copy), and still inside
+	// buf.MaxPooledBufferSize so the buffer really comes from the pool.
+	httpsH1PaddedQuerySize = 40000
+	// Past http2's max frame size, which is how much of the body
+	// writeRequestBody lifts into its scratch buffer per round.
+	httpsH2PaddedQuerySize = 20000
+	// Pinned on the HTTP/2 server so the client cannot write the whole body
+	// before the response headers come back.
+	httpsPinnedStreamWindow = 1024
+	// Pinned too: Go's HTTP/2 server advertises a 1 MiB max frame size by
+	// default, and the client sizes its body-copy buffer from that — with the
+	// default it would slurp a 20 KB query in one Read and the divergence would
+	// be hidden by the copy size rather than absent. 16384 is the protocol
+	// minimum and what real resolvers advertise.
+	httpsPinnedMaxFrameSize = 16384
+	// How many times the HTTP/2 scenario is repeated; see the test.
+	httpsH2Rounds = 8
+	// How long to wait after the response headers before draining the pool, so
+	// that Exchange has certainly returned from RoundTrip.
+	httpsReleaseSettleDelay = 200 * time.Millisecond
+)
+
+// httpsPaddedQuery returns a query and the exact bytes HTTPSTransport.exchange
+// packs for it.
+func httpsPaddedQuery(t *testing.T, padding int) (*mDNS.Msg, []byte) {
+	t.Helper()
+	message := new(mDNS.Msg)
+	message.SetQuestion("example.com.", mDNS.TypeA)
+	opt := new(mDNS.OPT)
+	opt.Hdr.Name = "."
+	opt.Hdr.Rrtype = mDNS.TypeOPT
+	opt.Option = append(opt.Option, &mDNS.EDNS0_PADDING{Padding: make([]byte, padding)})
+	message.Extra = append(message.Extra, opt)
+
+	onWire := *message
+	onWire.Id = 0
+	onWire.Compress = true
+	expected, err := onWire.Pack()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return message, expected
+}
+
+func httpsTestReply(t *testing.T) []byte {
+	t.Helper()
+	query := new(mDNS.Msg)
+	query.SetQuestion("example.com.", mDNS.TypeA)
+	response := new(mDNS.Msg)
+	response.SetReply(query)
+	raw, err := response.Pack()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return raw
+}
+
+// httpsPoisonPool takes buffers of one size class out of the pool and fills them
+// with a pattern no DNS message contains. They are returned, not released: the
+// caller holds them so nothing can hand them back while the check runs.
+func httpsPoisonPool(size int, count int) []*buf.Buffer {
+	poison := make([]*buf.Buffer, 0, count)
+	for range count {
+		buffer := buf.NewSize(size)
+		poison = append(poison, buffer)
+		free := buffer.FreeBytes()
+		for i := range free {
+			free[i] = 0xEE
+		}
+	}
+	return poison
+}
+
+func httpsReleaseAll(buffers []*buf.Buffer) {
+	for _, buffer := range buffers {
+		buffer.Release()
+	}
+}
+
+// httpsRequirePoisonReachesReleasedBuffer is the CONTROL for the tests below. A
+// clean result there means nothing unless this instrument is shown to be able to
+// produce a dirty one: it must be true that a buffer released while its bytes
+// are still referenced comes back out of the pool and gets overwritten. If that
+// stops holding — a different allocator, a pool that zeroes, a size class that
+// is not pooled at all — the tests below would go green on broken code.
+//
+// Retried, because under -race sync.Pool.Put drops one object in four on
+// purpose. That same dice roll is why the checks below are 3-in-4 detectors
+// under -race and certainties without it; it can only make a broken build look
+// clean, never a clean build look broken.
+func httpsRequirePoisonReachesReleasedBuffer(t *testing.T, size int, pattern []byte) {
+	t.Helper()
+	for range 32 {
+		control := buf.NewSize(size)
+		free := control.FreeBytes()
+		if len(free) < len(pattern) {
+			t.Fatalf("control failed: a %d-byte buffer came back %d bytes long", size, len(free))
+		}
+		copy(free, pattern)
+		alias := free[:len(pattern)]
+		control.Release()
+
+		held := httpsPoisonPool(size, 8)
+		poisoned := !bytes.Equal(alias, pattern)
+		httpsReleaseAll(held)
+		if poisoned {
+			return
+		}
+	}
+	t.Fatal("control failed: poisoning the pool never touched a released buffer, so a clean result below would prove nothing")
+}
+
+// httpsTestDialer hands HTTPSTransportWrapper a connection to a local test
+// server, optionally wrapped.
+type httpsTestDialer struct {
+	target string
+	wrap   func(net.Conn) net.Conn
+	access sync.Mutex
+	conns  []net.Conn
+}
+
+func (d *httpsTestDialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	conn, err := (&net.Dialer{}).DialContext(ctx, "tcp", d.target)
+	if err != nil {
+		return nil, err
+	}
+	var wrapped net.Conn = conn
+	if d.wrap != nil {
+		wrapped = d.wrap(conn)
+	}
+	d.access.Lock()
+	d.conns = append(d.conns, conn)
+	d.access.Unlock()
+	return wrapped, nil
+}
+
+func (d *httpsTestDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
+	return nil, os.ErrInvalid
+}
+
+func (d *httpsTestDialer) closeAll() {
+	d.access.Lock()
+	defer d.access.Unlock()
+	for _, conn := range d.conns {
+		conn.Close()
+	}
+}
+
+// httpsGatedConn stops accepting writes once limit bytes have gone out, until
+// the gate is opened. HTTP/1.1 has no flow-control knob to park the writer with,
+// so the connection provides one.
+type httpsGatedConn struct {
+	net.Conn
+	limit   int64
+	written atomic.Int64
+	gate    chan struct{}
+}
+
+func (c *httpsGatedConn) Write(p []byte) (int, error) {
+	if c.written.Load()+int64(len(p)) > c.limit {
+		select {
+		case <-c.gate:
+		case <-time.After(30 * time.Second):
+			return 0, errors.New("gated conn: nobody opened the gate")
+		}
+	}
+	n, err := c.Conn.Write(p)
+	c.written.Add(int64(n))
+	return n, err
+}
+
+// httpsSlowServer is the handler both tests share: response HEADERS first, then
+// nothing until the pool has been drained, then the request body, then the
+// response body.
+type httpsSlowServer struct {
+	reply       []byte
+	served      atomic.Int32
+	warmups     int32
+	headersSent chan struct{}
+	bodyGate    chan struct{}
+	received    chan []byte
+	readErr     chan error
+}
+
+func newHTTPSSlowServer(reply []byte) *httpsSlowServer {
+	return &httpsSlowServer{
+		reply:       reply,
+		headersSent: make(chan struct{}, 1),
+		bodyGate:    make(chan struct{}),
+		received:    make(chan []byte, 1),
+		readErr:     make(chan error, 1),
+	}
+}
+
+func (s *httpsSlowServer) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
+	if s.served.Add(1) <= s.warmups {
+		// Warm-up: answer normally, so the connection is established and the
+		// client has applied the server's SETTINGS before the query that
+		// matters goes out.
+		io.Copy(io.Discard, request.Body)
+		writer.Header().Set("Content-Type", MimeType)
+		writer.Header().Set("Content-Length", strconv.Itoa(len(s.reply)))
+		writer.Write(s.reply)
+		return
+	}
+	// Without this, net/http's HTTP/1.1 server drains up to 256 KB of the
+	// request body before it will write response headers, precisely so that a
+	// half-duplex client cannot deadlock. That would consume the query before
+	// the client is anywhere near done sending it, and there would be nothing
+	// left in flight to catch. Full duplex is how a resolver that answers from
+	// cache before reading the whole query behaves; HTTP/2 is full duplex
+	// already and returns an error here, which is fine.
+	http.NewResponseController(writer).EnableFullDuplex()
+	writer.Header().Set("Content-Type", MimeType)
+	// Content-Length matters: without it Exchange falls into io.ReadAll and
+	// waits for the end of the response, which this handler is about to
+	// withhold on purpose.
+	writer.Header().Set("Content-Length", strconv.Itoa(len(s.reply)))
+	writer.WriteHeader(http.StatusOK)
+	writer.(http.Flusher).Flush()
+	s.headersSent <- struct{}{}
+
+	// A real resolver would be reading the query by now. Withholding it is what
+	// keeps the client parked mid-body while the pool is drained.
+	<-s.bodyGate
+	body, err := io.ReadAll(request.Body)
+	s.readErr <- err
+	s.received <- body
+
+	writer.Write(s.reply)
+}
+
+// drainPoolOnceHeadersAreOut waits for the response headers, gives Exchange time
+// to return from RoundTrip, drains the size class the query buffer came from —
+// on this goroutine, so a buffer released on the way out lands in our hands and
+// not somewhere harmless — and only then lets the server read the query.
+func (s *httpsSlowServer) drainPoolOnceHeadersAreOut(bufferSize int) <-chan []*buf.Buffer {
+	poisoned := make(chan []*buf.Buffer, 1)
+	go func() {
+		<-s.headersSent
+		time.Sleep(httpsReleaseSettleDelay)
+		poisoned <- httpsPoisonPool(bufferSize, 32)
+		close(s.bodyGate)
+	}()
+	return poisoned
+}
+
+func (s *httpsSlowServer) requireQueryOnWire(t *testing.T, expected []byte) {
+	t.Helper()
+	var sent []byte
+	select {
+	case sent = <-s.received:
+	case <-time.After(30 * time.Second):
+		t.Fatal("the server never received the request body")
+	}
+	if err := <-s.readErr; err != nil {
+		t.Fatal("reading the request body: ", err)
+	}
+	if bytes.Equal(sent, expected) {
+		return
+	}
+	firstDiff := -1
+	for i := 0; i < len(sent) && i < len(expected); i++ {
+		if sent[i] != expected[i] {
+			firstDiff = i
+			break
+		}
+	}
+	t.Fatalf("the query on the wire is not the query we packed: %d of %d bytes received, first difference at offset %d — "+
+		"the pooled request buffer was reused while the transport was still reading it", len(sent), len(expected), firstDiff)
+}
+
+// TestHTTPSExchangeRequestBufferOutlivesRoundTripHTTP1 proves that the query an
+// HTTP/1.1 resolver receives is the query we asked to send, even when the pool
+// is drained the instant the response headers arrive.
+func TestHTTPSExchangeRequestBufferOutlivesRoundTripHTTP1(t *testing.T) {
+	message, expected := httpsPaddedQuery(t, httpsH1PaddedQuerySize)
+	bufferSize := 1 + message.Len()
+	httpsRequirePoisonReachesReleasedBuffer(t, bufferSize, expected)
+
+	handler := newHTTPSSlowServer(httpsTestReply(t))
+	server := httptest.NewServer(handler)
+	t.Cleanup(server.Close)
+
+	dialer := &httpsTestDialer{
+		target: server.Listener.Addr().String(),
+		wrap: func(conn net.Conn) net.Conn {
+			// One 4 KiB flush of net/http's write buffer gets through, which is
+			// what carries the request headers to the server, and the write loop
+			// parks on the next one — still holding the query.
+			return &httpsGatedConn{Conn: conn, limit: 4096, gate: handler.bodyGate}
+		},
+	}
+	t.Cleanup(dialer.closeAll)
+
+	// Scheme http puts HTTPSTransportWrapper on its HTTP/1.1 leg, the one it
+	// also falls back to whenever a resolver does not negotiate h2.
+	destination := &url.URL{Scheme: "http", Host: "doh.invalid", Path: "/dns-query"}
+	dnsTransport := &HTTPSTransport{
+		TransportAdapter: dns.NewTransportAdapter(C.DNSTypeHTTPS, "test-doh-h1", nil),
+		logger:           logger.NOP(),
+		dialer:           dialer,
+		destination:      destination,
+		headers:          http.Header{},
+		transport:        NewHTTPSTransportWrapper(dialer, M.ParseSocksaddr(server.Listener.Addr().String()), destination),
+	}
+	t.Cleanup(func() { dnsTransport.Close() })
+
+	poisoned := handler.drainPoolOnceHeadersAreOut(bufferSize)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+	if _, err := dnsTransport.Exchange(ctx, message); err != nil {
+		t.Fatal("exchange: ", err)
+	}
+	defer httpsReleaseAll(<-poisoned)
+
+	handler.requireQueryOnWire(t, expected)
+}
+
+// TestHTTPSExchangeRequestBufferOutlivesRoundTripHTTP2 does the same over h2,
+// the leg every resolver that speaks HTTP/2 lands on.
+func TestHTTPSExchangeRequestBufferOutlivesRoundTripHTTP2(t *testing.T) {
+	message, expected := httpsPaddedQuery(t, httpsH2PaddedQuerySize)
+	bufferSize := 1 + message.Len()
+	httpsRequirePoisonReachesReleasedBuffer(t, bufferSize, expected)
+	// Repeated because a buffer released on the goroutine running Exchange
+	// usually lands in that P's private sync.Pool slot, which the goroutine
+	// draining the pool cannot steal: one round catches a broken build about
+	// half the time, eight catch it better than 99 times in 100. Every round
+	// must come back clean.
+	for round := range httpsH2Rounds {
+		if !t.Run(strconv.Itoa(round), func(t *testing.T) {
+			httpsH2Round(t, message, expected, bufferSize)
+		}) {
+			return
+		}
+	}
+}
+
+func httpsH2Round(t *testing.T, message *mDNS.Msg, expected []byte, bufferSize int) {
+	handler := newHTTPSSlowServer(httpsTestReply(t))
+	// x/net/http2 may put the first request on the wire before it has applied
+	// the server's SETTINGS, and would then overrun the 1 KiB window this test
+	// pins and be reset with FLOW_CONTROL_ERROR. One small query first settles
+	// that: reading its response proves the SETTINGS frame ahead of it was
+	// processed.
+	handler.warmups = 1
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { listener.Close() })
+	h2server := &http2.Server{
+		MaxUploadBufferPerStream: httpsPinnedStreamWindow,
+		MaxReadFrameSize:         httpsPinnedMaxFrameSize,
+	}
+	go func() {
+		for {
+			conn, acceptErr := listener.Accept()
+			if acceptErr != nil {
+				return
+			}
+			go h2server.ServeConn(conn, &http2.ServeConnOpts{Handler: handler})
+		}
+	}()
+
+	dialer := &httpsTestDialer{target: listener.Addr().String()}
+	t.Cleanup(dialer.closeAll)
+
+	// Scheme https keeps HTTPSTransportWrapper on its h2 leg. The dialer hands
+	// back a plain connection, which x/net/http2 speaks prior-knowledge h2 over;
+	// TLS adds nothing this test is about.
+	destination := &url.URL{Scheme: "https", Host: "doh.invalid", Path: "/dns-query"}
+	dnsTransport := &HTTPSTransport{
+		TransportAdapter: dns.NewTransportAdapter(C.DNSTypeHTTPS, "test-doh-h2", nil),
+		logger:           logger.NOP(),
+		dialer:           dialer,
+		destination:      destination,
+		headers:          http.Header{},
+		transport:        NewHTTPSTransportWrapper(dialer, M.ParseSocksaddr(listener.Addr().String()), destination),
+	}
+	t.Cleanup(func() { dnsTransport.Close() })
+
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+	warmup := new(mDNS.Msg)
+	warmup.SetQuestion("warmup.invalid.", mDNS.TypeA)
+	if _, err = dnsTransport.Exchange(ctx, warmup); err != nil {
+		t.Fatal("warm-up exchange: ", err)
+	}
+
+	poisoned := handler.drainPoolOnceHeadersAreOut(bufferSize)
+	if _, err = dnsTransport.Exchange(ctx, message); err != nil {
+		t.Fatal("exchange: ", err)
+	}
+	defer httpsReleaseAll(<-poisoned)
+
+	handler.requireQueryOnWire(t, expected)
+}
+
+// TestHTTPSRequestBufferSurvivesRewind covers the second owner a retry creates.
+// net/http rewinds a dead connection's request by CLOSING the body it has and
+// then asking GetBody for another one (rewindBody), while x/net/http2 asks
+// GetBody first and closes the old body on a goroutine (shouldRetryRequest,
+// closeReqBodyLocked). Either ordering frees the buffer under the retry if the
+// first Close is what returns it to the pool, and the retry then sends whatever
+// the next pool user wrote — the same disclosure, one attempt later.
+func TestHTTPSRequestBufferSurvivesRewind(t *testing.T) {
+	message, expected := httpsPaddedQuery(t, httpsH2PaddedQuerySize)
+	bufferSize := 1 + message.Len()
+	httpsRequirePoisonReachesReleasedBuffer(t, bufferSize, expected)
+
+	exMessage := *message
+	exMessage.Id = 0
+	exMessage.Compress = true
+	requestBuffer := buf.NewSize(bufferSize)
+	rawMessage, err := exMessage.PackBuffer(requestBuffer.FreeBytes())
+	if err != nil {
+		t.Fatal(err)
+	}
+	queryBuffer := newRequestBuffer(requestBuffer, rawMessage)
+	defer queryBuffer.release()
+
+	first, ok := queryBuffer.body()
+	if !ok {
+		t.Fatal("the first body was refused while exchange still holds the buffer")
+	}
+	// The transport got some of the query out before the connection turned out
+	// to be dead, then closed the body.
+	if _, err = io.CopyN(io.Discard, first, 128); err != nil {
+		t.Fatal(err)
+	}
+	first.Close()
+
+	// GetBody, as the retry would call it.
+	second, ok := queryBuffer.body()
+	if !ok {
+		t.Fatal("GetBody was refused after the first body was closed: the retry has no query left to send")
+	}
+	poison := httpsPoisonPool(bufferSize, 32)
+	defer httpsReleaseAll(poison)
+
+	retried, err := io.ReadAll(second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(retried, expected) {
+		firstDiff := -1
+		for i := 0; i < len(retried) && i < len(expected); i++ {
+			if retried[i] != expected[i] {
+				firstDiff = i
+				break
+			}
+		}
+		t.Fatalf("the retried query is not the query we packed: %d of %d bytes, first difference at offset %d — "+
+			"closing the first body returned the buffer to the pool while the retry still needed it", len(retried), len(expected), firstDiff)
+	}
+	second.Close()
+}
+
+// TestHTTPSRequestBufferRefusesBodyAfterRelease pins the recoverable end of the
+// contract: once the buffer really is back in the pool, GetBody must hand out an
+// error rather than a reader over memory that now belongs to somebody else.
+func TestHTTPSRequestBufferRefusesBodyAfterRelease(t *testing.T) {
+	requestBuffer := buf.NewSize(64)
+	rawMessage := requestBuffer.FreeBytes()[:8]
+	queryBuffer := newRequestBuffer(requestBuffer, rawMessage)
+
+	body, ok := queryBuffer.body()
+	if !ok {
+		t.Fatal("the first body was refused while the caller still holds the buffer")
+	}
+	body.Close()
+	body.Close() // http3 and net/http both manage to close a body twice
+	queryBuffer.release()
+
+	if _, ok = queryBuffer.body(); ok {
+		t.Fatal("a body was handed out over a buffer that is already back in the pool")
+	}
+}

dns/transport/quic/http3.go

@@ -126,6 +126,12 @@ func (t *HTTP3Transport) newTransport() *http3.Transport {
 				conn.Close()
 				return nil, dialErr
 			}
+			// quic-go does not take ownership of the packet conn passed to
+			// DialEarly: when the connection ends it only stops reading.
+			go func() {
+				<-quicConn.Context().Done()
+				conn.Close()
+			}()
 			return quicConn, nil
 		},
 		TLSClientConfig: t.tlsConfig,
@@ -156,15 +162,34 @@ func (t *HTTP3Transport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS
 	exMessage := *message
 	exMessage.Id = 0
 	exMessage.Compress = true
-	requestBuffer := buf.NewSize(1 + message.Len())
-	rawMessage, err := exMessage.PackBuffer(requestBuffer.FreeBytes())
+	// NOT a pooled buffer, deliberately — the request body must own memory this
+	// transport can never hand back.
+	//
+	// quic-go writes the request body on a goroutine of its own (http3's
+	// doRequest spawns it and goes on to block in ReadResponse), and NOTHING ever
+	// joins that goroutine. On the success path sendRequestBody closes the body
+	// when it is finished, but on every error path RoundTripOpt closes it as soon
+	// as doRequest returns — and doRequest waits only on the request-cancellation
+	// watchdog, not on the writer. So there is no moment at which this code can
+	// know the body is no longer being read, and therefore no moment at which it
+	// may return a pooled buffer. Releasing on Close looks like an ownership
+	// handoff and is not one.
+	//
+	// Owning it costs nothing here, measured rather than assumed: for a typical
+	// query (a 36-byte name, A record) Pack is 87 ns/op at 64 B and 1 alloc,
+	// against 108 ns/op at 64 B and 1 alloc for packing into a pooled buffer. The
+	// pool never avoided an allocation on this path — buf.NewSize allocates the
+	// Buffer struct itself, the same 64 bytes the message needs — it only added
+	// Get/Put on top. This path is hot in queries, not in bytes.
+	//
+	// The response buffer below stays pooled: it is read to completion and
+	// unpacked before Exchange returns, and nothing outlives it.
+	rawMessage, err := exMessage.Pack()
 	if err != nil {
-		requestBuffer.Release()
 		return nil, err
 	}
 	request, err := http.NewRequestWithContext(ctx, http.MethodPost, t.destination.String(), bytes.NewReader(rawMessage))
 	if err != nil {
-		requestBuffer.Release()
 		return nil, err
 	}
 	request.Header = t.headers.Clone()
@@ -174,7 +199,6 @@ func (t *HTTP3Transport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS
 	currentTransport := t.transport
 	t.transportAccess.Unlock()
 	response, err := currentTransport.RoundTrip(request)
-	requestBuffer.Release()
 	if err != nil {
 		return nil, err
 	}

dns/transport/quic/http3_requestbuffer_lx_test.go

@@ -0,0 +1,426 @@
+package quic
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/tls"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/sagernet/quic-go"
+	"github.com/sagernet/quic-go/http3"
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/dns"
+	"github.com/sagernet/sing-box/dns/transport"
+	"github.com/sagernet/sing/common/buf"
+	"github.com/sagernet/sing/common/logger"
+	M "github.com/sagernet/sing/common/metadata"
+
+	mDNS "github.com/miekg/dns"
+)
+
+// The request body of a DoH3 query used to be backed by a POOLED buffer. quic-go
+// sends that body on a goroutine of its own which outlives RoundTrip (http3's
+// doRequest spawns it and returns as soon as the response HEADERS arrive), and
+// NOTHING joins that goroutine, so there is no moment at which the transport may
+// hand the buffer back.
+//
+// Two tests, because the two paths are observable in different ways.
+//
+//   - On the SUCCESS path the body keeps flowing, so the damage is visible on the
+//     wire: TestHTTP3ExchangeRequestBufferOutlivesRoundTrip pins a 2 KB server
+//     stream window and answers before reading the body, so the client is still
+//     writing when Exchange returns, and compares what the server received.
+//
+//   - On the FAILURE and CANCELLATION paths the damage is not visible on the wire
+//     at all: every ReadResponse error in quic-go calls str.CancelWrite BEFORE
+//     RoundTripOpt closes the body, so whatever the writer reads afterwards is
+//     thrown at a dead stream. What is left is a read of memory that belongs to
+//     somebody else. TestHTTP3ExchangeNeverPacksQueriesIntoPooledMemory therefore
+//     pins the CAUSE instead of the symptom: the bytes of a query must never end
+//     up in a buffer this transport can return to the pool.
+
+const (
+	// Big enough to need more than one 8 KiB read out of the request body
+	// (http3's bodyCopyBufferSize), small enough to still come from the pool
+	// (buf.MaxPooledBufferSize).
+	paddedQuerySize = 20000
+	// Pinned on the server so the client cannot write the whole body before the
+	// response comes back.
+	pinnedStreamWindow = 2048
+	// Padding for the marked query of the ownership test. Only has to be
+	// distinctive and pooled, not large.
+	markedQueryPadding = 4096
+	markedQueryNeedle  = 64
+	// How deep to drain a size class when looking for the needle.
+	poolScanDepth = 64
+	// How many times a CONTROL may repeat before it gives up.
+	//
+	// Both controls in this file assert the same thing — a buffer released while
+	// its bytes are still referenced comes back out of the pool — and under
+	// `-race` that is a DICE ROLL, not a certainty: sync.Pool.Put drops one
+	// object in four on purpose (runtime_randn(4) == 0, sync/pool.go). Measured
+	// in golang:1.26 with `go test -race -count=60`: the single-attempt control
+	// failed 18 times out of 60, i.e. the gate's -race pass had a ~30% chance of
+	// going red on a tree with nothing wrong with it.
+	//
+	// A retry is the honest repair rather than a papering-over, because the
+	// control's claim is EXISTENTIAL — "this instrument is able to find a
+	// released, still-referenced buffer" — and one success proves it. It is not
+	// an average over attempts, so nothing is diluted by taking more than one.
+	// 32 attempts leave a (1/4)^32 chance of a false alarm.
+	//
+	// What this does NOT do, said plainly: it does not make the VERDICT below
+	// certain under -race. The same 1-in-4 drop means a scan that comes back
+	// clean has a 1-in-4 chance of being clean because the pool threw the
+	// evidence away. That direction is the safe one — it can only let a broken
+	// build look clean, never make a clean build look broken — and the -race
+	// pass is not the only one that runs this test: [2/7] of scripts/run-tests.sh
+	// runs the same file WITHOUT -race, where both the control and the verdict
+	// are certainties.
+	controlAttempts = 32
+)
+
+func paddedQuery(t *testing.T) (*mDNS.Msg, []byte) {
+	t.Helper()
+	message := new(mDNS.Msg)
+	message.SetQuestion("example.com.", mDNS.TypeA)
+	opt := new(mDNS.OPT)
+	opt.Hdr.Name = "."
+	opt.Hdr.Rrtype = mDNS.TypeOPT
+	opt.Option = append(opt.Option, &mDNS.EDNS0_PADDING{Padding: make([]byte, paddedQuerySize)})
+	message.Extra = append(message.Extra, opt)
+
+	// Exactly what HTTP3Transport.Exchange puts on the wire.
+	onWire := *message
+	onWire.Id = 0
+	onWire.Compress = true
+	expected, err := onWire.Pack()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return message, expected
+}
+
+// poisonPool takes buffers of one size class out of the pool and fills them with
+// a pattern no DNS message contains. The buffers are returned, not released: the
+// caller holds them so nothing can hand them back while the check runs.
+func poisonPool(size int, count int) []*buf.Buffer {
+	poison := make([]*buf.Buffer, 0, count)
+	for range count {
+		buffer := buf.NewSize(size)
+		poison = append(poison, buffer)
+		free := buffer.FreeBytes()
+		for i := range free {
+			free[i] = 0xEE
+		}
+	}
+	return poison
+}
+
+func releaseAll(buffers []*buf.Buffer) {
+	for _, buffer := range buffers {
+		buffer.Release()
+	}
+}
+
+// requirePoisonReachesReleasedBuffer is the CONTROL for the test below. A clean
+// result there means nothing unless this instrument is shown to be able to
+// produce a dirty one: it must be true that a buffer released while its bytes
+// are still referenced comes back out of the pool and gets overwritten. If this
+// stops holding — a different allocator, a pool that zeroes, a size class that
+// is not pooled at all — the test below would go green on broken code.
+//
+// Retried, because under -race sync.Pool.Put drops one object in four on
+// purpose. That same dice roll is why the check below is a 3-in-4 detector under
+// -race and a certainty without it; it can only make a broken build look clean,
+// never a clean build look broken. See controlAttempts.
+func requirePoisonReachesReleasedBuffer(t *testing.T, size int, pattern []byte) {
+	t.Helper()
+	for range controlAttempts {
+		control := buf.NewSize(size)
+		free := control.FreeBytes()
+		if len(free) < len(pattern) {
+			t.Fatalf("control failed: a %d-byte buffer came back %d bytes long", size, len(free))
+		}
+		copy(free, pattern)
+		alias := free[:len(pattern)]
+		control.Release()
+
+		held := poisonPool(size, 8)
+		poisoned := !bytes.Equal(alias, pattern)
+		releaseAll(held)
+		if poisoned {
+			return
+		}
+	}
+	t.Fatal("control failed: poisoning the pool never touched a released buffer, so a clean result below would prove nothing")
+}
+
+// TestHTTP3ExchangeRequestBufferOutlivesRoundTrip proves that the query the
+// server receives is the query we asked to send, even when the pool is drained
+// the instant Exchange returns.
+func TestHTTP3ExchangeRequestBufferOutlivesRoundTrip(t *testing.T) {
+	message, expected := paddedQuery(t)
+	bufferSize := 1 + message.Len()
+	requirePoisonReachesReleasedBuffer(t, bufferSize, expected)
+
+	drainGate := make(chan struct{})
+	received := make(chan []byte, 1)
+	mux := http.NewServeMux()
+	mux.HandleFunc("/dns-query", func(writer http.ResponseWriter, request *http.Request) {
+		// Answer BEFORE reading the request body. A real resolver would not, but
+		// any peer, middlebox or loss pattern that delays the body has the same
+		// effect, and this makes the window deterministic.
+		response := new(mDNS.Msg)
+		response.SetReply(testQuery())
+		rawResponse, err := response.Pack()
+		if err != nil {
+			writer.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		writer.Header().Set("Content-Type", transport.MimeType)
+		// Content-Length matters here: without it Exchange falls into io.ReadAll
+		// and waits for the stream FIN, which this handler is about to withhold.
+		writer.Header().Set("Content-Length", strconv.Itoa(len(rawResponse)))
+		writer.Write(rawResponse)
+		writer.(http.Flusher).Flush()
+
+		<-drainGate
+		body, _ := io.ReadAll(request.Body)
+		received <- body
+	})
+	listener, err := quic.ListenAddrEarly("127.0.0.1:0", testServerTLSConfig(t, []string{http3.NextProtoH3}), &quic.Config{
+		InitialStreamReceiveWindow:     pinnedStreamWindow,
+		MaxStreamReceiveWindow:         pinnedStreamWindow,
+		InitialConnectionReceiveWindow: 1 << 16,
+		MaxConnectionReceiveWindow:     1 << 16,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	server := &http3.Server{Handler: mux}
+	go server.ServeListener(listener)
+	t.Cleanup(func() {
+		server.Close()
+		listener.Close()
+	})
+
+	dialer := &trackingDialer{}
+	t.Cleanup(dialer.closeAll)
+	dnsTransport := &HTTP3Transport{
+		TransportAdapter: dns.NewTransportAdapter(C.DNSTypeHTTP3, "test-doh3-buffer", nil),
+		logger:           logger.NOP(),
+		dialer:           dialer,
+		destination:      &url.URL{Scheme: "https", Host: "localhost", Path: "/dns-query"},
+		headers:          http.Header{},
+		serverAddr:       M.ParseSocksaddr(listener.Addr().String()),
+		tlsConfig: &tls.Config{
+			InsecureSkipVerify: true,
+			ServerName:         "localhost",
+			NextProtos:         []string{http3.NextProtoH3},
+			MinVersion:         tls.VersionTLS13,
+		},
+	}
+	dnsTransport.transport = dnsTransport.newTransport()
+	t.Cleanup(func() { dnsTransport.Close() })
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	if _, err = dnsTransport.Exchange(ctx, message); err != nil {
+		t.Fatal("exchange: ", err)
+	}
+
+	// Exchange has returned, the body is still in flight. Drain the size class it
+	// came from, on this very goroutine, so a buffer released on the way out lands
+	// in our hands and not somewhere harmless. The buffers are held until after
+	// the comparison below.
+	poison := poisonPool(bufferSize, 32)
+	defer releaseAll(poison)
+
+	close(drainGate)
+	var sent []byte
+	select {
+	case sent = <-received:
+	case <-time.After(20 * time.Second):
+		t.Fatal("the server never received the request body")
+	}
+	if !bytes.Equal(sent, expected) {
+		firstDiff := -1
+		for i := 0; i < len(sent) && i < len(expected); i++ {
+			if sent[i] != expected[i] {
+				firstDiff = i
+				break
+			}
+		}
+		t.Fatalf("the query on the wire is not the query we packed: %d of %d bytes received, first difference at offset %d — "+
+			"the pooled request buffer was reused while quic-go was still reading it", len(sent), len(expected), firstDiff)
+	}
+}
+
+// markedQuery builds a query whose EDNS0 padding carries a random tag, so the
+// packed bytes contain a needle that can be searched for in pool memory and
+// cannot collide with anything else.
+func markedQuery(t *testing.T) (*mDNS.Msg, []byte) {
+	t.Helper()
+	padding := make([]byte, markedQueryPadding)
+	if _, err := rand.Read(padding); err != nil {
+		t.Fatal(err)
+	}
+	message := new(mDNS.Msg)
+	message.SetQuestion("example.com.", mDNS.TypeA)
+	opt := new(mDNS.OPT)
+	opt.Hdr.Name = "."
+	opt.Hdr.Rrtype = mDNS.TypeOPT
+	opt.Option = append(opt.Option, &mDNS.EDNS0_PADDING{Padding: padding})
+	message.Extra = append(message.Extra, opt)
+	return message, padding[:markedQueryNeedle]
+}
+
+// poolHoldsNeedle drains one size class of the buffer pool and reports whether
+// any buffer in it still carries the needle. It must run on the goroutine that
+// released the buffer: sync.Pool keeps a per-P private slot that no other P can
+// steal from, and on the paths this test covers the release happens inline in
+// RoundTripOpt, on the caller's own goroutine.
+func poolHoldsNeedle(size int, needle []byte, count int) bool {
+	held := make([]*buf.Buffer, 0, count)
+	defer func() { releaseAll(held) }()
+	var found bool
+	for range count {
+		buffer := buf.NewSize(size)
+		held = append(held, buffer)
+		if bytes.Contains(buffer.FreeBytes(), needle) {
+			found = true
+		}
+	}
+	return found
+}
+
+// requireInstrumentFindsPackedQuery is the CONTROL. It does exactly what the old
+// Exchange did — pack a query into a pooled buffer and release it — and demands
+// that the scan below FINDS the needle. Without it, "the pool does not hold the
+// query" would also be the verdict for a scan that can never find anything.
+//
+// Retried for the same reason its sibling control above is, and it was NOT
+// before: under -race sync.Pool.Put drops one object in four, so a single
+// attempt made this control — and with it the whole -race pass of the gate —
+// fail on 18 of 60 measured runs with nothing wrong in the tree. A fresh
+// needle is packed on each attempt, so a later one cannot be answered by an
+// earlier one's bytes. See controlAttempts for what the retry does and does not
+// buy.
+func requireInstrumentFindsPackedQuery(t *testing.T) {
+	t.Helper()
+	for range controlAttempts {
+		message, needle := markedQuery(t)
+		size := 1 + message.Len()
+		exMessage := *message
+		exMessage.Id = 0
+		exMessage.Compress = true
+
+		buffer := buf.NewSize(size)
+		if _, err := exMessage.PackBuffer(buffer.FreeBytes()); err != nil {
+			t.Fatal(err)
+		}
+		buffer.Release()
+
+		if poolHoldsNeedle(size, needle, poolScanDepth) {
+			return
+		}
+	}
+	t.Fatalf("control failed: %d times in a row, a query packed into a pooled buffer and released was NOT "+
+		"found by the scan, so a clean verdict below would prove nothing. Under -race sync.Pool.Put drops "+
+		"one object in four, which is what the retries absorb; this many consecutive misses is something "+
+		"else — a pool that zeroes on Put, a size class that stopped being pooled, or buf.Buffer no longer "+
+		"handing its array back at all", controlAttempts)
+}
+
+// TestHTTP3ExchangeNeverPacksQueriesIntoPooledMemory pins the ownership rule the
+// failure paths depend on.
+//
+// quic-go's http3.Transport closes the request body on every error path
+// (transport.go RoundTripOpt) the moment doRequest returns, and doRequest waits
+// only on the request-cancellation watchdog — never on the goroutine writing the
+// body. So releasing the buffer when the body is closed is not an ownership
+// handoff, and the only safe arrangement is for the query never to live in pool
+// memory at all.
+//
+// This test encodes THAT design. A future guarded-pool design (a lock around
+// Read and Close, refusing reads after release) would also be correct and would
+// fail this test on purpose — it would have to replace it, and say so.
+func TestHTTP3ExchangeNeverPacksQueriesIntoPooledMemory(t *testing.T) {
+	requireInstrumentFindsPackedQuery(t)
+
+	// A UDP socket nobody answers on: the handshake runs to the context deadline
+	// instead of being refused, which is the shape a router sees when the tunnel
+	// carrying its resolver drops.
+	blackhole, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { blackhole.Close() })
+
+	for _, testCase := range []struct {
+		name string
+		ctx  func(t *testing.T) (context.Context, context.CancelFunc)
+	}{
+		{
+			// RoundTripOpt closes the body after the handshake gives up.
+			name: "server never answers",
+			ctx: func(t *testing.T) (context.Context, context.CancelFunc) {
+				return context.WithTimeout(context.Background(), 500*time.Millisecond)
+			},
+		},
+		{
+			// The cancellation watchdog fires, then RoundTripOpt closes the body.
+			name: "context already cancelled",
+			ctx: func(t *testing.T) (context.Context, context.CancelFunc) {
+				ctx, cancel := context.WithCancel(context.Background())
+				cancel()
+				return ctx, func() {}
+			},
+		},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			message, needle := markedQuery(t)
+			size := 1 + message.Len()
+
+			dialer := &trackingDialer{}
+			t.Cleanup(dialer.closeAll)
+			dnsTransport := &HTTP3Transport{
+				TransportAdapter: dns.NewTransportAdapter(C.DNSTypeHTTP3, "test-doh3-ownership", nil),
+				logger:           logger.NOP(),
+				dialer:           dialer,
+				destination:      &url.URL{Scheme: "https", Host: "localhost", Path: "/dns-query"},
+				headers:          http.Header{},
+				serverAddr:       M.ParseSocksaddr(blackhole.LocalAddr().String()),
+				tlsConfig: &tls.Config{
+					InsecureSkipVerify: true,
+					ServerName:         "localhost",
+					NextProtos:         []string{http3.NextProtoH3},
+					MinVersion:         tls.VersionTLS13,
+				},
+			}
+			dnsTransport.transport = dnsTransport.newTransport()
+			t.Cleanup(func() { dnsTransport.Close() })
+
+			ctx, cancel := testCase.ctx(t)
+			defer cancel()
+			if _, err := dnsTransport.Exchange(ctx, message); err == nil {
+				t.Fatal("expected the exchange to fail; this test is about the failure path")
+			}
+
+			// Same goroutine that ran RoundTripOpt, so the per-P private slot a
+			// release would have landed in is the one being drained.
+			if poolHoldsNeedle(size, needle, poolScanDepth) {
+				t.Fatal("the bytes of the query came back out of the buffer pool: the request body was packed into pooled " +
+					"memory and released while quic-go's body writer could still be reading it")
+			}
+		})
+	}
+}

dns/transport/quic/packetconn_leak_test.go

@@ -0,0 +1,351 @@
+package quic
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"net/http"
+	"net/url"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/sagernet/quic-go"
+	"github.com/sagernet/quic-go/http3"
+	sbTLS "github.com/sagernet/sing-box/common/tls"
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/dns"
+	"github.com/sagernet/sing-box/dns/transport"
+	"github.com/sagernet/sing-box/option"
+	"github.com/sagernet/sing/common"
+	"github.com/sagernet/sing/common/logger"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+
+	mDNS "github.com/miekg/dns"
+)
+
+var _ N.Dialer = (*trackingDialer)(nil)
+
+// These tests pin down who owns the UDP socket handed to quic-go.
+//
+// quic-go's Dial/DialEarly take a net.PacketConn but do NOT take ownership of
+// it: quic.setupTransport() builds a Transport with createdConn=false, and
+// Transport.Close() then only calls conn.SetReadDeadline(time.Now()) instead of
+// conn.Close(). So every QUIC connection torn down here — idle timeout, a
+// retryable error, an engine reload calling Reset() — used to strand the UDP
+// socket that carried it for the rest of the process's life. On a router that
+// resolves through DoQ/DoH3 for months that is an unbounded fd leak.
+//
+// Both tests reconnect once and assert the socket from the FIRST connection is
+// actually closed. Without the `<-conn.Context().Done() -> rawConn.Close()`
+// watchdogs in quic.go / http3.go they fail on that assertion.
+
+type trackedConn struct {
+	net.Conn
+	closeOnce sync.Once
+	closed    chan struct{}
+}
+
+func (c *trackedConn) Close() error {
+	c.closeOnce.Do(func() { close(c.closed) })
+	return c.Conn.Close()
+}
+
+// trackingDialer hands out real UDP sockets and remembers every one of them.
+type trackingDialer struct {
+	access sync.Mutex
+	conns  []*trackedConn
+}
+
+func (d *trackingDialer) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	conn, err := (&net.Dialer{}).DialContext(ctx, network, destination.String())
+	if err != nil {
+		return nil, err
+	}
+	tracked := &trackedConn{Conn: conn, closed: make(chan struct{})}
+	d.access.Lock()
+	d.conns = append(d.conns, tracked)
+	d.access.Unlock()
+	return tracked, nil
+}
+
+func (d *trackingDialer) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
+	return net.ListenUDP("udp", nil)
+}
+
+func (d *trackingDialer) count() int {
+	d.access.Lock()
+	defer d.access.Unlock()
+	return len(d.conns)
+}
+
+func (d *trackingDialer) at(index int) *trackedConn {
+	d.access.Lock()
+	defer d.access.Unlock()
+	return d.conns[index]
+}
+
+func (d *trackingDialer) closeAll() {
+	d.access.Lock()
+	defer d.access.Unlock()
+	for _, conn := range d.conns {
+		conn.Close()
+	}
+}
+
+func requireClosed(t *testing.T, conn *trackedConn, what string) {
+	t.Helper()
+	select {
+	case <-conn.closed:
+	case <-time.After(5 * time.Second):
+		t.Fatalf("%s: the UDP socket of the retired QUIC connection was never closed — quic-go does not own it, we must", what)
+	}
+}
+
+func requireDialed(t *testing.T, dialer *trackingDialer, want int) {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		if dialer.count() >= want {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("expected at least %d dial(s), got %d", want, dialer.count())
+}
+
+func testServerTLSConfig(t *testing.T, nextProtos []string) *tls.Config {
+	t.Helper()
+	certificate, err := sbTLS.GenerateKeyPair(nil, nil, nil, "localhost")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &tls.Config{
+		Certificates: []tls.Certificate{*certificate},
+		NextProtos:   nextProtos,
+		MinVersion:   tls.VersionTLS13,
+	}
+}
+
+func testClientTLSConfig(t *testing.T, nextProtos []string) sbTLS.Config {
+	t.Helper()
+	config, err := sbTLS.NewClient(context.Background(), logger.NOP(), "localhost", option.OutboundTLSOptions{
+		Enabled:    true,
+		Insecure:   true,
+		ServerName: "localhost",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	config.SetNextProtos(nextProtos)
+	return config
+}
+
+// startDoQServer serves a minimal DoQ responder and returns its address.
+func startDoQServer(t *testing.T) M.Socksaddr {
+	t.Helper()
+	listener, err := quic.ListenAddr("127.0.0.1:0", testServerTLSConfig(t, []string{"doq"}), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(func() {
+		cancel()
+		listener.Close()
+	})
+	go func() {
+		for {
+			conn, acceptErr := listener.Accept(ctx)
+			if acceptErr != nil {
+				return
+			}
+			go func(conn *quic.Conn) {
+				for {
+					stream, streamErr := conn.AcceptStream(ctx)
+					if streamErr != nil {
+						return
+					}
+					go func(stream *quic.Stream) {
+						defer stream.Close()
+						request, readErr := transport.ReadMessage(stream)
+						if readErr != nil {
+							return
+						}
+						response := new(mDNS.Msg)
+						response.SetReply(request)
+						transport.WriteMessage(stream, 0, response)
+					}(stream)
+				}
+			}(conn)
+		}
+	}()
+	return M.ParseSocksaddr(listener.Addr().String())
+}
+
+func testQuery() *mDNS.Msg {
+	message := new(mDNS.Msg)
+	message.SetQuestion("example.com.", mDNS.TypeA)
+	return message
+}
+
+func TestQUICTransportClosesPacketConnOnReconnect(t *testing.T) {
+	t.Parallel()
+	serverAddr := startDoQServer(t)
+	dialer := &trackingDialer{}
+	t.Cleanup(dialer.closeAll)
+
+	dnsTransport := &Transport{
+		TransportAdapter: dns.NewTransportAdapter(C.DNSTypeQUIC, "test-doq", nil),
+		dialer:           dialer,
+		serverAddr:       serverAddr,
+		tlsConfig:        testClientTLSConfig(t, []string{"doq"}),
+		connection: transport.NewConnPool(transport.ConnPoolOptions[*quic.Conn]{
+			Mode: transport.ConnPoolSingle,
+			IsAlive: func(conn *quic.Conn) bool {
+				return conn != nil && !common.Done(conn.Context())
+			},
+			Close: func(conn *quic.Conn, _ error) {
+				conn.CloseWithError(0, "")
+			},
+		}),
+	}
+	t.Cleanup(func() { dnsTransport.Close() })
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+
+	if _, err := dnsTransport.Exchange(ctx, testQuery()); err != nil {
+		t.Fatal("first exchange: ", err)
+	}
+	requireDialed(t, dialer, 1)
+	first := dialer.at(0)
+
+	// Retire the connection the way a retryable error or an engine reload does.
+	dnsTransport.Reset()
+	requireClosed(t, first, "Reset()")
+
+	// The reconnect must still work, on a fresh socket.
+	if _, err := dnsTransport.Exchange(ctx, testQuery()); err != nil {
+		t.Fatal("second exchange: ", err)
+	}
+	requireDialed(t, dialer, 2)
+	second := dialer.at(1)
+	if second == first {
+		t.Fatal("expected a new UDP socket for the reconnect")
+	}
+
+	if err := dnsTransport.Close(); err != nil {
+		t.Fatal(err)
+	}
+	requireClosed(t, second, "Close()")
+}
+
+func TestHTTP3TransportClosesPacketConnOnReconnect(t *testing.T) {
+	t.Parallel()
+	mux := http.NewServeMux()
+	mux.HandleFunc("/dns-query", func(writer http.ResponseWriter, request *http.Request) {
+		message, err := readRequestMessage(request)
+		if err != nil {
+			writer.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		response := new(mDNS.Msg)
+		response.SetReply(message)
+		rawResponse, err := response.Pack()
+		if err != nil {
+			writer.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		writer.Header().Set("Content-Type", transport.MimeType)
+		writer.Write(rawResponse)
+	})
+	listener, err := quic.ListenAddrEarly("127.0.0.1:0", testServerTLSConfig(t, []string{http3.NextProtoH3}), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	server := &http3.Server{Handler: mux}
+	go server.ServeListener(listener)
+	t.Cleanup(func() {
+		server.Close()
+		listener.Close()
+	})
+	serverAddr := M.ParseSocksaddr(listener.Addr().String())
+
+	dialer := &trackingDialer{}
+	t.Cleanup(dialer.closeAll)
+
+	stdConfig := &tls.Config{
+		InsecureSkipVerify: true,
+		ServerName:         "localhost",
+		NextProtos:         []string{http3.NextProtoH3},
+		MinVersion:         tls.VersionTLS13,
+	}
+	dnsTransport := &HTTP3Transport{
+		TransportAdapter: dns.NewTransportAdapter(C.DNSTypeHTTP3, "test-doh3", nil),
+		logger:           logger.NOP(),
+		dialer:           dialer,
+		destination:      &url.URL{Scheme: "https", Host: "localhost", Path: "/dns-query"},
+		headers:          http.Header{},
+		serverAddr:       serverAddr,
+		tlsConfig:        stdConfig,
+	}
+	dnsTransport.transport = dnsTransport.newTransport()
+	t.Cleanup(func() { dnsTransport.Close() })
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+
+	if _, err = dnsTransport.Exchange(ctx, testQuery()); err != nil {
+		t.Fatal("first exchange: ", err)
+	}
+	requireDialed(t, dialer, 1)
+	first := dialer.at(0)
+
+	dnsTransport.Reset()
+	requireClosed(t, first, "Reset()")
+
+	if _, err = dnsTransport.Exchange(ctx, testQuery()); err != nil {
+		t.Fatal("second exchange: ", err)
+	}
+	requireDialed(t, dialer, 2)
+	second := dialer.at(1)
+	if second == first {
+		t.Fatal("expected a new UDP socket for the reconnect")
+	}
+
+	if err = dnsTransport.Close(); err != nil {
+		t.Fatal(err)
+	}
+	requireClosed(t, second, "Close()")
+}
+
+func readRequestMessage(request *http.Request) (*mDNS.Msg, error) {
+	defer request.Body.Close()
+	rawMessage := make([]byte, 4096)
+	n, err := readFull(request.Body, rawMessage)
+	if err != nil {
+		return nil, err
+	}
+	var message mDNS.Msg
+	err = message.Unpack(rawMessage[:n])
+	if err != nil {
+		return nil, err
+	}
+	return &message, nil
+}
+
+func readFull(reader interface{ Read([]byte) (int, error) }, buffer []byte) (int, error) {
+	var total int
+	for total < len(buffer) {
+		n, err := reader.Read(buffer[total:])
+		total += n
+		if err != nil {
+			if total > 0 {
+				return total, nil
+			}
+			return total, err
+		}
+	}
+	return total, nil
+}

dns/transport/quic/quic.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"os"
+	"time"
 
 	"github.com/sagernet/quic-go"
 	"github.com/sagernet/sing-box/adapter"
@@ -117,6 +118,12 @@ func (t *Transport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS.Msg,
 				rawConn.Close()
 				return nil, E.Cause(err, "establish QUIC connection")
 			}
+			// quic-go does not take ownership of the packet conn passed to
+			// DialEarly: when the connection ends it only stops reading.
+			go func() {
+				<-earlyConnection.Context().Done()
+				rawConn.Close()
+			}()
 			return earlyConnection, nil
 		})
 		if err != nil {
@@ -144,6 +151,11 @@ func (t *Transport) exchange(ctx context.Context, message *mDNS.Msg, conn *quic.
 		return nil, E.Cause(err, "open stream")
 	}
 	defer stream.CancelRead(0)
+	stopWatch := context.AfterFunc(ctx, func() {
+		stream.CancelRead(0)
+		_ = stream.SetWriteDeadline(time.Now())
+	})
+	defer stopWatch()
 	err = transport.WriteMessage(stream, 0, message)
 	if err != nil {
 		stream.Close()

docs-lx/lx-changelog.md

@@ -12,6 +12,50 @@ as GitHub **pre-releases** and never become "Latest".
 
 #### Unreleased (shater)
 
+**`l3-honest-drop` — ICMP routed to an L4-only outbound is dropped, not
+forged** — ships with `shaterd` (part of the shater L3 ingress,
+`docs-shater/DECISIONS.md` D25), not as an lx release tag; recorded here because
+it edits two upstream files. Without it the TUN stack answers an unroutable echo
+ITSELF — sing-tun's `ICMPForwarder.HandlePacket` rewrites Echo→EchoReply
+whenever the flow judgment comes back Accept (`stack_gvisor_icmp.go`) — so a
+ping routed to vless/vmess/… would read as a working tunnel while the packet
+never left the router.
+
+* **`route/route.go` (`PreMatch`)** — the pre-match walk was renamed to
+  `preMatch` and the exported `PreMatch` became a thin FUNNEL that rewrites
+  `PreMatchContinue` and `PreMatchBypass` to `PreMatchDrop` for
+  `N.NetworkICMP`. An earlier version overrode `continueResult` inside
+  `preMatchFlow` instead; that covered only the exits reaching that function and
+  left three of the walk's own exits forging — the `prepareMatchMetadata` error
+  return, the sniff bail-outs, and the `default:` arm of the rule-action switch
+  (every action pre-match has no arm for: `hijack-dns`, `direct`, …). A guard on
+  the single return value cannot be outgrown by a new exit. `PreMatchBypass` is
+  folded in because sing-tun implements `ActionBypass` on the nfqueue plane only
+  — on the TUN path it lands in the same `default:` arm as Accept, i.e. forges.
+* **`adapter/router.go` (`JudgeFlow`, the `!isPort` branch)** — ICMP returns
+  `ActionDrop` where it fell through to `ActionAccept`. Second line of defense:
+  `adapter.FlowOutbound` and `tun.Port` are distinct interfaces, and a drift
+  between them must not quietly re-enable the forged reply.
+* **TCP/UDP behaviour is unchanged** — `PreMatchContinue` still means "take the
+  ordinary connection route" for both, `PreMatchBypass` still means bypass, and
+  the `!isPort` fallthrough still returns `ActionAccept` for them; pinned by
+  `route/prematch_icmp_lx_test.go` and `adapter/judgeflow_icmp_lx_test.go`
+  (both inside the marker), each ICMP case having an explicit TCP/UDP twin.
+* **NOT covered: a FRAGMENTED echo to a WireGuard/AWG outbound is still
+  forged** — sing-tun's `ForwardDispatcher.Dispatch` returns before asking for a
+  verdict at all when `parsed.fragment`, and the reassembled packet reaches
+  `ICMPForwarder.HandlePacket`, whose `installFlow` demands an UNSPECIFIED port
+  address that a WireGuard endpoint never has. Fixing it inside `JudgeFlow`
+  is NOT possible — both consumers call it with identical arguments and the
+  working path needs the concrete address. Full chain, the two viable fixes and
+  the trap are in `docs-shater/DECISIONS.md` D25, under "What is still NOT
+  covered, said plainly", item 2.
+* **Rebase cost: two small marked blocks** (`lx:begin/end l3-honest-drop`, a
+  wrapper function in `route/route.go` and one branch body in
+  `adapter/router.go`) plus the two self-contained test files — carried across
+  an upstream rebase by eye. Note that `PreMatch`'s own body now lives in
+  `preMatch`, so an upstream change to the walk applies to that function.
+
 **Fork-layer + control-plane rework of proxy health** — ships with `shaterd`
 (the shater router daemon), not as an lx release tag; recorded here because the
 load-bearing half lives in fork zones (`common/urltest`, `protocol/group`).

docs-shater/ARCHITECTURE.md

@@ -62,16 +62,61 @@ flowchart LR
   C["LAN client"] -->|"nft tproxy, mark → tproxy port"| IN["sing-box tproxy inbound (sniff SNI/Host/QUIC)"]
   IN --> R{"route: rule match — src / dst / list / geo / client"}
   R -->|"proxied"| OUT["outbound / selector (balancer, chain)"]
-  R -->|"direct"| DIR["direct (flow-offload on)"]
+  R -->|"direct"| DIR["direct (out the normal route, untunnelled)"]
   R -->|"blocked"| BLK["block"]
   OUT --> NET["exit — VLESS/Reality/AmneziaWG2/Hysteria2/…"]
 ```
 
 Reliability (ported from v0.1): own nft table `inet shater` + own marks/tables
-(never touch fw4); atomic validate→stage→swap; commit-confirm rollback;
-idempotent reconcile under flock; management-bypass always; fail-closed
+(never touch fw4); atomic validate→stage→swap; commit-confirm rollback (opt-in —
+see §5); idempotent reconcile under flock; management-bypass always; fail-closed
 kill-switch (dead group → block, not a silent direct leak).
 
+Only TCP and UDP reach that path — TPROXY carries nothing else. What happens to
+the rest is §3a.
+
+### 3a. L3 ingress and kernel egress — what TPROXY cannot carry
+
+Two opt-in globals cover the protocols the tproxy plane leaves on the floor.
+Both are off in a stock config, and both are configured through UCI only (the
+panel does not expose them).
+
+**`globals.l3_tunnel` — LAN ICMP through the tunnel.** The generator adds a
+synthetic `tun` inbound tagged `l3-in` (gVisor stack, `auto_route` **off**, MTU
+65535, `shater/generate/inbound.go`), so ICMP is routed by the engine's own rules
+instead of being dropped or answered by a forged local reply. The device is not
+one fixed name: the generator emits a stable placeholder (so a no-op reconcile
+still hashes identical and does not rebuild the engine once a minute), and
+`shater/engine/l3slot.go` substitutes one of the two slots `shater-l3a` /
+`shater-l3b` (`netplane/l3.go`) just before `box.New` — a new generation must
+never reopen the name the outgoing one still holds
+(`TUNSETIFF: device or resource busy` took the whole LAN down once). The routing half is scoped and lives entirely outside
+the main table: our nft prerouting chain stamps LAN `icmp`/`ipv6-icmp` with
+`L3Mark` (`fwmark_base + 0x80`), and `netplane.addL3Routing` binds that mark to
+`L3Table` (`table_base + 8`), whose only content is a default route out the live
+slot. Because the daemon creates the device at runtime, netifd never learns about
+it and fw4 would reject the forward on its own account — so `30_shater-core`
+seeds a **`shater_l3` zone in the user's `/etc/config/firewall`**, matching
+`list device 'shater-l3*'` (a string match that is valid before the TUN exists
+and covers both slots). Ceiling: ICMP echo only, and only for L3-capable
+egresses; see `DECISIONS.md` D25 for what is still not covered.
+
+**`globals.untunnelable_egress` — everything else, carried by the kernel.** It
+names an existing interface/tunnel egress. Whatever the L3 block above did not
+claim — ESP/AH, GRE, IGMP, SCTP, and ICMP too when `l3_tunnel` is off — is
+stamped in prerouting with **that egress's own mark** (`netplane/nft.go`,
+`UntunnelableEgressBinding`) and accepted; the `fwmark → table` pair
+`addEgressRouting` already installed for the egress then routes it out the
+egress's device. No new mark, no new table, and the engine never sees a byte —
+which is why any IP protocol works here while the L3 TUN is narrow. Order is
+load-bearing: this sweep runs **after** the L3 marking (first match wins) and
+**after** the local-plane accepts, so LAN-to-LAN, router-addressed traffic and
+IPv6 neighbour discovery never leave through an uplink. With `ipv6=0` the mark
+is scoped to `nfproto ipv4`, because `addEgressRouting` installs the `-6`
+rule/table pair only when IPv6 is on and marked v6 without it would fall through
+to the main table past the kill-switch. `globals.untunnelable` (block | icmp |
+direct) stays in charge of whatever neither mechanism carries.
+
 ## 4. DNS + filtering + stats
 
 ```mermaid
@@ -79,7 +124,7 @@ flowchart LR
   C["client :53"] -->|"hijack"| DNS["sing-box DNS (in-process)"]
   DNS --> FILT{"shater filter: blocklists + allowlist + per-device policy"}
   FILT -->|"blocked"| NX["NXDOMAIN / 0.0.0.0"]
-  FILT -->|"allowed"| RES["resolvers (DoH/DoT/plain/FakeIP) + nftset for routing"]
+  FILT -->|"allowed"| RES["resolvers (DoH/DoT/plain/local/FakeIP), per-rule detour"]
   DNS -->|"query events (engine observability)"| AGG["shater stats aggregator"]
   AGG --> PANEL["panel: top domains · per-device · allowed/blocked · timeline"]
 ```
@@ -87,9 +132,10 @@ flowchart LR
 Because the engine's DNS runs **in our process**, every query (domain, client,
 verdict, latency) is available to the stats aggregator without log-scraping —
 this is the payoff of embedding. Blocklist matching uses an efficient compiled
-matcher, not dnsmasq megalists (see `DECISIONS.md` D5). Per-device blocking =
-engine route/DNS rule keyed by client, or nftset(device) × nftset(blocked-domain)
-→ drop.
+matcher, not dnsmasq megalists (see `DECISIONS.md` D5). Per-device blocking is an
+engine route/DNS rule keyed by client. Routing decisions come from in-engine
+rule-sets: the v0.1 mechanism where dnsmasq populated nft sets does not exist in
+v0.2 (`generate/dns.go`).
 
 ## 5. Config & apply flow
 
@@ -100,11 +146,20 @@ stateDiagram-v2
   Render --> Validate: engine config check + nft -c
   Validate --> KeepOld: fail
   Validate --> Apply: ok (atomic swap: engine reload + nft/route reconcile)
-  Apply --> ConfirmWindow
+  Apply --> Committed: confirm_timeout = 0 (SHIPPED DEFAULT — nothing armed)
+  Apply --> ConfirmWindow: confirm_timeout > 0
   ConfirmWindow --> Committed: confirmed
   ConfirmWindow --> Rollback: timeout
   Rollback --> LastGood
 ```
 
+**The confirm window is opt-in and ships closed.** `model.DefaultGlobals()` leaves
+`ConfirmTimeout` at zero, the shipped `/etc/config/shater` says
+`option confirm_timeout '0'`, and `apply.ArmRollback` returns immediately on a
+non-positive timeout — so on a stock install every apply takes the left edge above
+and there is no net under it. `shaterd apply` reports which edge it took
+(`reason: commit-confirm-off` vs an armed window). Set
+`globals.confirm_timeout` to arm it.
+
 ## 6. Roadmap tiers
 See `ROADMAP.md` for the phased plan and `FEATURES.md` for the full feature list.

docs-shater/CONTEXT.md

@@ -31,12 +31,11 @@ Do not delete it — we port proven pieces from it. What v0.1 has:
 - **`luci-app-shater`** — a custom "instrument panel" LuCI app (client-side JS +
   ucode/rpcd ubus backend): Overview with a live Signal Path, Simple/Advanced
   toggle, quick-start wizard, Nodes/Subs/Rules/DNS/Live/Profiles/Settings pages.
-- **CI + signed opkg feed** on Gitea: builds per-arch, signs the feed index with
-  usign, publishes a rolling `latest` Gitea release consumable as `src/gz`. **Feed
-  signing key fingerprint `5ac4b177689cb8e0`**; public key `dist/shater-feed.pub`,
-  secret in the Gitea repo secret `KEY_BUILD`.
+- **CI + a signed package feed** on Gitea: builds per-arch, signs the feed index,
+  publishes a rolling `latest` Gitea release the router consumes as a feed.
+  (v0.1 shipped `.ipk` signed with a usign key — that lane is retired, D22.)
 - Verified end-to-end on the VM: real LAN client proxied, DNS anti-leak, honest
-  fail-closed, opkg install/upgrade from the signed feed.
+  fail-closed, install/upgrade from the signed feed.
 
 v0.1 is engine-locked to **xray-core**; its generator, share-link parser and
 `run.json` are xray-shaped.
@@ -52,6 +51,9 @@ We are rebasing onto a new engine and a new UI architecture. Full rationale in
    MASQUE/WARP, and gRPC observability (DNS queries / rules / outbounds). Upstream
    sing-box brings VLESS/VMess/Trojan/Shadowsocks/WireGuard/Reality + Hysteria2/
    TUIC. It is library-first (`libbox`) and **GPL-3.0** (compatible with us).
+   That list is what the FORK can build, not what shater ships: `shater/registry`
+   registers only what `shater/generate` can emit, and MASQUE is one of the types
+   deliberately left out (~6 MB of binary and resident RAM). See `FEATURES.md`.
    - We **fork it** (not just depend on it) so we can embed literally everything —
      control-plane, admin panel, DNS filter — and integrate tightly with the
      engine internals (DNS, routing, stats). This is a deliberate, decided
@@ -85,13 +87,13 @@ We are rebasing onto a new engine and a new UI architecture. Full rationale in
 
 ## Repository model
 
-- **`shater` `main` = our fork of sing-box-lx.** After Phase 1 it contains the
-  full sing-box-lx tree PLUS our additive overlay (`shater/`, `panel/`,
-  `openwrt/`, `docs-shater/`). Upstream is tracked via a git remote and merged by tag.
+- **`shater` `main` = our fork of sing-box-lx.** It contains the full sing-box-lx
+  tree PLUS our additive overlay (`shater/`, `panel/`, `openwrt/`, `docs-shater/`,
+  `scripts/`, `ci/`). Upstream is tracked via a git remote and merged by tag.
+  Phase 1 merged the engine in on 2026-07-14 (`v1.14.0-lx.3`); `main` has not been
+  a docs-only seed since.
 - **`shater` branch `v0.1`** = the standalone xray-based version (frozen, ported
   from).
-- Until Phase 1 merges the engine in, `main` is the docs-first overlay seed you
-  are reading now (LICENSE, README, `docs-shater/`, `dist/shater-feed.pub`).
 
 ## What to port from v0.1 (don't rewrite these ideas)
 
@@ -105,8 +107,8 @@ overlay, don't redo:
 - **Subscription fetch** (HAPP emulation, fingerprint reconcile, per-sub cache)
   and the flexible **ruleset/list** model — though sing-box has its own share-link
   parser and config schema we now target.
-- **CI feed build + usign signing + Gitea release** (adapt to the single forked
-  binary; keep key `5ac4b177689cb8e0`).
+- **CI feed build + index signing + Gitea release** (adapted to the single forked
+  binary; the format is apk, signed with the EC key — D22).
 - The LuCI **design system** (the "instrument panel" identity) — reused for the
   mini-dashboard and as the panel's visual language.
 
@@ -120,20 +122,30 @@ filter/stats engine wired into sing-box's DNS.
   v0.2 fork; branch `v0.1` = the working xray-based version.
 - **Upstream to track:** `https://github.com/Leadaxe/sing-box-lx` (which tracks
   `https://github.com/SagerNet/sing-box`).
-- **CI:** Gitea Actions (act_runner + Docker). v0.1's workflow was removed from
-  `main`; new CI is added when the v0.2 build exists.
-- **Feed signing:** usign key `5ac4b177689cb8e0`; secret in repo secret
-  `KEY_BUILD`; public key `dist/shater-feed.pub` (kept so existing installs keep
-  verifying).
-- **Test VM:** OpenWrt 24.10.3 x86_64 in Docker (`docker ps --filter
-  name=openwrt-vm`). SSH via the ssh-manager MCP server `local_openwrt`
-  (localhost:2222, root/openwrt). LuCI at `http://127.0.0.1:8080` (root/openwrt),
-  drivable with the Playwright MCP.
+- **CI:** Gitea Actions (act_runner + Docker), `.gitea/workflows/release.yml` —
+  builds the four packages through the ImmortalWrt 25.12.1 SDK and publishes the
+  signed per-arch apk repo. The opkg/`.ipk` lane was deleted, not disabled (D22).
+- **Test gate:** `bash scripts/run-tests.sh` — the whole suite under the SHIPPED
+  build tags, on linux (in Docker from a non-linux host), with `-race`, and with
+  three anti-silent-skip checks. Not optional reading before touching `shater/`.
+- **Feed signing:** EC (prime256v1) key for the apk index; secret in the repo
+  secret `KEY_APK`; public key `dist/shater-apk.pem`, installed on routers as
+  `/etc/apk/keys/shater-apk.pem`. Never regenerate it (D22).
+- **Test VM:** **ImmortalWrt 25.12.1** (`r37978-cd0a06bfd3fd`) x86_64 in Docker
+  (`docker ps --filter name=openwrt-vm`), apk-tools 3.0.5 — deliberately the same
+  revision as `mini_router`, and required: the only package format we publish is
+  `.apk`, which does not install on 24.10 at all. SSH via the ssh-manager MCP
+  server `local_openwrt` (localhost:2222, root/openwrt). LuCI at
+  `http://127.0.0.1:8080` (root/openwrt), drivable with the Playwright MCP.
+- **Routers:** `mini_router` (BPi-R3 Mini, ImmortalWrt 25.12.1) carries the real
+  home traffic; `main_router` (BPi-R4, OpenWrt 25.12.0). Both `aarch64_cortex-a53`,
+  both apk-tools 3.0.5 — see the table in D22.
 
 ## Current status
 
-Repo reset done: v0.1 preserved on its branch; `main` cleaned to this docs-first
-scaffold. Next is Phase 1 in `ROADMAP.md` — fork sing-box-lx into `main`
-(add upstream remote, merge a pinned tag), stand up the embedding prototype
-(prove AmneziaWG 2.0, measure binary size with feature-trim + `-s -w` + UPX)
-before building the control plane and panel.
+**v0.2 is feature-complete and running on real hardware.** ROADMAP Phases 0–8 are
+done and VM-verified; the product ships as a signed apk feed and is installed on
+`mini_router`. Read `ROADMAP.md` for what each phase delivered, `FEATURES.md` for
+the honest MVP/T1/T2 state of each feature (including what is declared but not
+shipped), and `DECISIONS.md` for why. Work since Phase 8 has been correctness and
+honesty passes rather than new phases.

docs-shater/FEATURES.md

@@ -6,15 +6,51 @@ usable release, **[T1]** next, **[T2]** later. Phases refer to `ROADMAP.md`.
 ## Proxy engine & protocols (from the sing-box fork)
 - **[MVP]** VLESS, VMess, Trojan, Shadowsocks, WireGuard, Reality/XTLS.
 - **[MVP]** **AmneziaWG 2.0** (I1–I5 CPS decoy packets) — a driving requirement.
-- **[T1]** Hysteria2, TUIC, ShadowTLS, XHTTP, MASQUE/CONNECT-IP (Cloudflare WARP).
+- **[MVP]** Hysteria2, TUIC (`hysteria2://`/`hy2://`/`tuic://`, `shater/parse`),
+  XHTTP transport — all shipped: the router tag set carries `with_quic` and
+  `with_xhttp` and `shater/registry` registers them (`scripts/router-tags.sh`,
+  `buildtags.Features`).
+- **[T1]** ShadowTLS — half-built: `shater/generate` emits it and `shater/registry`
+  registers it, but no parser produces one (there is no `shadowtls://` share link
+  and no subscription path), so a config cannot reach it today.
+- **NOT SHIPPED** MASQUE/CONNECT-IP (Cloudflare WARP). `masque` appears nowhere in
+  `shater/parse`, `shater/generate` or `shater/model`, and `shater/registry` names
+  it among the upstream types it deliberately does not register (~6 MB of binary
+  and resident RAM). The engine fork can build it; this product does not.
 - **[MVP]** Transports: TCP/WS/gRPC/HTTPUpgrade/H2/QUIC as upstream provides.
 
 ## Transparent proxying & routing
 - **[MVP]** TPROXY transparent proxy for multiple LAN interfaces (TCP + UDP), SNI/
   Host/QUIC sniffing.
+- **[MVP]** **L3 ingress for ICMP** (`globals.l3_tunnel`, opt-in, default off):
+  LAN ping travels THROUGH the tunnel instead of being dropped or answered by a
+  forged local reply. The engine opens a dedicated TUN (`shater-l3`, gVisor
+  stack, `auto_route` off); nft marks LAN icmp/icmpv6 only and a scoped
+  `ip rule` routes it in — the TPROXY plane and the main routing table stay
+  untouched (D25). Carried only by L3-capable egresses (WireGuard/AmneziaWG,
+  direct); ICMP routed to vless/vmess/… is honestly dropped, never faked.
+  Ceiling is upstream sing-tun's: ICMP echo only — Windows tracert works, IPv6
+  traceroute shows just the destination; ESP/AH/GRE/IGMP stay with the
+  `untunnelable` policy (D17) unless `untunnelable_egress` carries them (D26).
+- **[MVP]** **Kernel egress for untunnelable protocols**
+  (`globals.untunnelable_egress`, opt-in, default empty): names an existing
+  interface/tunnel egress, and IPsec (ESP/AH), PPTP/GRE, SCTP — everything that
+  is neither TCP nor UDP, plus ICMP when the L3 ingress is off — is routed out
+  that egress's device by the KERNEL with kernel NAT, reusing the egress's own
+  fwmark/table from `addEgressRouting`; the proxy never sees a byte, which is
+  why every protocol works (D26). What that buys depends on the device: a
+  WireGuard interface really is a tunnel, a second WAN is just another uplink
+  whose real address the destination sees. It does not revive multicast IPTV,
+  and UDP-based VPNs (WireGuard, OpenVPN-UDP, IPsec NAT-T) never needed it —
+  they follow the routing rules as before. The `untunnelable` policy (D17)
+  keeps only the failure case: a route that did not come up.
 - **[MVP]** First-match routing rules by source (IP/CIDR/MAC/interface/zone),
-  destination (domain/suffix/keyword/geosite), reusable domain/IP lists, port,
-  proto → target (outbound/selector/chain/direct/block) + egress.
+  destination, port, proto → target (outbound/selector/chain/direct/block) + egress.
+  A rule names its **destination through a rule-set only** — a reusable named list
+  (inline domains/CIDRs, a local or remote file, or a geosite/geoip category) that is
+  compiled once into a `.srs` and shared by every rule that references it. Domain
+  entries take `full:` (exact), `suffix:` / a leading dot (host + subdomains),
+  `keyword:` (substring) and `regexp:`; a bare entry means host + subdomains.
 - **[MVP]** Node groups with balancer/observatory (least-ping/failover/round-robin).
 - **[T1]** Multi-hop chains (L1→Ln); per-rule egress selection; egress via any
   interface/tunnel (e.g. an AmneziaWG tunnel).
@@ -36,6 +72,16 @@ usable release, **[T1]** next, **[T2]** later. Phases refer to `ROADMAP.md`.
   type=fakeip + pool — there is no global "FakeIP mode"); no DNS leaks. Routing
   is decided by in-engine rule-sets — the v0.1 dnsmasq→nftset population
   mechanism does not exist in v0.2 (see generate/dns.go).
+  The hijack covers the queries a client sends **to the router itself** — the
+  address DHCP hands out — because `globals.dns_intercept` is **ON by default**
+  (D24). With it off, those queries go to dnsmasq and out to the ISP in the clear,
+  so the well-behaved client leaks while the one that hard-codes 8.8.8.8 does not.
+  `.lan` and the private PTR zones are preserved through dnsmasq either way. Two
+  things the promise does NOT cover, both by design: while the engine is DOWN the
+  holding plane hooks `forward` only, so dnsmasq still answers router-addressed
+  :53 unfiltered (client traffic and DNS to external resolvers stay blocked); and
+  with no `config resolver` at all there is no DNS plane to filter with — queries
+  fall through to the system resolver and generate says so.
 - **[MVP]** Client DoT/DoH blocking (stop devices bypassing the filter).
 - **[MVP]** **Blocklists** with **flexible sources**: `inline` (type your own) /
   `file` / `url` (auto-update) / `geosite` category (only when geodata present).
@@ -73,8 +119,12 @@ usable release, **[T1]** next, **[T2]** later. Phases refer to `ROADMAP.md`.
 ## Reliability ("железно")
 - **[MVP]** Fail-closed kill-switch (dead group → block, never silent direct leak);
   IPv6 dropped when disabled.
-- **[MVP]** Atomic apply with engine + `nft -c` validation; commit-confirm
-  auto-rollback to last-good.
+- **[MVP]** Atomic apply with engine + `nft -c` validation. Commit-confirm
+  auto-rollback to last-good is built and works, but it is **opt-in and ships
+  OFF**: `DefaultGlobals()` leaves `ConfirmTimeout` at 0, the shipped
+  `/etc/config/shater` says `confirm_timeout '0'`, and `apply.ArmRollback` returns
+  at once on a non-positive timeout. Until an operator sets a window, an apply on
+  a stock box has no net under it — and `shaterd apply` says so.
 - **[MVP]** Idempotent reconcile from hotplug/boot under flock; restart engine only
   on real config change; management-bypass (SSH/LuCI/LAN) always exempt.
 - **[MVP]** Own nft table `inet shater` + own marks/tables; never touch fw4.
@@ -89,8 +139,8 @@ usable release, **[T1]** next, **[T2]** later. Phases refer to `ROADMAP.md`.
   SIM uplink → different egress); backup/restore; i18n (EN + RU).
 
 ## Ops & distribution
-- **[MVP]** Single signed binary; signed opkg feed on Gitea (reuse key
-  `5ac4b177689cb8e0`); one-line install; `opkg upgrade`.
+- **[MVP]** Single signed binary; signed apk feed on Gitea (EC key
+  `dist/shater-apk.pem`); one-line install; named-package `apk upgrade`.
 - **[T1]** Upstream-rebase cadence (track sing-box-lx tags) with a smoke suite.
-- **[T2]** apk (OpenWrt 25.x) packaging; multi-router fleet management; REST/gRPC
-  external API; Telegram bot.
+- **[T2]** Multi-router fleet management; REST/gRPC external API; Telegram bot.
+  (apk packaging landed and is now the only lane — D22.)

docs-shater/INSTALL.md

@@ -1,7 +1,7 @@
 # Shater v0.2 — Build & Install
 
 How to build the ship artifact (the SPA-embedded `shaterd` binary) and install
-the OpenWrt feed onto a router.
+the signed apk repo onto a router.
 
 ## 1. Build the `shaterd` binary
 
@@ -28,7 +28,7 @@ Arg / env:
 - `VERSION` — stamped into `constant.Version`. Resolution: positional arg →
   `$SHATER_VERSION` → `ci/version.sh --binary` → `v0.2.0-dev`. `ci/version.sh` is
   the **same** computation the package version comes from (§2.1), so the string
-  the panel shows always matches what `apk info shaterd` / `opkg status` report.
+  the panel shows always matches what `apk list -I shaterd` reports.
 - `--fast` — skip `npm ci` when `panel/node_modules` already exists.
 - `UPX=/path/to/upx` — override the UPX binary (default `upx` on `PATH`). UPX is
   cross-arch, so one host packs both the amd64 and aarch64 ELFs. (Note: UPX also
@@ -43,22 +43,44 @@ UPX="…/scratchpad/upx-4.2.4-win64/upx.exe" scripts/build-shaterd.sh v0.2.0 --f
 The `dist/*` and `openwrt/shaterd/files/shaterd-*.upx` outputs are gitignored —
 they are release artifacts, not source.
 
-Tag set (D9 — keep in sync with `docs-shater/DECISIONS.md`):
+Tag set (D9/D23) — defined in **one** place, `scripts/router-tags.sh`, which
+documents every tag and is sourced by the build:
 
 ```
-with_quic,with_wireguard,with_utls,
+with_gvisor,with_quic,with_wireguard,with_utls,
 badlinkname,tfogo_checklinkname0,with_xhttp,with_awg,with_lx_command
 ```
 
 We drop `with_purego,with_naive_outbound`: they pull cronet-go, which forces a
 glibc `PT_INTERP` even under `CGO_ENABLED=0`, making the binary unusable on musl.
-We drop `with_gvisor`: the shater data plane is tproxy/redirect and generate
-never emits a tun inbound, so the userspace gvisor netstack is unreachable code.
 We drop `with_clash_api`: the admin panel is shater's own web server and the
 generator never emits a `clash_api` service, so the Clash server is dead code.
 We drop `with_dhcp`: shater resolver types are `udp/tcp/doh/dot/local/fakeip`;
 a `dhcp://` DNS transport is never generated or registered.
 
+`with_gvisor` was dropped in 2026-07 as "unreachable — we emit no tun inbound"
+and **put back on 2026-07-25**: gVisor is also the netstack of the WireGuard
+endpoint, so without it every `wg://`/`awg://` node died at apply time with
+*"gVisor is not included in this build"* while the panel still offered the
+feature. It costs ~2.8 MB raw / ~0.65 MB UPX per arch. Full story: `DECISIONS.md`
+D23.
+
+### Changing the tag set
+
+Run the guard — it is what stands between a size trim and a silently dead
+feature, and CI runs it before the artifact is built:
+
+```sh
+scripts/check-router-tags.sh     # from Windows/macOS it re-execs itself in golang:1.26
+```
+
+It (1) fails if a feature declared in `FEATURES.md` lost a build tag it needs to
+run (`shater/buildtags`, no tags/OS/network required) and (2) constructs one node
+of every declared protocol through `box.New` **compiled with the shipped tag
+set** — nothing may be skipped in that run. Adding a protocol to
+`shater/parse`+`shater/generate` means adding a row to `buildtags.Features` and a
+probe case in `shater/generate/shipped_tags_linux_test.go`.
+
 ## 2. Packages
 
 Four OpenWrt packages live under `openwrt/`:
@@ -66,7 +88,7 @@ Four OpenWrt packages live under `openwrt/`:
 | Package            | Arch      | What it ships |
 |--------------------|-----------|---------------|
 | `shaterd`          | per-arch  | **Prebuilt** static `shaterd` binary → `/usr/bin/shaterd` (this is the ship artifact from step 1). |
-| `shater-core`      | all       | procd init (supervises `shaterd run`), cron, hotplug, sysctl, inert default UCI. `DEPENDS:=+shaterd +kmod-nft-tproxy +kmod-nft-socket +ip-full`. |
+| `shater-core`      | all       | procd init (supervises `shaterd run`), the boot armor (§4), cron, hotplug, sysctl, inert default UCI. `DEPENDS:=+shaterd +kmod-nft-tproxy +kmod-nft-socket +kmod-tun +ip-full +nftables-json +ca-bundle`. |
 | `luci-app-shater`  | all       | Thin LuCI launcher: mini dashboard + token-handoff "Open panel" button. `DEPENDS:=+shater-core +rpcd`. |
 | `byedpi`           | per-arch  | *Optional* ByeDPI (`ciadpi`) local desync SOCKS proxy for a `type='byedpi'` egress. |
 
@@ -91,9 +113,9 @@ See `openwrt-package-build-ci` for SDK/feed mechanics.
 `PKG_VERSION`/`PKG_RELEASE` are **not** maintained by hand. They used to be, and
 nobody bumped them: **v0.2.2 … v0.2.6 all shipped as `shaterd 0.2.0-r3`** with
 different binaries inside (v0.2.6's ELF is 5 491 616 B against r2's 5 488 336 B).
-Both package managers offer an upgrade only when the feed's version string
-differs from the installed one, so `apk update` saw nothing new and the routers
-could not be updated through the normal path at all.
+apk offers an upgrade only when the feed's version string differs from the
+installed one, so `apk update` saw nothing new and the routers could not be
+updated through the normal path at all.
 
 `ci/version.sh` now derives them from `git describe`, once per CI job:
 
@@ -103,9 +125,8 @@ could not be updated through the normal path at all.
 | dispatch, 3 commits past `v0.2.7` | `0.2.7` | `4` | `v0.2.7-r4-g<sha>` |
 | no reachable tag / no git     | `0.0.0` | `1` | `v0.0.0-r1` |
 
-Ordering is what makes this safe, and both managers agree on it (checked with
-`apk version -t` on apk-tools 3.0.3 and `opkg compare-versions` on opkg
-38eccbb1): the dotted part decides first, `-rN` only breaks ties — so
+Ordering is what makes this safe (checked with `apk version -t` on apk-tools
+3.0.3): the dotted part decides first, `-rN` only breaks ties — so
 `0.2.7-r1 > 0.2.6-r12 > 0.2.6-r1 > 0.2.0-r3`. A release therefore always
 outranks every rolling build before it, rolling builds between two releases grow
 monotonically, and an untagged build (`0.0.0`) can never masquerade as an
@@ -113,8 +134,9 @@ upgrade.
 
 The value travels as `SHATER_PKG_VERSION`/`SHATER_PKG_RELEASE` in the SDK build
 environment; the Makefiles read it with a literal fallback for manual/offline
-builds. Both lanes then **assert** the produced `.ipk`/`.apk` really carries it,
-so a lost variable fails the build instead of shipping a stale version.
+builds. `ci/sdk-build-apk.sh` then **asserts** the produced `.apk` really carries
+it, so a lost variable fails the build instead of shipping a stale version. The
+release job asserts the same version again on the published rolling repo (§5.1).
 
 `byedpi` is deliberately excluded — `PKG_VERSION:=0.17.3` is *upstream ByeDPI's*
 version, which is what `PKG_HASH` pins and what tells you which ByeDPI is
@@ -124,21 +146,27 @@ when our packaging of it changes.
 
 ## 3. Install on a router
 
-Install order follows the deps (`shaterd` → `shater-core` → `luci-app-shater`):
+**The normal path is the signed apk repo — §5.** This section is the manual
+fallback (a router with no route to the Gitea host, or a hand-carried build).
+
+Install order follows the deps (`shaterd` → `shater-core` → `luci-app-shater`).
+apk filenames carry no architecture, so make sure you copied the `.apk` built for
+*this* router's arch (`cat /etc/apk/arch`):
 
 ```sh
 # <ver> = the release version, e.g. 0.2.7-r1 (§2.1 — it comes from the git tag)
-opkg install shaterd_<ver>_<arch>.ipk          # or: apk add shaterd   (25.12+)
-opkg install shater-core_<ver>_all.ipk
-opkg install luci-app-shater_<ver>_all.ipk
-opkg install byedpi_0.17.3-r1_<arch>.ipk       # optional: ByeDPI egress
+# --allow-untrusted: our member .apk are unsigned by design — trust lives in the
+# signed packages.adb index (§5), which a loose file install does not consult.
+apk add --allow-untrusted ./shaterd-<ver>.apk
+apk add --allow-untrusted ./shater-core-<ver>.apk
+apk add --allow-untrusted ./luci-app-shater-<ver>.apk
+apk add --allow-untrusted ./byedpi-0.17.3-r1.apk       # optional: ByeDPI egress
 ```
 
-Installing from a signed feed instead:
+From the repo instead (§5 sets it up once), deps pull the rest in:
 
 ```sh
-# add the feed (customfeeds.conf / apk repositories), then:
-opkg update && opkg install shater-core luci-app-shater   # shaterd pulled in as a dep
+apk update && apk add luci-app-shater      # -> shater-core -> shaterd
 ```
 
 ## 4. Enable
@@ -148,102 +176,162 @@ install. Configure nodes/rules (via the LuCI panel or `uci`), then enable and ap
 
 ```sh
 uci set shater.globals.enabled=1
+# The safety net is NOT on by default — see below. 120 s is a window wide enough
+# to re-open SSH/LuCI and decide whether the new config is any good.
+uci set shater.globals.confirm_timeout=120
 uci commit shater
-shaterd apply        # apply + arm commit-confirm on the running daemon
-shaterd confirm      # confirm (cancels the auto-rollback)
+shaterd apply        # apply + arm the auto-rollback for 120 s
+shaterd confirm      # confirm inside that window (cancels the auto-rollback)
 ```
 
+> **Commit-confirm ships OFF.** `model.DefaultGlobals()` does not seed
+> `ConfirmTimeout`, the shipped `/etc/config/shater` carries
+> `option confirm_timeout '0'`, and `apply.ArmRollback` returns immediately on a
+> non-positive timeout — so on a stock box `shaterd apply` arms **nothing** and an
+> apply that costs you SSH/LuCI access simply stays. The daemon says so rather
+> than implying otherwise: the `commit-confirm-off` outcome of `shaterd apply`
+> prints *"globals.confirm_timeout is 0, so commit-confirm is switched OFF: this
+> apply armed NO automatic rollback"*, and the panel's Overview reads
+> `confirm: no auto-rollback`. Set a window (UCI as above, or Settings in the
+> panel) if you want the net. Non-obvious detail: the option is written back only
+> when non-zero, so an explicit `0` disappears from `/etc/config/shater` on the
+> first write — absent and `0` mean the same thing.
+
 `/etc/init.d/shater enable && /etc/init.d/shater start` brings up the procd-supervised
 daemon (`shaterd run`), which owns the engine, the `inet shater` data plane, policy
 routing, in-process DNS, and the admin panel (default `:8088`). The LuCI app's
 "Open panel" button mints a single-use token and hands the browser off to the panel.
 
-## 5. Add the signed feed (recommended — then `opkg upgrade` just works)
+### What enabling does to DNS
 
-CI (`.gitea/workflows/release.yml`) publishes every build as a **rolling `latest`
-Gitea release** that is itself a signed opkg `src/gz` feed: the release holds the
-`.ipk` for all arches, a `Packages`/`Packages.gz` index, a usign `Packages.sig`,
-and the public key `shater-feed.pub`. opkg filters by `Architecture`, so the **same
-two lines work on every device** (x86 testbed picks `x86_64 + all`; the BPI routers
-pick `aarch64_cortex-a53 + all`).
+From the first apply, **every** LAN plaintext `:53` goes into the engine — including
+the queries a client sends to the router's own address, which is what DHCP hands out.
+That is `globals.dns_intercept`, and it is **on by default** (D24); without it those
+queries reach dnsmasq and the ISP unfiltered, i.e. the client with default settings
+leaks while the one that hard-coded `8.8.8.8` does not. What follows from it:
 
-> **Format:** OpenWrt 24.10 (our SDK) uses **opkg** (`.ipk`, `Packages.gz`, usign),
-> so the feed is `src/gz` and the trust anchor is the usign key
-> `dist/shater-feed.pub` (fingerprint **`5ac4b177689cb8e0`**). apk only replaces
-> opkg at OpenWrt **25.12** — see §6.
+- `.lan` and private reverse (PTR) lookups still go to dnsmasq — the engine gets a
+  rule for those suffixes. If you renamed dnsmasq's domain away from `lan`, add a
+  `config dns_rule` for the new suffix.
+- Configure at least one `config resolver`. With none, the engine has no resolver
+  plane: intercepted queries fall through to the system resolver (dnsmasq → your
+  ISP, in the clear), blocklists and per-device DNS rules are inert, and the apply
+  says so in its warnings.
+- While the engine is DOWN, DNS is **not** blacked out: the fail-closed holding
+  plane hooks `forward` only, so dnsmasq keeps answering router-addressed `:53`
+  (unfiltered, plaintext) while client traffic and DNS to external resolvers stay
+  blocked. "The tunnel is down" is not "DNS is private".
 
-One-time setup on the router:
+To opt out, on the router:
 
 ```sh
-# 1) trust the feed key — the FILENAME must equal the usign key fingerprint.
-wget -O /etc/opkg/keys/5ac4b177689cb8e0 \
-  https://git.qomar.pw/omar/shater/releases/download/latest/shater-feed.pub
-
-# 2) add the feed (one URL serves every arch).
-echo "src/gz shater https://git.qomar.pw/omar/shater/releases/download/latest" \
-  >> /etc/opkg/customfeeds.conf
-
-# 3) refresh + install (shaterd is pulled in as a dependency).
-opkg update
-opkg install luci-app-shater        # -> shater-core -> shaterd
-opkg install byedpi                 # optional: ByeDPI desync egress
+uci set shater.globals.dns_intercept=0
+uci commit shater
+shaterd apply
 ```
 
-With the key installed, opkg's default `check_signature 1` verifies the feed on
-every `opkg update`; no `--nocheck-signature` needed. A **tagged** release
-(`vX.Y.Z`) publishes the identical layout at
-`.../releases/download/vX.Y.Z` if you prefer to pin a version instead of tracking
-`latest`.
+Your `0` is kept: `/etc/config/shater` is a conffile (upgrades never replace it) and
+the daemon always writes the option back explicitly, so it is never re-enabled by a
+default.
 
-### Updating
+### The boot-time fail-closed armor
 
-Name the packages. **Never run a bare `opkg upgrade`** — with no arguments it
-tries to upgrade *every* installed package from *every* configured feed, which on
-OpenWrt means base/system packages on the overlay and is a well-known way to
-brick a router.
+`shater-core` installs a **third** init script, `/etc/init.d/shater-armor`, and
+`30_shater-core` enables it at install time. It exists because `/etc/init.d/shater`
+is `START=99`: by then fw4 (19) has loaded `lan -> wan ACCEPT` and netifd (20) has
+brought the LAN bridge up, so between link-up and the daemon's first apply the
+router forwards LAN traffic to the WAN in the clear — on router hardware with a
+UPX-packed binary that is the seconds in which Wi-Fi associates and every client
+reconnects. `kill_switch=closed` covered none of it, because the protection lived
+inside a process that had not started.
 
-```sh
-opkg update
-opkg upgrade shaterd shater-core luci-app-shater byedpi   # only our own packages
+**How it works.** On every apply the daemon persists a copy of its fail-closed
+*holding plane* — the same ruleset it installs when the engine is down — to
+`/etc/shater/boot.nft`. `shater-armor` runs at `START=21` (after fw4 and netifd),
+validates that file with `nft -c` and loads it. When the daemon comes up it
+replaces the table atomically, so there is never a moment with no table. Its
+`stop()` is deliberately a no-op.
+
+**LAN forwarding is blocked until the daemon applies — management access is not.**
+The chain hooks `forward` only, so SSH, LuCI and the admin panel (all `input` hook,
+to the router's own addresses) stay reachable **on purpose**: a kill switch you
+cannot switch off is a brick. If you see the syslog line
+
+```
+fail-closed plane armed from /etc/shater/boot.nft: LAN->WAN forwarding is BLOCKED
+until shaterd applies. SSH, LuCI and the admin panel stay reachable.
 ```
 
-Drop `byedpi` from the list if you never installed it. An upgrade is offered only
-when the feed's `Version` differs from the installed one — that is exactly what
-bug B4 broke (v0.2.2…v0.2.6 all published as `0.2.0-r3`). Since then CI derives
-the version from the git tag on every build (§2.1), so there is nothing to bump
-by hand any more; check with:
+that is the mechanism working, not a fault.
 
-```sh
-opkg list-installed | grep -E 'shaterd|shater-core|luci-app-shater|byedpi'
-```
+**When it refuses to arm** — each is a state check made at boot, never a record of
+something that happened on the way down:
 
-## 6. apk feed (OpenWrt/ImmortalWrt 25.12+ — incl. BananaWRT 25.12-mtk-vendor)
+| Condition | Behaviour |
+|---|---|
+| `/etc/shater/boot.nft` absent | Nothing to do, silent. The file exists only while the last applied config was **both** `enabled=1` **and** `kill_switch=closed`; either being off removes it at the next apply, and an operator-typed `/etc/init.d/shater stop` removes it there and then. Powering off does **not** — and neither does the `stop` a package upgrade issues while the service stays enabled, so being replaced cannot leave the next boot unprotected. |
+| the file is empty, or fails `nft -c` | Refuses, logs an error — the LAN is unprotected until `shaterd` starts. |
+| `/usr/bin/shaterd` missing, or no `S??shater` symlink in `/etc/rc.d` | Refuses: nothing would ever come along to replace the block with a working data plane. This is what makes an uninstalled or disabled product safe regardless of what the file says. |
+| UCI is readable **and** says `globals.enabled` is not `1` | Removes `boot.nft` and does not arm. An **unreadable** UCI is not a refusal — that case is exactly why the armor is a file rather than a query. |
+| `nft` not installed | Refuses, logs an error. |
 
-OpenWrt/ImmortalWrt **25.12** replaces opkg with Alpine's **apk**: `.apk` files,
-a binary `packages.adb` index, EC (prime256v1) keys in `/etc/apk/keys/`, and
-effectively mandatory signatures (unsigned needs `--allow-untrusted`). The
-package **Makefiles are unchanged** — the SDK release decides the format.
+**Turning it off.** The durable off-states are the two the script itself asks
+about — `uci set shater.globals.enabled=0 && uci commit shater && shaterd apply`
+(the next apply removes `boot.nft`), or `/etc/init.d/shater disable`. A bare
+`/etc/init.d/shater stop` typed at the shell also removes the file, but it is not
+durable: `S99shater` is still linked, so procd starts the daemon again on the next
+boot. To remove just the armor and keep the stack: `/etc/init.d/shater-armor
+disable`.
 
-CI builds this lane **in parallel** with the opkg feed (same manual triggers:
-`v*` tag push or `workflow_dispatch`): the `build-apk` jobs in
-`.gitea/workflows/release.yml` compile the same 4 packages through the official
-**ImmortalWrt 25.12 SDK** (tarballs from
+## 5. The signed apk repo (the normal install path)
+
+OpenWrt/ImmortalWrt **25.12** packages with Alpine's **apk**: `.apk` files, a
+binary `packages.adb` index, EC (prime256v1) keys in `/etc/apk/keys/`, and
+effectively mandatory signatures (unsigned needs `--allow-untrusted`). This is
+the only format shater publishes — the `.ipk`/opkg lane was removed in 2026-07
+(`DECISIONS.md` D22); every device we serve is on 25.12 with apk-tools 3.
+
+CI (`v*` tag push or `workflow_dispatch`) compiles the 4 packages through the
+official **ImmortalWrt 25.12 SDK** (tarballs from
 `downloads.immortalwrt.org/releases/25.12.1/targets/{x86/64,mediatek/filogic}/`)
-and publish **one release per arch** — rolling `apk-latest-x86_64` /
-`apk-latest-aarch64_cortex-a53`, or `apk-vX.Y.Z-<arch>` for a tagged version.
-Per-arch (unlike the combined opkg release) because apk filenames carry no
-architecture and packages are fetched relative to the `packages.adb` URL.
+and publishes **one release per arch**: the rolling `apk-latest-x86_64` /
+`apk-latest-aarch64_cortex-a53`, plus `apk-vX.Y.Z-<arch>` on a tag. Per-arch
+because apk filenames carry no architecture and packages are fetched *relative to
+the `packages.adb` URL*, so one flat multi-arch release would collide.
 
-> **Key:** apk cannot use the usign key. The apk trust anchor is the separate EC
-> public key **`dist/shater-apk.pem`** (generated once by `ci/gen-apk-key.sh`;
-> private half lives ONLY in the Gitea secret **`KEY_APK`**, the apk analog of
-> `KEY_BUILD`). Never regenerate either key — that invalidates every deployed
-> router's trust. The usign identity `shater-feed.pub` keeps signing the
-> opkg/24.10 feed, untouched.
+> **Key:** the trust anchor is the EC public key **`dist/shater-apk.pem`**
+> (generated once by `ci/gen-apk-key.sh`; the private half lives ONLY in the
+> Gitea secret **`KEY_APK`**). Never regenerate it — that invalidates every
+> deployed router's trust.
 
-One-time setup on a 25.12 router (BananaWRT `25.12-mtk-vendor` on the BPI-R3
-mini, BPI-R4 on 25.12, or the future 25.12 VM — `/etc/apk/arch` picks the right
-per-arch release automatically):
+### 5.1 Rolling or pinned — pick the repo URL deliberately
+
+The repo line names an **index file**, and which one you name is the whole
+update policy:
+
+| Repo line points at | Behaviour | Cost |
+|---|---|---|
+| `apk-latest-<arch>/packages.adb` (**rolling**) | Every release run REPLACES this release's assets, so `apk update && apk upgrade <our packages>` always sees the newest build. Install once, never touch the file again. | You get whatever CI published last; there is no per-router pin. |
+| `apk-vX.Y.Z-<arch>/packages.adb` (**pinned**) | The router stays on exactly that build. `apk update` will never offer a newer shater. | `/etc/apk/repositories.d/shater.list` must be edited **by hand on every upgrade**, on every router. |
+
+`mini_router` is deliberately on a **pinned** URL — a considered choice, and the
+hand-edit per release is its price. Use rolling unless you specifically want to
+freeze a device.
+
+> The rolling release used to go stale silently: publishing was an either/or, so
+> tag runs wrote only `apk-vX.Y.Z-<arch>` and `apk-latest-<arch>` was last
+> refreshed on 2026-07-24 at `0.2.0` while v0.2.9/v0.2.10 shipped. A router on
+> the rolling URL kept getting a successful `apk update` with nothing new. Fixed
+> 2026-07-25: `release-apk` writes the rolling pointer on **every** run and then
+> reads the release back over the Gitea API, asserting it holds our three
+> tag-versioned packages at exactly the version just built and **no** leftover
+> asset at another version (two versions of one package in one index would let
+> apk choose instead of us).
+
+### 5.2 One-time setup on the router
+
+BananaWRT `25.12-mtk-vendor` on the BPI-R3 mini, OpenWrt 25.12 on the BPI-R4, or
+the testbed VM — `/etc/apk/arch` picks the right per-arch release automatically:
 
 ```sh
 # 1) trust the apk feed key (any *.pem filename under /etc/apk/keys works).
@@ -251,6 +339,7 @@ wget -O /etc/apk/keys/shater-apk.pem \
   "https://git.qomar.pw/omar/shater/releases/download/apk-latest-$(cat /etc/apk/arch)/shater-apk.pem"
 
 # 2) add the repo — the line points at the packages.adb INDEX FILE itself.
+#    (rolling; for a pinned router put apk-vX.Y.Z-$(cat /etc/apk/arch) here — §5.1)
 echo "https://git.qomar.pw/omar/shater/releases/download/apk-latest-$(cat /etc/apk/arch)/packages.adb" \
   > /etc/apk/repositories.d/shater.list
 
@@ -260,7 +349,7 @@ apk add luci-app-shater        # -> shater-core -> shaterd
 apk add byedpi                 # optional: ByeDPI desync egress
 ```
 
-### Updating
+### 5.3 Updating
 
 **Never run a bare `apk upgrade`.** With no arguments apk reconciles *every*
 installed package against *every* configured repository at once; on a router
@@ -286,9 +375,8 @@ Drop `byedpi` from either list if you never installed it. Check what you are on
 with `apk list -I shaterd shater-core luci-app-shater byedpi` — the version reads
 `0.2.7-r1` (§2.1: `PKG_VERSION-rPKG_RELEASE`, derived from the git tag by CI, so
 every build really is a new version; before that fix v0.2.2…v0.2.6 all published
-as `0.2.0-r3` and `apk update` offered nothing). Pin a version instead of tracking
-rolling by pointing the repo line at
-`.../download/apk-vX.Y.Z-$(cat /etc/apk/arch)/packages.adb`.
+as `0.2.0-r3` and `apk update` offered nothing). Rolling vs pinned repo URL —
+§5.1.
 
 ### BananaWRT `25.12-mtk-vendor` compatibility
 
@@ -298,8 +386,14 @@ The mtk-vendor channel (base: `SuperKali/immortalwrt-mt798x-rebase`, branch
 `downloads.immortalwrt.org/releases/25.12-SNAPSHOT` — so packages built with the
 vanilla ImmortalWrt 25.12 filogic SDK install cleanly; no SuperKali-special SDK
 is needed. We ship **no kmods** (shaterd is a static Go binary, byedpi plain C),
-so the vendor 6.6 kernel is irrelevant to our packages; the kmod *dependencies*
-of shater-core (`kmod-nft-tproxy`, `kmod-nft-socket`, plus `ip-full`) are
-already **baked into the BananaWRT mtk-vendor image** (verified in its
-`config.buildinfo`). On a self-built 25.12 image, make sure those kmods come
-from the image's own kernel build.
+so the vendor 6.6 kernel is irrelevant to our packages.
+
+What was actually checked in the BananaWRT mtk-vendor `config.buildinfo` is
+`kmod-nft-tproxy`, `kmod-nft-socket` and `ip-full` — those three are baked into
+the image. `shater-core` also depends on `kmod-tun`, `nftables-json` and
+`ca-bundle` (added later; see the annotated `DEPENDS` in
+`openwrt/shater-core/Makefile`), and **those were not part of that check**. They
+are ordinarily present on a stock image — apk will pull whatever is missing from
+the distfeeds — but if you install offline or from a slimmed image, verify them
+yourself. On a self-built 25.12 image, make sure the kmods come from the image's
+own kernel build.

docs-shater/PORTING.md

@@ -195,7 +195,7 @@ type Chain struct { Name string; Hops []string } // "group:<n>" | "node:<n>", L1
 type Egress struct { Name,Type,Interface,Target string } // interface|proxy|direct|block
 type Rule struct {
 	Name string; Enabled bool; Order int
-	Src []string; DstDomain,DstRuleset,DstIP []string; DstPort,Proto string
+	Src []string; DstRuleset []string; DstPort,Proto string // dst = ruleset only (v0.2 schema v2)
 	Target string // chain:|group:|node:|direct|block
 	Egress,Kill string
 	SchedEnabled bool; SchedDays []string; SchedStart,SchedEnd string; SchedUTCOffset int
@@ -251,16 +251,71 @@ Apply/rollback: `apSnapshot` (run→last-good, nft→last-good.nft, route marks)
 > v0.2: "restart engine only on change" → config-hash gate + Close+New box (no reload).
 
 ### uci.go — `/etc/config/shater` schema
-- `config globals`: enabled, loglevel, kill_switch, dns_mode, ipv6, fwmark_base, table_base, confirm_timeout, resolver_default, resolver_fallback, probe_url, probe_interval, schema_version, active_profile.
-- `config inbound`: name, enabled, type, network, tproxy_port(12345), listen, port, auth, user, pass, target_addr, target_port, target_network, tcp, udp, sniff.
+- `config globals` — the full option set, with the value used when the option is
+  ABSENT (the `model.DefaultGlobals` seed). Booleans are always written back as
+  `'1'`/`'0'` by `render.go`, so an explicit value never decays into the seed:
+
+  | option | default | meaning |
+  |---|---|---|
+  | `enabled` | `0` as shipped | master switch; `0` ⇒ `Reconcile` tears the stack down instead of applying |
+  | `loglevel` (alias `log_level`) | `warning` | engine + daemon level; `none/off/silent/disabled` ⇒ log disabled, unknown ⇒ `warn` + a validation warning |
+  | `log_syslog` / `log_file` / `log_persist` | `1` / `1` / `0` | operational log (`shater/logsink`): syslog, rotated file, and whether that file lives on flash instead of tmpfs |
+  | `log_max_kb` | `2048` | size cap of the log file, clamped to 128…8192; `0` = "use the default", not "off" |
+  | `kill_switch` | `closed` | `closed` = fail-closed (block on engine loss, incl. a holding plane when the engine never started); `open` = plain routing |
+  | `ipv6` | `1` | `0` drops LAN IPv6 in the forward chain instead of leaving it unproxied |
+  | `fwmark_base` / `table_base` | `0x2000` | reserved fwmark / routing-table bases (must not collide with fw4 or other apps) |
+  | `confirm_timeout` | `0` | seconds before an unconfirmed apply auto-rolls back; `0` = commit-confirm off |
+  | `resolver_default` / `resolver_fallback` / `endpoint_resolver` | unset | `config resolver` names: the DNS catch-all, its failover chain, and the bootstrap-direct server that resolves proxy endpoint DOMAINS |
+  | `probe_url` / `probe_interval` | engine defaults | the ONE instrument all health probing uses (D20 — there are no per-group overrides) |
+  | `panel_port` | `0` ⇒ `8088` | admin-panel HTTP port |
+  | `dns_filter` | `0` | master enable of the blocklist/allowlist filter (D15); needs at least one `config resolver` |
+  | `dns_intercept` | **`1`** | force ALL LAN plaintext `:53` into the engine, INCLUDING queries addressed to the router itself. See D24 for why this is the default, what preserves `.lan`, and what happens while the engine is down |
+  | `block_doh` | `0` | NXDOMAIN the known public DoH hostnames + the Firefox canary and reject `:443` to their IPs, so clients fall back to `:53` (which the engine catches) |
+  | `group_health` | `1` | OUR background group probing (the observatory). Does not touch sing-box's own urltest inside a group |
+  | `untunnelable` | `block` | policy for what TPROXY cannot carry (ICMP/IGMP/ESP/AH/GRE/SCTP): `block` \| `icmp` (echo out, rest dropped) \| `direct` (all out, bypassing the tunnel) |
+  | `l3_tunnel` | `0` | **opt-in**, UCI-only (the panel does not expose it). Opens the synthetic `l3-in` TUN so LAN ICMP is routed by the engine instead of dropped/forged; nft marks LAN `icmp`/`ipv6-icmp` with `fwmark_base+0x80` and a scoped `ip rule` sends it to table `table_base+8`. Absent option ⇒ OFF; only an explicit `1` opens it. See D25 and `ARCHITECTURE.md` §3a |
+  | `untunnelable_egress` | unset | **opt-in**, UCI-only. Names a `config egress`; everything the L3 block did not claim (ESP/AH, GRE, IGMP, SCTP, and ICMP when `l3_tunnel=0`) is stamped with that egress's OWN mark and routed out its device by the kernel — no new mark, no new table, engine not in the path. Empty ⇒ `untunnelable` above stays in sole charge (D26) |
+  | `geo_provider` | unset = auto | `sagernet` \| `loyalsoldier` \| `metacubex` \| `custom`; auto = country codes from SagerNet, everything else from Loyalsoldier |
+  | `geosite_url` / `geoip_url` | unset | `{category}` templates, honoured only when `geo_provider=custom` |
+  | `geosite_index_url` / `geoip_index_url` | unset | git-trees URLs used to SUGGEST categories in the panel; empty = no suggestions |
+  | `stats_backend` | `memory` | `off` (no aggregation at all) \| `memory` (RAM, lost on restart) \| `sqlite` (aggregates in RAM + query/connection log on disk). The value NAME is historical: the on-disk store is **bbolt**, not SQLite, since the migration — a leftover sqlite-era `stats.db` is detected by its file magic and replaced (`shater/stats/boltring.go`) |
+  | `stats_ring_size` / `stats_timeline_minutes` / `stats_max_domains` | `200` / `60` / `5000` | live-log length, sparkline minutes, domain-map cap. **`0` = UNLIMITED** (grows with traffic), which is why these three are always emitted |
+  | `stats_disk_limit_mb` | `64` | on-disk cap of `stats.db`; only meaningful for `stats_backend=sqlite`; `0` = unlimited |
+  | `stats_retention_disabled` | `0` | master switch that turns OFF all trimming/pruning — every aggregate then grows unbounded |
+  | `schema_version` | `0` = pre-versioned | UCI schema revision; `shaterd migrate` writes `2` |
+  | `active_profile` | unset | display bookkeeping: the last profile switched to |
+
+  Deleted options still parse (unknown keys are ignored) and drain out on the next
+  render: `dns_mode` (D17 — fake-IP is a resolver TYPE), `sweep_interval` (D19).
+- `config inbound`: name, enabled, type, network, tproxy_port(12345), listen, port, auth, user, pass, target_addr, target_port, target_network, tcp, udp.
+  **No `sniff`.** Since sing-box 1.11 sniffing is a leading route ACTION rule with no
+  inbound matcher, so every inbound is sniffed always; the flag was read by nothing but
+  its own UCI round-trip. Re-adding it would be a regression, not a restored feature —
+  the hijack-dns rule matches the SNIFFED `dns` protocol, so a per-inbound toggle is a
+  DNS-leak switch wearing a performance label (`model.go`, `Inbound`).
 - `config subscription`: name, enabled, url, update_interval, fetch_via(direct|proxy), ua, hwid, device_os, ver_os, device_model, list header, format, list include/exclude/filter_proto/filter_country, dedup, expire_alert_days.
 - `config node`: name, enabled, uri, mux, mux_concurrency, xudp_concurrency, xudp_udp443, sockopt_mark, tcp_fast_open, tcp_keepalive_idle.
 - `config group`: name, source, subscription, list node, strategy, include/exclude/filter_proto/filter_country, dedup, probe_url, probe_interval.
 - `config chain`: name, list hop.  `config egress`: name, type, interface, target.
-- `config ruleset`: name, type(domain|ipcidr), source(inline|file|url), url, path, format, update_interval, list entry.
-- `config rule`: name, enabled, order, list src/dst_domain/dst_ruleset/dst_ip, dst_port, proto, target, egress, kill, sched_enabled, list sched_day, sched_start/end/tz.
-- `config preset`: name, enabled, order, target.  `config profile`: name, enabled, priority, list match_iface, probe_url, probe_mode, sched_*, list enable_rule/disable_rule, default_target, default_egress.
+- `config ruleset`: name, type(domain|ipcidr), source(inline|file|url|geosite|geoip), url, path, format, update_interval, list category, list entry.
+- `config rule`: name, enabled, order, list src, list dst_ruleset, dst_port, proto, target, egress, kill, sched_enabled, list sched_day, sched_start/end, sched_utc_offset.
+  v0.1 carried `dst_domain`/`dst_ip` on the rule itself; **schema v2 removed both** — a
+  destination is a `config ruleset` and nothing else. `shaterd migrate` folds each legacy
+  list into a generated `rule-<name>` (and `rule-<name>-ip`) inline ruleset; see
+  `DECISIONS.md` D21 for the entry-by-entry conversion table.
+- `config profile`: name, enabled, priority, list match_iface, probe_url, probe_mode, sched_*, list enable_rule/disable_rule, default_target, default_egress.
 - `config resolver`: name, type, address, detour, pool.  `config dns_rule`: order, list match_domain/match_src, resolver.
+- `config blocklist`: name, enabled, source(inline|file|url|geosite), url, path, list category, list entry, response(nxdomain), update_interval.
+- `config allowlist`: the same minus `response` (an allowlist has no verdict to render); it overrides every blocklist.
+- `config device`: name, mac, ip, enabled, list block, list allow.
+- `config alert`: name, enabled, type(telegram), token, chat_id, url, list event, via, fallback.
+- **`config preset` is NOT a section type.** `ReadUCI`'s type switch has no `preset`
+  branch, so such a section is parsed by nothing and reaches no part of the model.
+  It survives only because `30_shater-core` still seeds three of them
+  (`block_ads`, `ru_bypass`, `private`) with the comment "so the LuCI Rules page
+  renders their toggles" — and v0.2's LuCI app is a thin launcher with no Rules
+  page. Those `uci set` calls should be dropped from the uci-defaults script; until
+  they are, three inert sections appear in every fresh `/etc/config/shater`.
 
 ### Subscriptions & HAPP fetch
 Schemes: `vless:// vmess:// trojan:// ss:// wireguard:// wg://`. Body formats (`DetectSubFormat`): clash-YAML, xray-JSON, singbox-JSON, base64/plain link list. All converge to URIs re-parsed by `ParseShareLink`. HAPP fetch: UA default `Happ/3.13.0`; headers `x-hwid` (auto UUIDv4/sub), `x-device-os`, `x-ver-os`, `x-device-model`, custom. `fetch_via=proxy` dials local socks. Quota/expiry from `Subscription-Userinfo` (`upload;download;total;expire`). Reconcile by `Fingerprint` (sha256 of proto|addr|port|id|net|sec|sni|path) → new/keep/stale (drop after 3 stale refreshes).
@@ -268,10 +323,11 @@ Schemes: `vless:// vmess:// trojan:// ss:// wireguard:// wg://`. Body formats (`
 ---
 
 ## PART B — v0.1 packaging (`shater-core/`, branch `v0.1`)
-Pure scripts+config, `PKGARCH:=all`. v0.1 DEPENDS: `+xrayctl +xray-core +dnsmasq-full +kmod-nft-tproxy +kmod-nft-socket +ip-full`. → **v0.2 deps: `+shaterd +kmod-nft-tproxy +kmod-nft-socket +ip-full`** (engine does DNS in-process, so dnsmasq-full may be droppable — confirm the :53 listener is our engine). `/etc/config/shater` is a conffile.
+Pure scripts+config, `PKGARCH:=all`. v0.1 DEPENDS: `+xrayctl +xray-core +dnsmasq-full +kmod-nft-tproxy +kmod-nft-socket +ip-full`. → **v0.2 deps (authoritative: `openwrt/shater-core/Makefile`, which annotates each one): `+shaterd +kmod-nft-tproxy +kmod-nft-socket +kmod-tun +ip-full +nftables-json +ca-bundle`** — `dnsmasq-full` is gone (the engine owns the `:53` hijack listener); `kmod-tun` is `/dev/net/tun` for the L3 ingress, `nftables-json` is the `nft -j` output `netplane/stats.go` parses, `ca-bundle` is the cert store a `CGO_ENABLED=0` binary has no host fallback for. `/etc/config/shater` is a conffile.
 - **init.d/shater** (procd, START=99/STOP=10): v0.1 supervised `xray run -c /etc/xray/run.json`; → v0.2 supervises `shaterd`. `respawn 3600 5 0` (infinite). **No `procd_set_param file` watch** (would bounce tunnel on commit). Inert unless `globals.enabled=1`. `ACTIVE_FLAG=/var/run/shater.active` gates hotplug/cron. `stop` clears flag + tears down nft table + reserved routing tables. `reload_service`→start/stop. trigger `procd_add_reload_trigger "shater"`.
 - **init.d/shater-cron** (START=96): supervised `loop`; per-item due-check, runs sub/ruleset update + reconcile + schedule due; watchdog: engine dead 5 ticks ⇒ kill_switch=open stops stack (fail-open), closed logs crit.
-- **uci-defaults/30_shater-core**: seed `rt_tables` (8192 shater), enable both inits, seed preset packs (disabled), run migrate, apply sysctl.
+- **init.d/shater-armor** (START=21/STOP=89, v0.2-only — no v0.1 counterpart): the fail-closed plane BEFORE the daemon exists. `/etc/init.d/shater` is START=99, so from netifd's `ifup` until the daemon's first apply the router forwarded LAN→WAN in the clear. The daemon persists its holding plane to `/etc/shater/boot.nft` on every apply; this loads it after fw4 (19) and netifd (20), `nft -c`-validated. Four state checks refuse to arm (no/empty/invalid file, missing `shaterd`, no `S??shater` rc-link, readable UCI saying `enabled≠1`) — asked ON THE WAY UP, deliberately not recorded on the way down. Hooks `forward` only, so SSH/LuCI/panel stay reachable. `stop()` is a NO-OP. Operator-facing writeup: `INSTALL.md` §4.
+- **uci-defaults/30_shater-core**: seed `rt_tables` (8192 shater), `mkdir /etc/shater`, seed the `shater_l3` fw4 zone + `lan→shater_l3` forwarding (named sections, `list device 'shater-l3*'`) and migrate a legacy exact-name entry to the wildcard, run `shaterd migrate`, apply sysctl, then a DETACHED bring-up (enable+restart `shater`/`shater-cron`, enable `shater-armor`, conditional `firewall reload`) — detached because an inline init call inside an apk/opkg transaction deadlocks on procd's flock. Also still seeds three `config preset` sections, which nothing parses (see the schema note above); those calls should go.
 - **hotplug.d/iface/99-shater**: ifup/ifdown → debounced (2s) `reconcile` (netifd wipes ip rules on reload). Guarded by enabled + ACTIVE_FLAG.
 - **sysctl.d/99-shater.conf**: `ip_forward=1`, `rp_filter=0` (all+default), `lo.route_localnet=1`, `lo.accept_local=1`, `all.src_valid_mark=1`, `ipv6.all.forwarding=1`.
 

docs-shater/README.md

@@ -6,7 +6,7 @@ OpenWrt). Лицо репозитория и быстрый старт — в к
 | Документ | О чём |
 |----------|-------|
 | [CONTEXT.md](CONTEXT.md) | **Начните здесь** — контекст проекта, история v0.1→v0.2, решения в кратце, testbed/инфра |
-| [INSTALL.md](INSTALL.md) | Сборка ship-артефакта (`shaterd`) и установка обоих фидов — opkg (24.10) и apk (25.12+) |
+| [INSTALL.md](INSTALL.md) | Сборка ship-артефакта (`shaterd`) и установка apk-фида (25.12+): роллинг или фиксация версии |
 | [ARCHITECTURE.md](ARCHITECTURE.md) | One-binary дизайн, auth-handoff LuCI→панель, data/DNS/apply-потоки (диаграммы) |
 | [FEATURES.md](FEATURES.md) | Полный список фич с тегами MVP/T1/T2 |
 | [ROADMAP.md](ROADMAP.md) | Фазовый план |

docs-shater/ROADMAP.md

@@ -49,7 +49,7 @@ build new logic in the `shater/`, `panel/`, `openwrt/` overlay.
   the gate: fail-closed forward drop (4f618140), engine apply-swap close-first
   fallback (9b6b9406), DNS hijack-dns per D14 (86194ce6).
 
-## Phase 2b — DPI-bypass egress = ByeDPI (D13)
+## Phase 2b — DPI-bypass egress = ByeDPI (D13)  ✅ DONE
 - The one external desync tool is **ByeDPI (ciadpi)** — chosen over zapret because
   it *is* a SOCKS egress (fits shater's "routing picks the egress" model with zero
   packet-plane conflict); zapret is explicitly rejected (see D13).
@@ -86,7 +86,7 @@ build new logic in the `shater/`, `panel/`, `openwrt/` overlay.
   well-known lists (StevenBlack/OISD/AdGuard).
 - **Gate:** ad/tracker domains blocked network-wide; big list loads fast; RAM sane.
 
-## Phase 5 — Statistics (per-domain / client / device)
+## Phase 5 — Statistics (per-domain / client / device)  ✅ DONE
 - Stats aggregator consuming the engine's DNS/routing/stats observability + nft
   counters: top domains, allowed vs blocked, per-device breakdown, timelines,
   per-node/per-rule traffic, live query log with one-click block.
@@ -104,7 +104,7 @@ build new logic in the `shater/`, `panel/`, `openwrt/` overlay.
 
 ## Phase 8 — Ship it  ✅ DONE
 - Adapt CI to build/sign the single forked binary for both arches; publish the
-  signed opkg feed (reuse key `5ac4b177689cb8e0`); install/upgrade docs.
+  signed feed (apk since D22, EC key `dist/shater-apk.pem`); install/upgrade docs.
 - Set an upstream-rebase cadence (merge new sing-box-lx tags, run the smoke suite).
 
 ## Cross-cutting (every phase)

go.mod

@@ -46,7 +46,7 @@ require (
 	github.com/sagernet/sing v0.8.12-0.20260702081104-2ded2af32d3d
 	github.com/sagernet/sing-cloudflared v0.1.3-0.20260706062323-d9787e794aa3
 	github.com/sagernet/sing-mux v0.3.5
-	github.com/sagernet/sing-quic v0.6.2-0.20260525051024-9467ede27fb7
+	github.com/sagernet/sing-quic v0.6.4-0.20260709034545-e23afe1172dc
 	github.com/sagernet/sing-shadowsocks v0.2.8
 	github.com/sagernet/sing-shadowsocks2 v0.2.1
 	github.com/sagernet/sing-shadowtls v0.2.1
@@ -104,14 +104,20 @@ require (
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/gopacket v1.1.19 // indirect
 	github.com/google/nftables v0.2.1-0.20240414091927-5e242ec57806 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/hashicorp/yamux v0.1.2 // indirect
 	github.com/hdevalence/ed25519consensus v0.2.0 // indirect
+	github.com/huin/goupnp v1.2.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/koron/go-ssdp v0.0.4 // indirect
 	github.com/kr/fs v0.1.0 // indirect
+	github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138 // indirect
+	github.com/libp2p/go-netroute v0.2.1 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect

go.sum

@@ -101,6 +101,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
+github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
 github.com/google/nftables v0.2.1-0.20240414091927-5e242ec57806 h1:wG8RYIyctLhdFk6Vl1yPGtSRtwGpVkWyZww1OCil2MI=
 github.com/google/nftables v0.2.1-0.20240414091927-5e242ec57806/go.mod h1:Beg6V6zZ3oEn0JuiUQ4wqwuyqqzasOltcoXPtgLbFp4=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -109,10 +111,14 @@ github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8
 github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
 github.com/hdevalence/ed25519consensus v0.2.0 h1:37ICyZqdyj0lAZ8P4D1d1id3HqbbG1N3iBb1Tb4rdcU=
 github.com/hdevalence/ed25519consensus v0.2.0/go.mod h1:w3BHWjwJbFU29IRHL1Iqkw3sus+7FctEyM4RqDxYNzo=
+github.com/huin/goupnp v1.2.0 h1:uOKW26NG1hsSSbXIZ1IR7XP9Gjd1U8pnLaCMgntmkmY=
+github.com/huin/goupnp v1.2.0/go.mod h1:gnGPsThkYa7bFi/KWmEysQRf48l2dvR5bxr2OFckNX8=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/insomniacslk/dhcp v0.0.0-20260220084031-5adc3eb26f91 h1:u9i04mGE3iliBh0EFuWaKsmcwrLacqGmq1G3XoaM7gY=
 github.com/insomniacslk/dhcp v0.0.0-20260220084031-5adc3eb26f91/go.mod h1:qfvBmyDNp+/liLEYWRvqny/PEz9hGe2Dz833eXILSmo=
+github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7BdWus=
+github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jsimonetti/rtnetlink v1.4.0 h1:Z1BF0fRgcETPEa0Kt0MRk3yV5+kF1FWTni6KUFKrq2I=
 github.com/jsimonetti/rtnetlink v1.4.0/go.mod h1:5W1jDvWdnthFJ7fxYX1GMK07BUpI4oskfOqvPteYS6E=
@@ -122,6 +128,8 @@ github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zt
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0=
+github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoKtbmZk=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
@@ -138,6 +146,10 @@ github.com/libdns/cloudflare v0.2.2 h1:XWHv+C1dDcApqazlh08Q6pjytYLgR2a+Y3xrXFu0v
 github.com/libdns/cloudflare v0.2.2/go.mod h1:w9uTmRCDlAoafAsTPnn2nJ0XHK/eaUMh86DUk8BWi60=
 github.com/libdns/libdns v1.1.1 h1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS/P/U=
 github.com/libdns/libdns v1.1.1/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
+github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138 h1:YohuNPT/1k3VcThCQlBZ43PCPWPfMRS1zcxWBF2SLK8=
+github.com/libp2p/go-nat v1.0.1-0.20250821073202-01afc089f138/go.mod h1:TXQg5tfSy+bUjnhT5728j5j/MBj7keIYqqZ1+8k/ui8=
+github.com/libp2p/go-netroute v0.2.1 h1:V8kVrpD8GK0Riv15/7VN6RbUQ3URNZVosw7H2v9tksU=
+github.com/libp2p/go-netroute v0.2.1/go.mod h1:hraioZr0fhBjG0ZRXJJ6Zj2IVEVNx6tDTFQfSmcq7mQ=
 github.com/logrusorgru/aurora v2.0.3+incompatible h1:tOpm7WcpBTn4fjmVfgpQq0EfczGlG91VSDkswnjF5A8=
 github.com/logrusorgru/aurora v2.0.3+incompatible/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
 github.com/mdlayher/netlink v1.9.0 h1:G8+GLq2x3v4D4MVIqDdNUhTUC7TKiCy/6MDkmItfKco=
@@ -264,8 +276,8 @@ github.com/sagernet/sing-cloudflared v0.1.3-0.20260706062323-d9787e794aa3 h1:3y6
 github.com/sagernet/sing-cloudflared v0.1.3-0.20260706062323-d9787e794aa3/go.mod h1:XEqEDYRCAYLaoPjZ1ifVWJg5iWAJHL2gOAXe/PM28Cg=
 github.com/sagernet/sing-mux v0.3.5 h1:RHnhVEc+SFqkrK4xMygYjDwwLhzp2Bj3lztSukONfhI=
 github.com/sagernet/sing-mux v0.3.5/go.mod h1:QvlKMyNBNrQoyX4x+gq028uPbLM2XeRpWtDsWBJbFSk=
-github.com/sagernet/sing-quic v0.6.2-0.20260525051024-9467ede27fb7 h1:hFLPJ21uNZSbRnzhOKz4Zv0b4F93mpDorWyN93BeRcM=
-github.com/sagernet/sing-quic v0.6.2-0.20260525051024-9467ede27fb7/go.mod h1:+oqD54aHel4ALKkp1hVXWCgLU/EjLojvm6AUzDfvj0I=
+github.com/sagernet/sing-quic v0.6.4-0.20260709034545-e23afe1172dc h1:zdc0fj4JdAdgAmQIoh7ZF+B/wPTEF2X75lYDqTmvlaw=
+github.com/sagernet/sing-quic v0.6.4-0.20260709034545-e23afe1172dc/go.mod h1:9k+dzGsWMttUGldBzq3dU792YHXzW6NgfbOGltnXq+0=
 github.com/sagernet/sing-shadowsocks v0.2.8 h1:PURj5PRoAkqeHh2ZW205RWzN9E9RtKCVCzByXruQWfE=
 github.com/sagernet/sing-shadowsocks v0.2.8/go.mod h1:lo7TWEMDcN5/h5B8S0ew+r78ZODn6SwVaFhvB6H+PTI=
 github.com/sagernet/sing-shadowsocks2 v0.2.1 h1:dWV9OXCeFPuYGHb6IRqlSptVnSzOelnqqs2gQ2/Qioo=
@@ -360,6 +372,8 @@ go4.org/mem v0.0.0-20240501181205-ae6ca9944745 h1:Tl++JLUCe4sxGu8cTpDzRLd3tN7US4
 go4.org/mem v0.0.0-20240501181205-ae6ca9944745/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
 golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
 golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
@@ -367,17 +381,24 @@ golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 h1:fQsdNF2N+/YewlRZiricy4P1i
 golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
 golang.org/x/image v0.27.0 h1:C8gA4oWU/tKkdCfYT6T2u4faJu3MeNS5O8UPWlPF61w=
 golang.org/x/image v0.27.0/go.mod h1:xbdrClrAUway1MUTEZDq9mz/UpRwYAkFFNUslZtcB+g=
+golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
 golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
 golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
 golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
 golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -389,6 +410,7 @@ golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
 golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
@@ -396,8 +418,10 @@ golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
 golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
 golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
 golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

openwrt/byedpi/Makefile

@@ -21,8 +21,8 @@ PKG_NAME:=byedpi
 # ci/version.sh). PKG_VERSION here is THIRD-PARTY UPSTREAM's version — it is what
 # PKG_SOURCE_URL/PKG_HASH pin, and what tells an operator which ByeDPI is
 # actually installed. Stamping our tag on it would be both a lie and a
-# regression: our tags are 0.2.x, and every version comparator (apk-tools 3 and
-# opkg alike, verified) reads 0.2.7 < 0.17.3 — component-wise numerically, 2 < 17
+# regression: our tags are 0.2.x, and the version comparator (apk-tools 3,
+# verified) reads 0.2.7 < 0.17.3 — component-wise numerically, 2 < 17
 # — so the "new" package would be a DOWNGRADE and routers would refuse it.
 # Bump PKG_RELEASE BY HAND when *our packaging* of it changes (init script, uci
 # defaults, build flags); bump PKG_VERSION+PKG_HASH when upstream releases.

openwrt/luci-app-shater/htdocs/luci-static/resources/view/shater/dashboard.js

@@ -26,15 +26,32 @@ var callMintToken = rpc.declare({
 	expect: { '': {} }
 });
 
-// led renders a small status dot: state is 'good' | 'warn' | 'bad'.
+// LED palette. 'unknown' is an UNLIT socket — never amber and never green.
+// Amber is this page's "degraded", and there is nothing to be degraded about
+// when no reading has arrived; green on a missing reading is how the panel used
+// to claim health it had not measured (see panel/src/planeState.ts, which says
+// the same thing and is the wording this page is kept in step with).
+var LED_COLORS = {
+	good: '#37b24d',
+	warn: '#f59f00',
+	bad: '#e03131',
+	unknown: '#6b6b6b'
+};
+
+// led renders a small status dot: state is 'good' | 'warn' | 'bad' | 'unknown'.
+// The dot is decorative — every row states its condition in words beside it — so
+// it is hidden from assistive tech rather than being the only carrier of meaning.
 function led(state) {
-	var color = state === 'good' ? '#37b24d'
-		: state === 'warn' ? '#f59f00'
-		: '#e03131';
+	// Closed positive list. An unrecognised state resolves to UNKNOWN, never to
+	// green: an open default here is exactly how a state nobody thought about
+	// ends up painted healthy.
+	var color = Object.prototype.hasOwnProperty.call(LED_COLORS, state)
+		? LED_COLORS[state] : LED_COLORS.unknown;
+	var glow = (color === LED_COLORS.unknown) ? '' : ';box-shadow:0 0 5px ' + color;
 	return E('span', {
+		'aria-hidden': 'true',
 		'style': 'display:inline-block;width:.72em;height:.72em;border-radius:50%;' +
-			'margin-right:.6em;vertical-align:-.05em;background:' + color +
-			';box-shadow:0 0 5px ' + color
+			'margin-right:.6em;vertical-align:-.05em;background:' + color + glow
 	});
 }
 
@@ -49,63 +66,251 @@ function row(state, label, value) {
 	]);
 }
 
-// statusRows maps the shaterd status object to LED rows. An empty object (the
-// ubus call failed / daemon down) degrades every row to a "down" reading.
-function statusRows(st) {
-	st = st || {};
-	var down = (st.running !== true);
+// ---------------------------------------------------------------------------
+// Pure state derivation — no DOM below this line until statusRows().
+//
+// statusReadout() maps a shaterd status object to a list of
+// { state, label, value } descriptors. It is deliberately free of E()/DOM so it
+// can be run against recorded fixtures offline; tests/status-readout.test.js
+// does exactly that for the three cases this page has to tell apart.
+// ---------------------------------------------------------------------------
 
+// PLANES is the closed set of values a LIVE Applier.Status() can put in `plane`
+// (shater/apply/apply.go: "full" | "hold" | "none"). It is also how this page
+// tells a live daemon from a dead one — see daemonState().
+var PLANES = { full: true, hold: true, none: true };
+
+// daemonState — is the shaterd PROCESS answering?
+//
+//   'up'      — a live Applier produced this status.
+//   'down'    — proven not: `shaterd status` printed its OFFLINE STUB.
+//   'unknown' — no usable answer, or an answer from a daemon older than `plane`.
+//
+// `running` MUST NOT be used for this. It changed meaning on 2026-07-26
+// (a8970b8ac): it used to be a hardcoded true, and is now the ENGINE's liveness
+// (apply.go `Running: engineUp`). A daemon that is perfectly alive with a dead
+// engine reports running=false — and this page used to answer that with a red
+// "Daemon: not running", the advice "start the Shater service first", and a
+// DISABLED button to the one place the config can be fixed. The holding plane
+// keeps management reachable on purpose (shater/netplane/nft.go); LuCI was the
+// only thing taking that guarantee away.
+//
+// Nor is "the ubus call returned" sufficient, which is the trap here: the rpcd
+// plugin shells out to `shaterd status`, and that command EXITS 0 WITH A
+// FABRICATED STATUS when the daemon is unreachable (cmd/shaterd/main.go,
+// cmdStatus offline stub). The stub is the apply.Status zero value plus a UCI
+// read, so it carries enabled/table/kill_switch/panel_port but leaves `plane` at
+// "" — a value no live daemon ever emits, because Status() always assigns one of
+// the three words. So a known plane word is the one positive proof on the wire
+// that a daemon answered, and an explicit empty one is positive proof that none
+// did.
+//
+// Everything else is unknown and is painted as unknown: {} from a failed ubus
+// call, {"error":...} from the plugin (which is ALSO what a live-but-wedged
+// daemon produces — cmdStatus prints nothing and exits 1 on a control-socket
+// timeout, so "wedged" must not be reported as "dead"), and a status from a
+// daemon predating the `plane` field.
+function daemonState(st) {
+	if (!st || typeof st !== 'object')
+		return 'unknown';
+	if (typeof st.plane === 'string' && PLANES[st.plane] === true)
+		return 'up';
+	if (st.plane === '')
+		return 'down';
+	return 'unknown';
+}
+
+// engineState — is a sing-box instance actually started?
+//
+// The engine lives INSIDE the shaterd process, so a dead daemon is a dead engine
+// and this page may say so without guessing. With the daemon up, `engine_running`
+// is the self-documenting field and `running` carries the same fact by
+// construction; either may prove a NEGATIVE, and a negative always wins. Neither
+// asserting anything leaves 'unknown'.
+function engineState(st) {
+	var d = daemonState(st);
+	if (d === 'down')
+		return 'down';
+	if (d === 'unknown')
+		return 'unknown';
+	if (st.running === false || st.engine_running === false)
+		return 'down';
+	if (st.running === true || st.engine_running === true)
+		return 'up';
+	return 'unknown';
+}
+
+function mk(state, label, value) {
+	return { state: state, label: label, value: value };
+}
+
+function statusReadout(st) {
+	st = (st && typeof st === 'object') ? st : {};
+
+	var dstate = daemonState(st);
+	var estate = engineState(st);
+	var traffic = (st.traffic && typeof st.traffic === 'object') ? st.traffic : {};
 	var rows = [];
 
-	// Daemon process itself.
-	rows.push(row(
-		down ? 'bad' : 'good',
-		_('Daemon (shaterd)'),
-		down ? _('not running') : _('running')
-	));
+	// --- The shaterd process itself. ------------------------------------------
+	// Its own liveness is not a field; it is whether a live daemon answered.
+	if (dstate === 'up')
+		rows.push(mk('good', _('Daemon (shaterd)'), _('responding')));
+	else if (dstate === 'down')
+		rows.push(mk('bad', _('Daemon (shaterd)'),
+			_('not responding — start the Shater service')));
+	else
+		rows.push(mk('unknown', _('Daemon (shaterd)'),
+			_('no usable answer — state unknown')));
 
-	// Desired state: globals.enabled in UCI.
-	rows.push(row(
-		st.enabled ? 'good' : 'warn',
-		_('Service enabled'),
-		st.enabled ? _('enabled') : _('inert (disabled)')
-	));
+	// --- The engine (sing-box) inside it. -------------------------------------
+	if (estate === 'up')
+		rows.push(mk('good', _('Engine (sing-box)'), _('running')));
+	else if (estate === 'down' && dstate === 'down')
+		rows.push(mk('bad', _('Engine (sing-box)'),
+			_('stopped — it runs inside shaterd, which is not answering')));
+	else if (estate === 'down')
+		rows.push(mk('bad', _('Engine (sing-box)'),
+			_('stopped — the daemon is up but no instance is running')));
+	else
+		rows.push(mk('unknown', _('Engine (sing-box)'), _('not reported')));
 
-	// Interception raised (ACTIVE_FLAG present after a successful enabled apply).
-	rows.push(row(
-		st.active ? 'good' : (st.enabled ? 'warn' : 'bad'),
-		_('Interception'),
-		st.active ? _('active') : _('inactive')
-	));
+	// --- Desired state: globals.enabled in UCI. -------------------------------
+	if (st.enabled === true)
+		rows.push(mk('good', _('Service enabled'), _('enabled')));
+	else if (st.enabled === false)
+		rows.push(mk('warn', _('Service enabled'), _('inert (disabled)')));
+	else
+		rows.push(mk('unknown', _('Service enabled'), _('not reported')));
 
-	// Data plane: the `inet shater` nft table is loaded.
-	rows.push(row(
-		st.table ? 'good' : (st.enabled ? 'warn' : 'bad'),
-		_('Data plane'),
-		st.table ? _('nft table inet shater loaded') : _('not loaded')
-	));
+	// --- The ACTIVE_FLAG latch. -----------------------------------------------
+	// NOT a health signal, and this row must never read as one. apply.go states
+	// the contract: it is the "the service is meant to be running" latch that
+	// gates hotplug and cron; it is raised by a successful enabled apply and
+	// cleared only by teardown, so it STAYS UP while the engine is down and the
+	// fail-closed holding plane is blocking the LAN — deliberately, because
+	// clearing it would switch off the very cron reconcile that brings the engine
+	// back. This page used to render it as "Interception: active", in green, over
+	// a dead engine and a blocked LAN. The lamp now reports only whether the
+	// latch AGREES with globals.enabled.
+	if (typeof st.active !== 'boolean')
+		rows.push(mk('unknown', _('Service latch'), _('not reported')));
+	else if (st.active)
+		rows.push(mk(st.enabled === true ? 'good' : 'warn', _('Service latch'),
+			_('raised — the service is meant to be running')));
+	else
+		rows.push(mk(st.enabled === false ? 'good' : 'warn', _('Service latch'),
+			_('cleared — the service is torn down')));
 
-	// Kill-switch: fail-closed ("closed") is the safe posture; "open" leaks
-	// LAN→WAN if the engine goes down. Unknown (older daemon) degrades to warn.
-	var ks = st.kill_switch;
-	rows.push(row(
-		ks === 'closed' ? 'good' : 'warn',
-		_('Kill-switch'),
-		ks === 'closed' ? _('closed (fail-closed)')
-			: ks === 'open' ? _('open (leaky)')
-			: _('unknown')
-	));
+	// --- What is loaded in the kernel right now. ------------------------------
+	// The row this page was missing. `plane` distinguishes the working ruleset
+	// from the FAIL-CLOSED HOLDING PLANE, which `table` cannot: `table` is a bare
+	// existence check, so a held LAN and a working one look identical through it.
+	switch (st.plane) {
+	case 'full':
+		// Deliberately mechanical wording. "full" means the table, the policy
+		// routing and the engine are all in place — it does NOT mean traffic is
+		// tunnelled. That claim belongs to the traffic verdict below.
+		rows.push(mk('good', _('Traffic plane'),
+			_('full — ruleset, routing and engine are all installed')));
+		break;
+	case 'hold':
+		rows.push(mk('bad', _('Traffic plane'),
+			_('hold — the engine is down and LAN→WAN forwarding is BLOCKED')));
+		break;
+	case 'none':
+		rows.push(mk(st.kill_switch === 'closed' ? 'bad' : 'warn', _('Traffic plane'),
+			st.kill_switch === 'closed'
+				? _('none — nothing is installed; traffic reaches the WAN unprotected')
+				: _('none — no data plane is installed')));
+		break;
+	default:
+		rows.push(mk('unknown', _('Traffic plane'),
+			dstate === 'down'
+				? _('not reported — no daemon answered')
+				: _('not reported by this daemon')));
+		break;
+	}
 
-	// Running engine config hash ("" when the engine is not started).
-	rows.push(row(
-		st.hash ? 'good' : 'warn',
-		_('Config hash'),
-		st.hash ? st.hash : '—'
-	));
+	// --- Where the traffic goes under the running config. ---------------------
+	// Separate from the plane on purpose: a router with one `default -> direct`
+	// rule has a fully installed plane and sends every packet out the plain WAN
+	// with its real address.
+	switch (traffic.verdict) {
+	case 'tunnel':
+		rows.push(mk('good', _('Traffic verdict'), _('tunnel — unmatched traffic is proxied')));
+		break;
+	case 'split':
+		rows.push(mk('warn', _('Traffic verdict'),
+			_('split — the default leaves directly; only matched rules are tunnelled')));
+		break;
+	case 'direct':
+		rows.push(mk('warn', _('Traffic verdict'),
+			_('direct — nothing is tunnelled; traffic leaves over the plain WAN')));
+		break;
+	case 'blocked':
+		rows.push(mk('warn', _('Traffic verdict'), _('blocked — unmatched traffic is dropped')));
+		break;
+	default:
+		rows.push(mk('unknown', _('Traffic verdict'), _('not reported')));
+		break;
+	}
+
+	// --- The nft table, as a bare presence check. -----------------------------
+	// Kept because the offline stub still reads it straight from the kernel, so
+	// it is the one plane fact available when no daemon answers. It says nothing
+	// about WHICH ruleset is loaded — that is the Traffic plane row.
+	if (st.table === true)
+		rows.push(mk('good', _('nft table'), _('inet shater is loaded')));
+	else if (st.table === false)
+		rows.push(mk(st.enabled === false ? 'warn' : 'bad', _('nft table'), _('not loaded')));
+	else
+		rows.push(mk('unknown', _('nft table'), _('not reported')));
+
+	// --- Kill-switch: the configured policy, and whether it is in force. ------
+	// "closed" with no plane installed is a setting that is not in effect, which
+	// is worse news than "open" and must not share its amber lamp.
+	if (st.kill_switch === 'closed' && st.plane === 'none')
+		rows.push(mk('bad', _('Kill-switch'),
+			_('closed, but NOT in effect — no data plane is installed')));
+	else if (st.kill_switch === 'closed' && dstate === 'up')
+		rows.push(mk('good', _('Kill-switch'), _('closed (fail-closed)')));
+	else if (st.kill_switch === 'closed')
+		rows.push(mk('warn', _('Kill-switch'),
+			_('configured closed; whether it is installed is not known')));
+	else if (st.kill_switch === 'open')
+		rows.push(mk('warn', _('Kill-switch'), _('open (leaky)')));
+	else
+		rows.push(mk('unknown', _('Kill-switch'), _('not reported')));
+
+	// --- Running engine config hash ("" when the engine is not started). ------
+	if (typeof st.hash === 'string' && st.hash !== '')
+		rows.push(mk('good', _('Config hash'), st.hash));
+	else if (estate === 'down')
+		rows.push(mk('unknown', _('Config hash'), _('none — the engine is not started')));
+	else
+		rows.push(mk('unknown', _('Config hash'), _('not reported')));
 
 	return rows;
 }
 
+// statusRows turns the readout into LED table rows.
+function statusRows(st) {
+	return statusReadout(st).map(function(r) {
+		return row(r.state, r.label, r.value);
+	});
+}
+
+// panelHint describes the button's target and what is known about it. It never
+// promises the panel is up — only where the launcher will point.
+function panelTitle(dstate) {
+	if (dstate === 'up')
+		return _('Mint a session token and open the admin panel');
+	if (dstate === 'down')
+		return _('shaterd is not answering, so this will probably fail — but the panel is served by the daemon, not by the engine, so it is worth trying: any failure is reported here.');
+	return _('The daemon state is not known. Try it — a failure is reported here rather than hidden.');
+}
+
 // handleOpenPanel mints a single-use token and hands it to the panel via the
 // ARCHITECTURE §2 browser bridge: GET http://<router>:<port>/?t=<token>. The panel
 // validates+consumes the token and drops a session cookie.
@@ -151,13 +356,17 @@ return view.extend({
 	handleSave: null,
 	handleReset: null,
 
+	// Exposed so the offline fixture harness (tests/status-readout.test.js) can
+	// exercise the state derivation without a browser, a router, or a DOM.
+	statusReadout: statusReadout,
+	daemonState: daemonState,
+	engineState: engineState,
+
 	load: function() {
 		return L.resolveDefault(callStatus(), {});
 	},
 
 	render: function(st) {
-		var self = this;
-
 		var table = E('table', { 'class': 'table' }, statusRows(st));
 
 		var openBtn = E('button', {
@@ -174,25 +383,29 @@ return view.extend({
 			'style': 'margin-left:1em;color:#888;font-size:90%'
 		}, hintText());
 
-		// Reflect daemon reachability on the button up front, then keep the whole
-		// dashboard live. Also track the panel port reported in status so the
-		// launcher redirect and hint follow globals.panel_port.
+		// Track the panel port reported in status so the launcher redirect and the
+		// hint follow globals.panel_port.
+		//
+		// THE BUTTON IS NEVER DISABLED. It used to be locked whenever
+		// `running !== true`, which after a8970b8ac means "the engine is down" —
+		// precisely the situation the panel exists to get you out of, and one in
+		// which the daemon and its web server are still up and still minting
+		// tokens (cmd/shaterd/main.go starts the panel server independently of the
+		// engine). Locking it on a guess is the failure; a mint that fails already
+		// reports itself through ui.addNotification, which is the recoverable
+		// direction for an unknown state.
 		function reflect(state) {
-			state = state || {};
+			state = (state && typeof state === 'object') ? state : {};
 			panelPort = state.panel_port || DEFAULT_PANEL_PORT;
 			hint.textContent = hintText();
-			var down = (state.running !== true);
-			openBtn.disabled = down;
-			openBtn.title = down
-				? _('shaterd is not running — start the Shater service first')
-				: _('Mint a session token and open the admin panel');
+			openBtn.title = panelTitle(daemonState(state));
 		}
-		reflect(st || {});
+		reflect(st);
 
 		poll.add(function() {
 			return L.resolveDefault(callStatus(), {}).then(function(s) {
 				dom.content(table, statusRows(s));
-				reflect(s || {});
+				reflect(s);
 			});
 		}, 5);
 
@@ -209,7 +422,7 @@ return view.extend({
 			E('div', { 'class': 'cbi-section' }, [
 				E('h3', {}, _('Admin panel')),
 				E('p', { 'class': 'cbi-value-description' },
-					_('The rich admin panel is served by shaterd on its own port. LuCI mints a short-lived, single-use token for your browser — the panel has no separate login.')),
+					_('The rich admin panel is served by shaterd on its own port — by the daemon, not by the engine, so it stays reachable while the engine is down. LuCI mints a short-lived, single-use token for your browser; the panel has no separate login.')),
 				E('div', {}, [ openBtn, hint ])
 			])
 		]);

openwrt/luci-app-shater/root/usr/libexec/rpcd/shater

@@ -4,9 +4,27 @@
 # Registers the ubus object "shater" (object name == this file's name) with two
 # read-side methods the thin LuCI launcher calls over ubus:
 #
-#   status      -> passthrough of `shaterd status` ({running,enabled,active,table,hash})
+#   status      -> passthrough of `shaterd status`
 #   mint_token  -> passthrough of `shaterd mint-token` ({"token":"..."} | {"error":"..."})
 #
+# The status object is whatever apply.Status marshals (shater/apply/apply.go is the
+# only definition; this script never parses or reshapes it). As of 2026-07-26 that is:
+#
+#   running, engine_running, enabled, active, table, plane, traffic, hash,
+#   kill_switch, panel_port, can_rollback, warnings, started_unix, uptime_seconds
+#
+# Two of those are load-bearing for the caller and easy to misread:
+#
+#   running / engine_running — the ENGINE's liveness, not this daemon's. `running`
+#       was a hardcoded true until a8970b8ac (2026-07-26) and is now `engineUp`, so
+#       a healthy daemon with a dead engine reports running=false. The daemon's own
+#       liveness is not a field at all.
+#   plane — "full" | "hold" | "none" from a LIVE daemon. `shaterd status` also has an
+#       OFFLINE STUB path: when the daemon is unreachable it still exits 0 and prints
+#       a status built from the apply.Status zero value plus a UCI read, which leaves
+#       plane at "". So this method returning an object is NOT evidence that a daemon
+#       answered; a known plane word is. dashboard.js relies on exactly that.
+#
 # Why shell out to shaterd instead of talking to /var/run/shaterd.ctl directly:
 # a reliable AF_UNIX client is NOT guaranteed on stock OpenWrt (busybox `nc` is
 # usually built without `-U`; socat/ucode-socket aren't in the base image). shaterd

openwrt/luci-app-shater/tests/status-readout.test.js

@@ -0,0 +1,236 @@
+#!/usr/bin/env node
+/*
+ * Offline harness for the dashboard's state derivation.
+ *
+ * Run: node openwrt/luci-app-shater/tests/status-readout.test.js
+ *
+ * Why this exists: the LuCI page is the ONE screen an operator reaches when the
+ * engine is down and the fail-closed holding plane is blocking the LAN. What it
+ * says there is a claim about the router's behaviour, and until now nothing
+ * checked those claims. There is no browser and no router in this loop — the view
+ * exposes statusReadout/daemonState/engineState as plain functions, and this file
+ * feeds them recorded status objects.
+ *
+ * The fixtures are not invented. Each is what the wire actually carries:
+ *
+ *   ENGINE_UP    — apply.Status() from a live daemon with a started engine.
+ *   ENGINE_DOWN  — apply.Status() from a live daemon whose engine died; the
+ *                  holding plane is installed and the LAN is blocked.
+ *   DAEMON_DOWN  — the OFFLINE STUB `shaterd status` prints when the daemon is
+ *                  unreachable (cmd/shaterd/main.go cmdStatus): apply.Status zero
+ *                  value + a UCI read, marshalled by Status.JSON(), so every field
+ *                  is present and `plane` is "".
+ *   NO_ANSWER    — {} , what L.resolveDefault hands render() when the ubus call
+ *                  fails outright.
+ *   PLUGIN_ERROR — {"error":...} from the rpcd plugin, which is ALSO what a
+ *                  live-but-wedged daemon produces.
+ *   LEGACY       — a daemon predating plane/engine_running (packages do not update
+ *                  atomically).
+ *
+ * Mutation check: revert dashboard.js to reading `st.running` for daemon
+ * liveness and this file fails on ENGINE_DOWN with the exact text the operator
+ * would have been shown.
+ */
+
+'use strict';
+
+var fs = require('fs');
+var path = require('path');
+
+// --- Load the view module with LuCI's globals stubbed. ----------------------
+// The view file is a module body LuCI wraps in a function, so it ends in a
+// top-level `return` and cannot be require()d. Wrapping it in new Function is the
+// same thing LuCI's loader does. The 'require x' lines are bare string literals
+// and evaluate to nothing.
+// DASHBOARD_JS points the harness at a copy of the view. It exists so the
+// mutation check is repeatable: copy dashboard.js, reintroduce the defect in the
+// copy, run this file against it, and watch the named assertions fail. A test
+// that cannot be shown to fail on the broken code is decoration.
+var SRC = process.env.DASHBOARD_JS || path.join(__dirname, '..', 'htdocs',
+	'luci-static', 'resources', 'view', 'shater', 'dashboard.js');
+
+function loadView() {
+	var src = fs.readFileSync(SRC, 'utf8');
+	var factory = new Function('view', 'dom', 'poll', 'rpc', 'ui', 'E', '_', 'L',
+		'window', src);
+	return factory(
+		{ extend: function(o) { return o; } },           // view
+		{ content: function() {} },                      // dom
+		{ add: function() {} },                          // poll
+		{ declare: function() { return function() {}; } }, // rpc
+		{ createHandlerFn: function() { return function() {}; }, addNotification: function() {} },
+		function() { return {}; },                       // E
+		function(s) { return s; },                       // _  (identity)
+		{ resolveDefault: function(p, d) { return Promise.resolve(d); } },
+		{ location: { hostname: 'router' }, open: function() { return null; } }
+	);
+}
+
+var page = loadView();
+
+// --- Fixtures ---------------------------------------------------------------
+
+var ENGINE_UP = {
+	running: true, engine_running: true, enabled: true, active: true, table: true,
+	plane: 'full', traffic: { verdict: 'tunnel', default: 'proxy', tunnel_rules: 3 },
+	hash: 'a1b2c3d4', kill_switch: 'closed', panel_port: 8088, can_rollback: true,
+	warnings: [], started_unix: 1753500000, uptime_seconds: 3600
+};
+
+var ENGINE_DOWN = {
+	running: false, engine_running: false, enabled: true, active: true, table: true,
+	plane: 'hold', traffic: { verdict: '', default: '', tunnel_rules: 0 },
+	hash: '', kill_switch: 'closed', panel_port: 8088, can_rollback: true,
+	warnings: [], started_unix: 1753500000, uptime_seconds: 3600
+};
+
+// Exactly what Status.JSON() emits for the cmdStatus offline stub.
+var DAEMON_DOWN = {
+	running: false, engine_running: false, enabled: true, active: true, table: true,
+	plane: '', traffic: { verdict: '', default: '', tunnel_rules: 0 },
+	hash: '', kill_switch: 'closed', panel_port: 8088, can_rollback: false,
+	warnings: null, started_unix: 0, uptime_seconds: 0
+};
+
+var NO_ANSWER = {};
+var PLUGIN_ERROR = { error: 'shaterd unavailable' };
+var LEGACY = {
+	running: true, enabled: true, active: true, table: true, hash: 'deadbeef',
+	kill_switch: 'closed', panel_port: 8088
+};
+
+// --- Assertions -------------------------------------------------------------
+
+var failures = [];
+
+function check(name, cond, detail) {
+	if (cond) return;
+	failures.push(name + (detail ? ': ' + detail : ''));
+}
+
+// readout indexes the rows by label. A row that is NOT emitted must fail by name
+// rather than by throwing on `undefined.state`: a harness that dies mid-run stops
+// reporting the assertions after it, which is the silent-skip failure this
+// project has been bitten by. Missing rows come back as a loud sentinel instead.
+var MISSING = { state: '<row absent>', value: '<row absent>', missing: true };
+
+function readout(st) {
+	var out = {};
+	page.statusReadout(st).forEach(function(r) { out[r.label] = r; });
+	return new Proxy(out, {
+		get: function(t, k) {
+			if (typeof k !== 'string' || k in t) return t[k];
+			return MISSING;
+		},
+		has: function(t, k) { return k in t; }
+	});
+}
+
+function show(title, st) {
+	process.stdout.write('\n=== ' + title + ' ===\n');
+	process.stdout.write('  daemon=' + page.daemonState(st) +
+		'  engine=' + page.engineState(st) + '\n');
+	page.statusReadout(st).forEach(function(r) {
+		process.stdout.write('  [' + r.state.padEnd(7) + '] ' +
+			r.label.padEnd(18) + ' ' + r.value + '\n');
+	});
+}
+
+function lamps(st) {
+	return page.statusReadout(st).map(function(r) { return r.state; });
+}
+
+// 1. Live daemon, engine up.
+show('A. daemon alive, engine running', ENGINE_UP);
+check('A/daemon', page.daemonState(ENGINE_UP) === 'up');
+check('A/engine', page.engineState(ENGINE_UP) === 'up');
+check('A/no-red', lamps(ENGINE_UP).indexOf('bad') === -1,
+	'a fully healthy router must show no red lamp');
+check('A/no-unknown', lamps(ENGINE_UP).indexOf('unknown') === -1,
+	'every field is present, so nothing may read as unknown');
+
+// 2. THE DEFECT. Live daemon, dead engine, LAN held.
+show('B. daemon alive, engine DOWN, holding plane', ENGINE_DOWN);
+check('B/daemon-up', page.daemonState(ENGINE_DOWN) === 'up',
+	'the daemon is answering; calling it dead is the bug being fixed');
+check('B/engine-down', page.engineState(ENGINE_DOWN) === 'down');
+var b = readout(ENGINE_DOWN);
+check('B/daemon-row-green', b['Daemon (shaterd)'].state === 'good',
+	'got ' + b['Daemon (shaterd)'].state + ' / ' + b['Daemon (shaterd)'].value);
+check('B/daemon-row-no-start-advice',
+	b['Daemon (shaterd)'].value.indexOf('start') === -1,
+	'must not tell the operator to start a service that is already running');
+check('B/plane-red', b['Traffic plane'].state === 'bad');
+check('B/plane-says-blocked', /BLOCKED/.test(b['Traffic plane'].value));
+check('B/latch-not-called-interception',
+	!b['Service latch'].missing && b['Interception'].missing === true,
+	'`active` is the run latch, not a "we are proxying" signal — apply.go: ' +
+	'"Never render it as \'we are proxying\'"');
+check('B/latch-value-is-a-latch', /meant to be running/.test(b['Service latch'].value),
+	'the latch row must state the latch, not claim traffic is being proxied');
+check('B/latch-not-active-word', !/^active$/.test(b['Service latch'].value));
+check('B/verdict-unknown', b['Traffic verdict'].state === 'unknown',
+	'no verdict was published; it must not be painted as tunnel');
+check('B/some-red', lamps(ENGINE_DOWN).indexOf('bad') !== -1,
+	'a blocked LAN must not be an all-green screen');
+
+// The button is a property of render(), not of the pure readout, so it is
+// guarded at the source level: nothing may ever set `disabled` on the launcher.
+// Locking the way into the panel while the engine is down is the defect this
+// whole file exists for, and it must not come back by a different route.
+check('B/button-never-disabled',
+	!/openBtn\s*\.\s*disabled/.test(fs.readFileSync(SRC, 'utf8')),
+	'dashboard.js assigns openBtn.disabled — the launcher must never be locked');
+
+// 3. Daemon not answering at all — the offline stub.
+show('C. daemon NOT running (offline stub)', DAEMON_DOWN);
+check('C/daemon-down', page.daemonState(DAEMON_DOWN) === 'down',
+	'plane:"" is the stub signature; got ' + page.daemonState(DAEMON_DOWN));
+check('C/engine-down', page.engineState(DAEMON_DOWN) === 'down');
+var c = readout(DAEMON_DOWN);
+check('C/daemon-row-red', c['Daemon (shaterd)'].state === 'bad');
+check('C/plane-unknown', c['Traffic plane'].state === 'unknown',
+	'the stub reports no plane; got ' + c['Traffic plane'].value);
+check('C/kill-switch-not-green', c['Kill-switch'].state !== 'good',
+	'"closed" from a dead daemon proves nothing is installed to enforce it');
+check('C/distinct-from-B',
+	c['Daemon (shaterd)'].value !== b['Daemon (shaterd)'].value,
+	'engine-down and daemon-down must not render identically');
+
+// 4/5/6. Degenerate answers must degrade to unknown, never to healthy.
+[['D. ubus call failed ({})', NO_ANSWER],
+ ['E. rpcd plugin error / wedged daemon', PLUGIN_ERROR],
+ ['F. legacy daemon (no plane, no engine_running)', LEGACY]].forEach(function(p) {
+	show(p[0], p[1]);
+	var st = p[1];
+	check(p[0] + '/daemon-unknown', page.daemonState(st) === 'unknown');
+	check(p[0] + '/engine-unknown', page.engineState(st) === 'unknown');
+	var r = readout(st);
+	check(p[0] + '/plane-unknown', r['Traffic plane'].state === 'unknown');
+	check(p[0] + '/daemon-row-unknown', r['Daemon (shaterd)'].state === 'unknown');
+	check(p[0] + '/no-false-green-plane', r['Traffic plane'].state !== 'good');
+});
+
+// The legacy fixture additionally must not crash and must not lose the fields it
+// DOES carry — a non-atomic package update must degrade, not black out.
+var f = readout(LEGACY);
+check('F/enabled-still-read', f['Service enabled'].state === 'good');
+check('F/hash-still-read', f['Config hash'].value === 'deadbeef');
+check('F/table-still-read', f['nft table'].state === 'good');
+
+// A plane word this build does not know about must land in unknown, not in the
+// last-listed branch. (Closed positive list, recoverable default.)
+var FUTURE = Object.assign({}, ENGINE_UP, { plane: 'partial' });
+check('G/unknown-plane-word', page.daemonState(FUTURE) === 'unknown',
+	'an unrecognised plane value must not be read as a live daemon');
+check('G/unknown-plane-row', readout(FUTURE)['Traffic plane'].state === 'unknown');
+
+// --- Report -----------------------------------------------------------------
+
+process.stdout.write('\n');
+if (failures.length) {
+	process.stdout.write('FAIL (' + failures.length + ')\n');
+	failures.forEach(function(f) { process.stdout.write('  - ' + f + '\n'); });
+	process.exit(1);
+}
+process.stdout.write('OK — all cases distinguished\n');

openwrt/shater-core/Makefile

@@ -40,6 +40,10 @@ define Package/shater-core
   #   shaterd              : the daemon our init supervises (`shaterd run`)
   #   kmod-nft-tproxy      : kernel TPROXY (shaterd emits the `inet shater` rules)
   #   kmod-nft-socket      : socket match used by the tproxy divert chain
+  #   kmod-tun             : /dev/net/tun — the daemon opens the `shater-l3` TUN
+  #                          for L3 ingress (globals.l3_tunnel); usually built-in
+  #                          on stock images, but a slimmed image without it would
+  #                          make the option fail with a cryptic open() error.
   #   ip-full              : `ip rule`/`ip route`/rt_tables for policy routing
   #   nftables-json        : shaterd shells out to `nft`, and netplane/stats.go
   #                          parses `nft -j list ...` — the JSON output only exists
@@ -49,7 +53,7 @@ define Package/shater-core
   #   ca-bundle            : the daemon is CGO_ENABLED=0, so crypto/x509 has no
   #                          host cert fallback — without /etc/ssl/certs every
   #                          HTTPS subscription / .srs ruleset fetch fails.
-  DEPENDS:=+shaterd +kmod-nft-tproxy +kmod-nft-socket +ip-full +nftables-json +ca-bundle
+  DEPENDS:=+shaterd +kmod-nft-tproxy +kmod-nft-socket +kmod-tun +ip-full +nftables-json +ca-bundle
   PKGARCH:=all
 endef
 
@@ -80,6 +84,10 @@ define Package/shater-core/install
 	$(INSTALL_DIR) $(1)/etc/init.d
 	$(INSTALL_BIN) ./files/etc/init.d/shater $(1)/etc/init.d/shater
 	$(INSTALL_BIN) ./files/etc/init.d/shater-cron $(1)/etc/init.d/shater-cron
+	# START=21 one-shot that loads the persisted fail-closed plane before fw4's
+	# `lan -> wan ACCEPT` can be the only thing on the box (the main init is
+	# START=99, i.e. seconds of plaintext forwarding on every boot).
+	$(INSTALL_BIN) ./files/etc/init.d/shater-armor $(1)/etc/init.d/shater-armor
 
 	$(INSTALL_DIR) $(1)/etc/hotplug.d/iface
 	$(INSTALL_BIN) ./files/etc/hotplug.d/iface/99-shater $(1)/etc/hotplug.d/iface/99-shater
@@ -92,6 +100,16 @@ define Package/shater-core/install
 
 	$(INSTALL_DIR) $(1)/etc/uci-defaults
 	$(INSTALL_BIN) ./files/etc/uci-defaults/30_shater-core $(1)/etc/uci-defaults/30_shater-core
+
+	# sysupgrade's "keep settings" walks /lib/upgrade/keep.d/*, and without this the
+	# node inventory in /etc/shater/subs does NOT survive a flash: the restored box
+	# has its rules and its groups and no nodes for them to point at, and the only
+	# repair is `sub update`, which needs the internet the tunnel was going to
+	# provide. Package metadata, not user config, so INSTALL_DATA and not
+	# INSTALL_CONF. (/etc/config/shater needs no entry — it is a conffile and
+	# sysupgrade already keeps it that way.)
+	$(INSTALL_DIR) $(1)/lib/upgrade/keep.d
+	$(INSTALL_DATA) ./files/lib/upgrade/keep.d/shater-core $(1)/lib/upgrade/keep.d/shater-core
 endef
 
 $(eval $(call BuildPackage,shater-core))

openwrt/shater-core/files/etc/config/shater

@@ -23,17 +23,84 @@ config globals 'globals'
 	option kill_switch 'closed'
 	# There is no dns_mode option: routing is decided by in-engine rule-sets and
 	# fake-IP is a resolver type (`config resolver` with type=fakeip + pool).
+	#
+	# Force ALL LAN plaintext DNS (:53) into the engine, INCLUDING queries the
+	# client sends to the router itself (the address DHCP hands out). ON by
+	# default: with it off, a client using the router as its resolver is answered
+	# by dnsmasq and forwarded to the ISP in the clear — no blocklists, no
+	# per-device DNS rules, no resolver detour — while a client that hard-codes
+	# 8.8.8.8 IS intercepted. The obedient client leaked; the evader did not.
+	#
+	# Set to '0' to opt out (dnsmasq answers router-addressed :53 again). Your
+	# explicit value is never overwritten: this file is a conffile, and the daemon
+	# always writes the option back as '1'/'0'.
+	#
+	# .lan and the private reverse (PTR) zones keep working: with at least one
+	# `config resolver` present the engine gets a synthetic server pointed at
+	# dnsmasq on 127.0.0.1:53 plus a rule that sends those suffixes to it; with no
+	# resolver at all the engine falls back to the system resolver, which is
+	# dnsmasq too. If you changed dnsmasq's domain away from `lan`, add a
+	# `config dns_rule` for it (only `lan` + RFC6303 reverse zones are built in).
+	#
+	# While the engine is DOWN the LAN is NOT left without DNS: the fail-closed
+	# holding plane hooks `forward` only, so dnsmasq still answers router-addressed
+	# :53 — unfiltered and in the clear, the documented trade-off (blocking it
+	# would also cut the daemon's own name resolution and its chance to recover).
+	# Queries aimed at an EXTERNAL resolver are dropped with the rest of the LAN's
+	# forwarded traffic.
+	option dns_intercept '1'
+	# Carry LAN ping through the tunnel. ON by default, and the alternative is
+	# why: without it a ping is decided by `untunnelable` below, whose rungs are
+	# "drop it" (block, the default) or "let it out of the WAN interface with the
+	# client's real IP on it" (icmp/direct). There was no setting in which ping
+	# both worked and stayed inside the tunnel. With this on, the engine opens a
+	# TUN, LAN ICMP is routed into it, and an outbound that speaks layer 3
+	# (WireGuard/AmneziaWG, or a direct route) carries the echo for real. An
+	# outbound that does not (vless/trojan/shadowsocks) makes the ping DROP —
+	# honestly: no reply is forged, ping reports loss. So a ping that used to
+	# "work" through such a node was a ping that was leaking.
+	#
+	# It costs a permanent TUN device plus the gVisor netstack behind it, about
+	# 2 MB of RSS for as long as the daemon runs.
+	#
+	# Set to '0' to opt out — worth it on a 32/64 MB router, or to bisect whether
+	# the L3 ingress is what broke something. `shaterd apply` will tell you what
+	# the off state costs. Your explicit value is never overwritten: this file is
+	# a conffile and the daemon always writes the option back as '1'/'0'.
+	#
+	# NOTE the interaction: with this ON, `untunnelable` no longer governs ping at
+	# all (the L3 route decision happens before the firewall chain its verdicts
+	# live in). It still governs ESP/AH/GRE/IGMP/SCTP, which no tunnel of ours can
+	# carry. `untunnelable 'icmp'` in particular stops meaning "block plus working
+	# ping" and is reported as such.
+	option l3_tunnel '1'
 	option ipv6 '1'
 	# Reserved fwmark base and routing-table base (do not overlap fw4/other apps).
 	option fwmark_base '0x2000'
 	option table_base '0x2000'
-	# Seconds to auto-rollback an unconfirmed apply (0 = commit-confirm off).
+	# Seconds to auto-rollback an unconfirmed apply. SHIPPED AS 0, i.e.
+	# commit-confirm is OFF: `shaterd apply` arms nothing, and an apply that costs
+	# you SSH/LuCI access stays until you undo it by hand. Set a window (e.g.
+	# '120') to arm it, and run `shaterd confirm` inside that window to keep the
+	# new config. Note the option is written back only when NON-zero, so an
+	# explicit '0' disappears from this file on the first write by the daemon or
+	# the panel — absent and 0 are the same thing.
 	option confirm_timeout '0'
-	option schema_version '1'
+	# Master enable of the DNS blocklist/allowlist filter (D15). OFF by default;
+	# it needs at least one `config resolver` to have a DNS plane to filter with.
+	# See the "DNS filter" section at the end of this file.
+	option dns_filter '0'
+	option schema_version '2'
 
 # LAN interception inbound. `network` is a UCI interface name; shaterd resolves
 # it to its device (e.g. 'lan' -> br-lan) for the nft TPROXY plane. Enable
 # globals above and adjust `network` to the interface(s) you want proxied.
+#
+# There is no per-inbound `sniff` option: since sing-box 1.11 sniffing is a
+# leading route ACTION rule with no inbound matcher, so EVERY inbound is sniffed,
+# always. Do not add one back — the hijack-dns rule matches the SNIFFED `dns`
+# protocol, so a per-inbound sniff toggle would be a DNS-leak switch (D14, and
+# the long argument at shater/model/model.go Inbound).
 config inbound
 	option name 'lan'
 	option enabled '1'
@@ -42,7 +109,6 @@ config inbound
 	option tproxy_port '12345'
 	option tcp '1'
 	option udp '1'
-	option sniff '1'
 
 # --- Commented examples (copy, uncomment, adjust, then enable globals) -------
 #
@@ -62,7 +128,29 @@ config inbound
 #	list node 'my-node'
 #
 # A routing rule. target: chain:<n>|group:<n>|node:<n>|egress:<n>|direct|block.
-# Match on src / dst_domain / dst_ruleset / dst_ip / dst_port / proto.
+# Match on src / dst_ruleset / dst_port / proto. A rule with NO matcher at all is
+# the default route for everything that reached it.
+#
+# WHERE the traffic is going is named ONLY by dst_ruleset — one or more
+# `config ruleset` names; the rule matches when ANY of them matches. There is no
+# inline domain or address list on a rule (`dst_domain`/`dst_ip` were removed in
+# schema v2): a destination list is written once as a ruleset, compiled into a
+# .srs and shared by every rule that references it. `shaterd migrate` converts
+# older configs automatically, creating a `rule-<name>` ruleset per rule.
+#config ruleset
+#	option name 'blocked-video'
+#	option type 'domain'
+#	option source 'inline'
+#	list entry 'youtube.com'
+#	list entry 'suffix:googlevideo.com'
+#
+#config rule
+#	option name 'video-via-main'
+#	option enabled '1'
+#	option order '50'
+#	list dst_ruleset 'blocked-video'
+#	option target 'group:main'
+#
 #config rule
 #	option name 'all-via-main'
 #	option enabled '1'
@@ -83,11 +171,16 @@ config inbound
 #	option type 'direct'
 #	option dpi 'fragment'
 #
+#config ruleset
+#	option name 'youtube'
+#	option source 'geosite'
+#	list category 'youtube'
+#
 #config rule
 #	option name 'youtube-fragment'
 #	option enabled '1'
 #	option order '50'
-#	list dst_domain 'geosite:youtube'
+#	list dst_ruleset 'youtube'
 #	option target 'egress:frag'
 #
 # A DNS resolver (type: doh|dot|plain|local|fakeip). `detour` routes its queries
@@ -100,8 +193,8 @@ config inbound
 #
 # --- DNS filter (D15) -------------------------------------------------------
 # Network-wide domain blocking, built on sing-box rule-sets + reject DNS rules.
-# Turn it ON by setting `option dns_filter '1'` in `config globals` above (it is
-# OFF by default). Filtering needs at least one `config resolver` (the in-engine
+# Turn it ON by flipping `option dns_filter` to '1' in `config globals` above (it
+# is shipped '0'). Filtering needs at least one `config resolver` (the in-engine
 # DNS plane). A blocklist answers matched domains with NXDOMAIN; an allowlist
 # always OVERRIDES the blocklists (allowlisted domains resolve normally).
 #

openwrt/shater-core/files/etc/init.d/shater

@@ -33,6 +33,30 @@
 #     be running. `start` raises ACTIVE_FLAG, `stop` clears it; hotplug/cron
 #     reconcile ONLY while the flag is up, so an admin `stop` STICKS — no
 #     background actor may resurrect interception behind a stopped daemon.
+#   * BEING REPLACED IS NOT BEING SWITCHED OFF. `restart` and `reload` (which is
+#     stop+start, i.e. every LuCI Save & Apply) both run through `stop`, and the
+#     daemon's SIGTERM teardown removes the fail-closed table unconditionally — it
+#     does not consult kill_switch at all. Between that teardown and the
+#     successor's first apply the init GUARANTEES a gap: it waits for the old
+#     process to exit (shater_wait_stopped), then runs `shaterd migrate`, then
+#     starts a daemon that still has to build an engine. So a restart is announced
+#     with RESTART_FLAG, which tells the outgoing daemon to leave the fail-closed
+#     holding plane STANDING — apply.TeardownExiting swaps it in with one nft
+#     transaction and then skips the delete, so the table is never absent, not even
+#     for the 80-90 ms the old arm-after-teardown order measured. A real `stop`
+#     raises no flag and therefore still means what it says.
+#     (A package UPGRADE does not come through here at all on apk v3: shater-core's
+#     script table is post-install / pre-deinstall / post-upgrade, with no
+#     pre-upgrade, so default_prerm — and its `stop` — runs only on REMOVAL.)
+#   * The FAIL-CLOSED PLANE MUST ALSO EXIST BEFORE THIS SCRIPT DOES. START=99 is
+#     after fw4 (19) and netifd (20), so at every boot the LAN forwards to the WAN
+#     in the clear for as long as it takes procd to decompress the daemon off
+#     flash and get an engine up. /etc/init.d/shater-armor (START=21) loads
+#     BOOT_ARMOR — a copy of the holding plane the daemon persists on every apply
+#     — to close that window. This script owns the DISARM half, and it owns it
+#     with a CLOSED LIST: an operator's `stop`, or a removal, and nothing else.
+#     Powering the box down must not — `shutdown` reaches stop_service too, and it
+#     is not a person switching the product off (see shater_stop_disarms).
 #   * The engine must never be permanently abandoned while interception stands:
 #     respawn retries are infinite (procd never gives up); a sustained-dead
 #     daemon is additionally escalated by the shater-cron watchdog.
@@ -50,11 +74,166 @@ ACTIVE_FLAG=/var/run/shater.active
 # Written by `shaterd run`; the single-owner token this init waits on so a
 # restart never overlaps a new data plane with the previous one's teardown.
 PIDFILE=/var/run/shaterd.pid
+# Raised around a restart/reload, read by the OUTGOING `shaterd run` at SIGTERM:
+# present => "you are being replaced, leave the fail-closed plane standing";
+# absent  => "you are being switched off, take everything down". tmpfs, so a
+# power cut can never make the next boot look like a restart.
+RESTART_FLAG=/var/run/shater.restarting
+# The persisted fail-closed holding plane. Written by the daemon on every apply,
+# loaded by /etc/init.d/shater-armor at boot. Its PRESENCE is the arm token, so
+# removing it here is how a deliberate stop stops the next boot from blocking.
+BOOT_ARMOR=/etc/shater/boot.nft
 # Seconds `start` will wait for a predecessor to finish its teardown. Must be
 # >= term_timeout below (procd's hard cap on a predecessor's life after SIGTERM)
 # so we never give up while procd is still letting it shut down cleanly.
 STOP_WAIT_SECS=40
 
+# WHICH ACTION rc.common was invoked with, frozen at source time.
+#
+# rc.common does, in this order:
+#     initscript=$1; action=${2:-help}; shift 2; ...; . "$initscript"; $action "$@"
+# so `action` is ALREADY assigned when this file is sourced, and every action then
+# runs as a function in THAT SAME shell. MEASURED on the target (ImmortalWrt
+# 25.12.1 r37978) with a throwaway probe init script, not read off documentation:
+#
+#     /etc/init.d/X restart  ->  stop_service action=[restart], start_service [restart]
+#     /etc/init.d/X stop     ->  stop_service action=[stop]
+#     /etc/init.d/X reload   ->  reload_service action=[reload]
+#     `reboot`               ->  stop_service action=[SHUTDOWN]     <-- see below
+#     the boot after it      ->  start_service action=[boot]
+#
+# A previous probe reported this variable EMPTY and the emptiness was written up as
+# the defect. It was the probe: `sh -x /etc/init.d/shater restart` bypasses the
+# `#!/bin/sh /etc/rc.common` shebang, so rc.common never runs, never assigns
+# `action`, and the variable reads empty no matter what this file does.
+#
+# Frozen into our own variable because `action` is a short, generic name that other
+# framework helpers also use as a local; a snapshot taken before any function runs
+# cannot be shadowed later.
+SHATER_RC_ACTION="$action"
+
+# --- what an action MEANS --------------------------------------------------
+#
+# THE BUG THESE TWO PREDICATES REPLACE (v0.2.17, measured on the live router).
+# The old stop_service was `case $action in restart|reload) keep;; *) DISARM;; esac`
+# — an open default that swept up every action nobody had enumerated. `reboot` is
+# one of them: procd runs the K-links with the action `shutdown`, so the shutdown
+# path deleted the arm token on the way down and the next boot had nothing to load.
+# The mechanism destroyed itself at exactly the moment it exists for. Instrument
+# reading from the router, one minute apart across a reboot:
+#
+#     13:28  /etc/shater/boot.nft present
+#     ----   reboot (stop_service action=[shutdown] -> old `*` branch -> rm)
+#     18s    at_S22: NO_TABLE  armor_file=NO_FILE
+#
+# So both lists below are POSITIVE and CLOSED. An action nobody thought about —
+# `shutdown` above all, but also whatever a future procd invents — falls through
+# both and changes nothing. The default now fails in the recoverable direction: at
+# worst a boot arms when it need not have, which costs the second before the daemon
+# applies and is still gated by shater-armor's own four state refusals. The old
+# default failed in the direction of the plaintext window the feature was built to
+# close.
+#
+# They are predicates rather than an inline `case` so the test gate can execute the
+# real thing: it sources THIS FILE in /bin/sh and calls them with every action procd
+# actually uses (shater/cmd/shaterd/initscript_test.go). A comment claiming
+# `shutdown` is handled is what shipped last time.
+
+# True only for the ONE action that means "the operator switched the product off".
+# Deliberately not `shutdown`: powering a router down is not turning a feature off.
+#
+# NOT sufficient on its own — see shater_stop_disarms. `stop` is also how the
+# package manager's plumbing reaches us, and a package manager is not a person.
+shater_action_disarms() {
+	case "$1" in
+		stop) return 0 ;;
+		*)    return 1 ;;
+	esac
+}
+
+# Is a package manager in the middle of a transaction RIGHT NOW?
+#
+# This is a state, read at the moment the decision is made, exactly like
+# shater-armor's four refusals — not a record of an event. The same question is
+# already asked (for the same reason: prerm/postinst plumbing is not a user
+# action) by the detached bring-up in /etc/uci-defaults/30_shater-core.
+shater_pkg_transaction() {
+	pidof apk >/dev/null 2>&1 && return 0
+	pidof opkg >/dev/null 2>&1 && return 0
+	return 1
+}
+
+# Is the main service still enabled at boot? Same glob, and for the same reason,
+# as shater-armor's own check: `/etc/init.d/shater enabled` would source procd.sh
+# and take a blocking flock, which is not something to do from inside a package
+# manager's transaction.
+shater_rc_enabled() {
+	local f
+	for f in /etc/rc.d/S[0-9][0-9]shater; do
+		[ -e "$f" ] && return 0
+	done
+	return 1
+}
+
+# THE ACTUAL DISARM DECISION.
+#   $1 = action
+#   $2 = 1 when a package transaction is in flight
+#   $3 = 1 when the service is still enabled in rc.d
+# All three are passed in rather than read inside, so the gate can drive every
+# combination without a package manager or an /etc/rc.d.
+#
+# WHY IT IS NOT JUST THE ACTION. base-files' default_prerm runs, in this order:
+#
+#     if [ "$PKG_UPGRADE" != "1" ]; then "$i" disable; fi
+#     "$i" stop
+#
+# so a package manager reaches stop_service wearing the operator's clothes. Two
+# different intentions arrive as the same action, and the difference between them
+# is readable at the moment of the decision:
+#
+#   REMOVAL  — prerm has ALREADY run `disable`, so S99shater is gone. The product
+#              is going away; the armor goes with it. (It is belt-and-braces even
+#              so: shater-armor refuses to arm without that symlink, and the whole
+#              init script is about to be deleted anyway.)
+#   REPLACED — the service is still enabled, so something intends to bring it
+#              back. That is not an operator switching anything off, and deleting
+#              the armor here would leave the next boot unprotected. "The next
+#              apply will rewrite it" is not an answer: the armor exists precisely
+#              to cover a reboot, and a reboot between an update and the first
+#              apply is how this product is deployed.
+#
+# MEASURED, because the paragraph above is about a path I got wrong once already.
+# On THIS target (apk-tools 3.0.5, ImmortalWrt 25.12.1) shater-core's script table
+# is post-install / pre-deinstall / post-upgrade, with NO pre-upgrade — so an apk
+# UPGRADE never executes default_prerm and never calls `stop` at all. Verified with
+# a real `apk fix --reinstall shater-core` while sampling the armor file: 245 625
+# samples, zero disappearances, even with this guard mutated off. The upgrade half
+# of this predicate is therefore defence-in-depth for a shape that is one
+# `pre-upgrade` script (or a returning opkg lane) away, NOT a fix for an observed
+# failure. The removal half is live today.
+shater_stop_disarms() {
+	shater_action_disarms "$1" || return 1
+	# No package manager involved => a person typed it. The escape hatch must work.
+	[ "$2" = "1" ] || return 0
+	# A package transaction that has NOT disabled the service is replacing it.
+	[ "$3" = "1" ] && return 1
+	return 0
+}
+
+# True when a successor is coming, so the outgoing daemon should leave the
+# fail-closed holding plane standing instead of removing it.
+#
+# `shutdown` is deliberately NOT a handoff either: nothing is coming, and the
+# kernel that would hold the plane is going away with it. Leaving the flag down
+# there also keeps the marker's meaning exact — it says "you are being replaced",
+# and at shutdown nothing is.
+shater_action_handoff() {
+	case "$1" in
+		restart|reload) return 0 ;;
+		*)              return 1 ;;
+	esac
+}
+
 # --- helpers ---------------------------------------------------------------
 
 # True only when the stack is explicitly enabled in UCI.
@@ -73,6 +252,25 @@ _slog() {
 	[ "$(uci -q get shater.globals.log_syslog)" = "0" ] || logger -t shater "$@"
 }
 
+# Announce/withdraw "this daemon is being replaced, not switched off". Read by
+# `shaterd run` when it receives SIGTERM.
+shater_mark_restart() {
+	mkdir -p "$(dirname "$RESTART_FLAG")" 2>/dev/null
+	: > "$RESTART_FLAG"
+}
+shater_clear_restart() { rm -f "$RESTART_FLAG"; }
+
+# Remove the persisted boot armor, so the LAN is NOT blocked at the next boot
+# before the daemon starts. Called from exactly two places, both of which are a
+# statement about the PRODUCT rather than about this process: an operator typing
+# `stop`, and a daemon binary that is no longer on the box. In neither case is
+# anything going to come along and replace the armor with a real data plane, and a
+# kill switch with nothing behind it is just a brick.
+#
+# NOT called on the shutdown path. That is the whole fix — see
+# shater_action_disarms.
+shater_disarm_boot() { rm -f "$BOOT_ARMOR"; }
+
 # Echo the pid of a LIVE `shaterd run`, or fail. The pidfile is written by the
 # daemon itself and removed only by the daemon that owns it, AFTER its teardown
 # has completed — so "pidfile names a live process" is precisely "the previous
@@ -136,9 +334,20 @@ start_service() {
 	# Guard: never claim to run without the daemon binary. A half-removed/failed
 	# shaterd upgrade must degrade to "plugin off", not to a box that thinks
 	# interception is live with nothing behind it.
+	#
+	# "Plugin off" now has to include DISARMING. With the boot armor in play, a
+	# missing binary is the one case where the fail-closed plane could stand
+	# forever with nothing able to replace it: the armor loads at START=21, the
+	# daemon never starts, and every later boot repeats it. The product being gone
+	# is not a security event — it is an uninstall — so the plane comes down and
+	# the LAN returns to plain routing, loudly.
 	if [ ! -x "$PROG" ]; then
+		shater_clear_restart
+		shater_disarm_boot
+		rm -f "$ACTIVE_FLAG"
+		nft delete table inet shater 2>/dev/null
 		_slog -p daemon.err \
-			"shaterd binary missing/not executable at $PROG — refusing to start (LAN stays on plain routing)"
+			"shaterd binary missing/not executable at $PROG — refusing to start; the fail-closed plane and its boot armor have been REMOVED (LAN back to plain routing, unprotected). Reinstall shaterd."
 		return 0
 	fi
 
@@ -150,9 +359,28 @@ start_service() {
 	# running, which is the boot case.
 	shater_wait_stopped
 
+	# The predecessor is gone and has already consumed the flag (it reads it in its
+	# SIGTERM handler). Withdraw it now, so a LATER `stop` is unambiguous even if
+	# this start fails further down.
+	shater_clear_restart
+
 	# Bring the UCI schema forward before the daemon reads it (idempotent;
 	# refuses a newer schema) so an upgraded package never applies a stale config.
-	"$PROG" migrate >/dev/null 2>&1
+	#
+	# THE FAILURE IS LOGGED, NOT SWALLOWED. This is the only place the schema
+	# migration runs at boot (`shaterd run`, the SIGHUP reconcile and the panel's
+	# config write all read UCI directly), so if it fails here it does not get
+	# retried until the next start. And it CAN fail for a mundane reason — a full
+	# /overlay makes `uci commit` fail — after which the config still carries the
+	# schema-v1 `dst_domain`/`dst_ip` options. The daemon holds every rule that
+	# still has them DISABLED and reports it, so nothing is silently misrouted, but
+	# rules the operator wrote are then not in force and the reason has to be
+	# visible somewhere. Hence: log the binary's own stderr, and start anyway —
+	# refusing to start would take the admin panel down with it, and the panel is
+	# the only way to fix the box.
+	local migrate_out
+	migrate_out=$("$PROG" migrate 2>&1) || _slog -p daemon.err \
+		"UCI schema migration FAILED: ${migrate_out:-no output from $PROG migrate}. Starting anyway; routing rules that still carry the removed dst_domain/dst_ip options stay DISABLED until this succeeds. Free space on /overlay and re-run '$PROG migrate', or restart the service."
 
 	procd_open_instance shater
 	# shaterd runs in the FOREGROUND under procd (must never daemonize). `run` is
@@ -200,6 +428,45 @@ start_service() {
 }
 
 stop_service() {
+	# Say WHY we are stopping before procd sends the signal, because the daemon
+	# cannot tell from the signal alone and the answer changes what it leaves in
+	# the kernel. Two INDEPENDENT questions, and the old code conflated them into
+	# one two-armed `case` whose else-branch answered both wrongly for `shutdown`:
+	#
+	#   1. IS A SUCCESSOR COMING (this process only)?  restart / reload.
+	#      Raise RESTART_FLAG so the outgoing daemon replaces its data plane with
+	#      the fail-closed HOLDING plane instead of removing it. The gap until the
+	#      successor applies is not a moment: this script waits out the old
+	#      process, runs `shaterd migrate`, then starts a daemon that must build an
+	#      engine — all of it, before this flag existed, with `lan -> wan ACCEPT`
+	#      and nothing else.
+	#
+	#   2. IS THE PRODUCT BEING SWITCHED OFF (across boots)?  `stop` — and only
+	#      `stop`, and only when a PERSON is behind it (shater_stop_disarms; the
+	#      package manager reaches us through `stop` too). Then the boot armor goes
+	#      with it, so the next boot does not quietly reinstate what the operator
+	#      just switched off — the same rule ACTIVE_FLAG has always enforced for
+	#      hotplug/cron.
+	#
+	# `shutdown` answers NO to both, which is the defect this replaced: a reboot is
+	# not a successor and it is certainly not an operator switching the product off.
+	# It is the boot the armor exists for. An upgrade answers NO to the second for
+	# the same kind of reason.
+	if shater_action_handoff "$SHATER_RC_ACTION"; then
+		shater_mark_restart
+	else
+		shater_clear_restart
+	fi
+	local in_pkg=0 rc_en=0
+	shater_pkg_transaction && in_pkg=1
+	shater_rc_enabled && rc_en=1
+	if shater_stop_disarms "$SHATER_RC_ACTION" "$in_pkg" "$rc_en"; then
+		shater_disarm_boot
+	elif [ "$in_pkg" = "1" ] && shater_action_disarms "$SHATER_RC_ACTION"; then
+		_slog -p daemon.info \
+			"stop came from a package transaction that left the service enabled — keeping the boot armor, so being replaced cannot leave the next boot unprotected"
+	fi
+
 	# Drop the live-flag FIRST so a concurrent hotplug/cron tick cannot rebuild
 	# what we are about to tear down. procd then sends SIGTERM to `shaterd run`,
 	# which runs its OWN honest teardown (engine.Close + netplane restore) — we
@@ -219,6 +486,11 @@ reload_service() {
 	# disabled, `start` is a no-op, so a disable+apply cleanly tears everything
 	# down. Because the wait lives in start_service, this path gets the same
 	# stop-then-start ordering guarantee as `restart`.
+	#
+	# Marked EXPLICITLY as well as via SHATER_RC_ACTION: this is the path a routine
+	# Save & Apply takes, so it is the one that must not depend on reading an
+	# rc.common variable correctly. Belt and braces, one line.
+	shater_mark_restart
 	stop
 	start
 }

openwrt/shater-core/files/etc/init.d/shater-armor

@@ -0,0 +1,162 @@
+#!/bin/sh /etc/rc.common
+# /etc/init.d/shater-armor — the fail-closed plane, before the daemon exists.
+#
+# WHAT THIS CLOSES
+#
+# /etc/init.d/shater is START=99. By then fw4 (START=19) has long since loaded
+# `lan -> wan ACCEPT` and netifd (START=20) has brought the LAN bridge up, so the
+# router forwards LAN traffic to the WAN in the clear from the moment the link
+# comes up until `shaterd run` has been decompressed off flash, has waited out any
+# predecessor, has migrated UCI, has read the config and has installed its first
+# table. On router-class hardware with a UPX-packed binary that is seconds — and
+# they are exactly the seconds in which Wi-Fi finishes associating and every
+# client on the network reconnects and starts talking. `kill_switch=closed` was
+# configured the whole time and covered none of it.
+#
+# There was nothing in the package that could cover it either: no /etc/nftables.d
+# include, no `nft -f` in uci-defaults. Protection existed only inside a Go
+# process that had not started yet.
+#
+# HOW
+#
+# The daemon persists a copy of its fail-closed HOLDING plane (the same ruleset it
+# installs when the engine is down: one forward chain, LAN-to-LAN and router
+# traffic accepted, everything else from the diverted devices dropped) to
+# $ARMOR on every apply. This script loads it early. When the daemon comes up it
+# replaces the table atomically — the ruleset begins with `delete table` and adds
+# its own in one netlink transaction — so there is never a moment with no table.
+#
+# `iifname` matches by NAME at packet time, not by ifindex at load time, so
+# loading this before netifd has created br-lan is fine: the rules simply start
+# matching when the device appears. That is why START can sit here rather than
+# racing netifd.
+#
+# START=21: after fw4 (19) and netifd (20), because fw4's own start tears its
+# table down and rebuilds it and we do not want to be in the middle of that, and
+# because there is nothing to protect before the LAN device is being created. The
+# residual exposure is the fraction of a second between netifd's `ifup` and this
+# script, against seconds-to-a-minute before.
+#
+# THE ESCAPE HATCHES (a kill switch that cannot be switched off is a brick)
+#
+# These are STATE checks, evaluated here, at the moment of arming — not a record
+# of something that happened on the way down. That distinction is the whole
+# lesson of v0.2.17: the arm token was deleted by an EVENT on the shutdown path
+# ("this looks like a stop"), and since `reboot` also runs the K-links, the
+# mechanism reliably erased itself on the one transition it was built for. An
+# event on the way down cannot be trusted to describe the world on the way up; a
+# question asked on the way up can be.
+#
+#   * $ARMOR only exists while the daemon's last applied config was BOTH enabled
+#     and fail-closed. `globals.enabled=0` and `kill_switch=open` each remove it
+#     at the next apply, and an operator typing `/etc/init.d/shater stop` removes
+#     it there and then. Powering the box off does NOT.
+#   * We refuse to arm when the main service is disabled in rc.d, or when the
+#     daemon binary is gone — in either case nothing would ever come along to
+#     replace the armor with a real data plane. These two are what makes a
+#     genuinely uninstalled/disabled product safe REGARDLESS of what the file
+#     says, which is why they are checked here rather than trusted to have been
+#     acted on earlier.
+#   * We refuse to arm when UCI can be read AND says the stack is disabled. A
+#     config that cannot be read is NOT a refusal: that case is precisely why the
+#     armor is a file rather than a query.
+#   * The chain hooks `forward` only, so SSH, LuCI and the admin panel (all input
+#     hook, to the router's own addresses) stay reachable. The operator can always
+#     get in and undo this.
+#
+# Note what a bare `/etc/init.d/shater stop` does NOT mean: it does not survive a
+# reboot, because S99shater is still linked and procd starts the daemon again. So
+# "stopped" is not a durable off-state and this script must not be designed as if
+# it were — the durable ones are `disable` (no S??shater) and `globals.enabled=0`,
+# and those are the two refusals above.
+#
+# busybox ash only — no bashisms.
+
+START=21          # after firewall (19) and network (20), long before shater (99)
+STOP=89
+
+ARMOR=/etc/shater/boot.nft
+PROG=/usr/bin/shaterd
+
+# Syslog line that honors globals.log_syslog, like the other two inits. An
+# unreadable UCI leaves the option empty => ON, which is what we want here: the
+# one boot where the config cannot be read is the boot worth logging.
+_slog() {
+	[ "$(uci -q get shater.globals.log_syslog)" = "0" ] || logger -t shater-armor "$@"
+}
+
+# Is the MAIN service enabled at boot? Answered by looking for its rc.d symlink
+# rather than by running `/etc/init.d/shater enabled`: that is a USE_PROCD script,
+# so every action of it sources procd.sh, which takes a blocking flock — and this
+# runs at START=21, in the middle of boot, for a question a glob answers exactly
+# as well. The START number is not hardcoded; any S<NN>shater counts.
+shater_service_enabled() {
+	local f
+	for f in /etc/rc.d/S[0-9][0-9]shater; do
+		[ -e "$f" ] && return 0
+	done
+	return 1
+}
+
+start() {
+	# No saved plane => the stack has never applied an enabled, fail-closed config
+	# (or it was explicitly switched off). Nothing to do, and nothing to say.
+	[ -f "$ARMOR" ] || return 0
+	[ -s "$ARMOR" ] || {
+		_slog -p daemon.err "$ARMOR is empty — NOT arming; the LAN is unprotected until shaterd starts"
+		return 0
+	}
+
+	# Never arm something nothing can disarm.
+	[ -x "$PROG" ] || {
+		_slog -p daemon.err \
+			"$PROG is missing — NOT arming (nothing would replace the block with a working data plane); the LAN stays on plain routing"
+		return 0
+	}
+	shater_service_enabled || {
+		_slog -p daemon.warn \
+			"the shater service is disabled in rc.d — NOT arming (nothing would replace the block with a working data plane); the LAN stays on plain routing"
+		return 0
+	}
+
+	# A READABLE config that says "off" wins over the saved plane (it means the
+	# daemon was stopped before it could disarm). An UNREADABLE config does not:
+	# that is the case this whole mechanism exists for.
+	en=$(uci -q get shater.globals.enabled 2>/dev/null)
+	if [ -n "$en" ] && [ "$en" != "1" ]; then
+		rm -f "$ARMOR"
+		_slog -p daemon.info "globals.enabled=$en — boot armor removed, not arming"
+		return 0
+	fi
+
+	command -v nft >/dev/null 2>&1 || {
+		_slog -p daemon.err "nft is not installed — cannot arm; the LAN is unprotected until shaterd starts"
+		return 0
+	}
+
+	# Validate before loading: a truncated/incompatible snapshot must not leave a
+	# half-built table behind on the one boot it is needed.
+	if ! nft -c -f "$ARMOR" >/dev/null 2>&1; then
+		_slog -p daemon.err \
+			"$ARMOR did not validate (nft -c) — NOT arming; the LAN is unprotected until shaterd starts"
+		return 0
+	fi
+	if nft -f "$ARMOR" >/dev/null 2>&1; then
+		_slog -p daemon.warn \
+			"fail-closed plane armed from $ARMOR: LAN->WAN forwarding is BLOCKED until shaterd applies. SSH, LuCI and the admin panel stay reachable."
+	else
+		_slog -p daemon.err \
+			"could not load $ARMOR — the LAN is unprotected until shaterd starts"
+	fi
+	return 0
+}
+
+stop() {
+	# Deliberately a NO-OP. By the time anything stops this service the daemon owns
+	# `inet shater`, and deleting the table here would dismantle a LIVE data plane
+	# on the strength of a service that only ever ran for one second at boot. The
+	# disarm paths that matter live where the decision is actually made:
+	# /etc/init.d/shater stop (operator switched it off) and the daemon itself
+	# (globals.enabled=0 / kill_switch=open).
+	return 0
+}

openwrt/shater-core/files/etc/init.d/shater-cron

@@ -3,11 +3,12 @@
 # plus the data-plane watchdog (v0.2).
 #
 # A tiny procd-supervised loop that, once per tick, checks every enabled
-# subscription and url-ruleset against its per-item `update_interval` and runs
+# subscription against its per-item `update_interval` and runs
 #   shaterd sub update <name>       (subscriptions)
-#   shaterd ruleset update <name>   (url rulesets)
 # when the item is due, then a single `shaterd reconcile` if anything changed
 # (the daemon's config-hash gate rebuilds the engine only on a real change).
+# `config ruleset` items are NOT touched here — see shater_run_due for who owns
+# their refresh and where the remaining gap is.
 #
 # RELIABILITY CONTRACT (same "железно" posture as /etc/init.d/shater):
 #   * The loop body is fully INERT unless globals.enabled=1 AND the main shater
@@ -27,6 +28,15 @@
 #     the main service is STOPPED (tears interception down — fail-open, LAN
 #     returns to plain routing); with kill_switch=closed the rules stay
 #     (blocked-by-design) and we log loudly.
+#   * CRASH-LOOP WATCHDOG: the dead-daemon counter above cannot see the failure
+#     it matters most for. /etc/init.d/shater sets `respawn 3600 5 0`, so a
+#     daemon that dies a few seconds into startup is back within 5s and a single
+#     `pidof` per 60s tick nearly always finds a process — the counter resets and
+#     never reaches WATCHDOG_TICKS, while the fail-closed plane keeps the LAN shut
+#     and the panel (served BY the daemon) never comes up. So the tick's sleep is
+#     spent SAMPLING the daemon's identity instead of sleeping blind, and a tick in
+#     which several different daemons lived is counted as churn. See
+#     shater_churn_scan / shater_churn_verdict / shater_churn_action.
 #   * The loop never self-exits (procd would respawn-churn an exiting body);
 #     it idles on its guards instead. busybox ash only — no bashisms.
 
@@ -42,14 +52,34 @@ INIT_SCRIPT=/etc/init.d/shater-cron
 SHATER_INIT=/etc/init.d/shater
 SHATERD=/usr/bin/shaterd
 ACTIVE_FLAG=/var/run/shater.active
+# Raised by /etc/init.d/shater around a restart/reload and cleared by the
+# successor's start_service. Read here ONLY as a "a person/package asked for this
+# bounce" veto on the crash-loop verdict — never as a liveness signal.
+RESTART_FLAG=/var/run/shater.restarting
+# Written by `shaterd run` itself (main.go writePidfile) before it builds anything,
+# and removed by that same process on a clean exit. It is the only handle that
+# names THE daemon: `pidof shaterd` also matches the short-lived CLI verbs this
+# very loop runs (`sub update`, `reconcile`, `schedule due`).
+PIDFILE=/var/run/shaterd.pid
 STAMP_DIR=/var/run/shater/cron
 TICK=60                          # seconds between due-checks
 RETRY_SECS=300                   # backoff before retrying a FAILED fetch
 WATCHDOG_TICKS=5                 # consecutive dead-daemon ticks before escalating
 DEFAULT_SUB_INTERVAL=6h
-DEFAULT_RS_INTERVAL=24h
 DEFAULT_BL_INTERVAL=24h          # url blocklist refresh interval (D16)
 
+# --- crash-loop watchdog tuning --------------------------------------------
+#
+# Every number here is chosen against ONE question: what can a legitimate restart
+# produce? A legitimate bounce (`restart`, LuCI Save & Apply -> reload, a package
+# transaction) replaces the daemon EXACTLY ONCE, and it is announced twice over —
+# /etc/init.d/shater raises RESTART_FLAG in stop_service and clears ACTIVE_FLAG for
+# the duration. A crash loop is announced by nothing and repeats without bound.
+LOOP_POLL=5                      # seconds between identity samples inside one tick
+LOOP_MIN_GENS=3                  # distinct daemons in ONE tick that count as churn
+LOOP_WINDOWS=2                   # consecutive churn ticks before we call it a loop
+LOOP_REPORT_TICKS=30             # do not repeat the report more often than this
+
 # --- helpers ---------------------------------------------------------------
 
 shater_enabled() {
@@ -133,7 +163,7 @@ shater_stamp_retry() {
 # Walk anonymous `config subscription` / `config ruleset` sections by index and
 # run any that are due. Echoes non-empty on stdout if at least one item updated.
 shater_run_due() {
-	local i name en ivl secs stamp src changed=""
+	local i name en ivl secs stamp changed=""
 
 	# Subscriptions.
 	i=0
@@ -159,28 +189,36 @@ shater_run_due() {
 		i=$(( i + 1 ))
 	done
 
-	# Rulesets (only url sources auto-update; others have nothing to fetch).
-	i=0
-	while uci -q get "shater.@ruleset[$i]" >/dev/null 2>&1; do
-		name=$(uci -q get "shater.@ruleset[$i].name")
-		src=$(uci -q get "shater.@ruleset[$i].source")
-		if [ -n "$name" ] && [ "$src" = "url" ]; then
-			ivl=$(uci -q get "shater.@ruleset[$i].update_interval")
-			secs=$(shater_ivl_secs "$ivl" "$DEFAULT_RS_INTERVAL")
-			stamp="$STAMP_DIR/rs.$(shater_safe_name "$name")"
-			if shater_due "$stamp" "$secs"; then
-				if "$SHATERD" ruleset update "$name" >/dev/null 2>&1; then
-					shater_stamp "$stamp"
-					changed=1
-				else
-					_slog -p daemon.warn \
-						"ruleset update '$name' failed; retrying in ${RETRY_SECS}s"
-					shater_stamp_retry "$stamp" "$secs"
-				fi
-			fi
-		fi
-		i=$(( i + 1 ))
-	done
+	# RULE-SETS ARE NOT UPDATED FROM HERE, AND NEVER WERE.
+	#
+	# There used to be a second loop that ran `shaterd ruleset update <name>` for
+	# every `config ruleset` with source=url. That verb has never existed: it
+	# printed a note and exited 0, so this loop stamped the item as freshly updated
+	# and raised `changed`, which cost a reconcile per item per interval and told
+	# the operator the list was current when not one byte had been fetched. The verb
+	# now exits non-zero (shater/cmd/shaterd/main.go, notImpl), which turns the same
+	# loop into one failed attempt and one syslog line every RETRY_SECS — ~288 lines
+	# a day, per rule-set, about work that has no owner here. Noise in the log hides
+	# real problems as effectively as a lie about success does.
+	#
+	# WHO REFRESHES A url RULE-SET NOW, so the next reader does not think this was
+	# forgotten. `source=url` splits into two shapes in shater/generate/ruleset.go:
+	#
+	#   * the URL serves an engine-native .srs/.json -> it stays a REMOTE rule-set
+	#     and sing-box owns fetch/cache/refresh through RemoteRuleSet.UpdateInterval
+	#     on the running box. This cron loop never had anything to contribute.
+	#   * the URL serves a plain-text list -> it is compiled locally into
+	#     /etc/shater/lists/<tag>.srs, and that artifact is refreshed by the
+	#     GENERATOR, "when missing or older than update_interval" — i.e. only when
+	#     something else already caused a generate. Nothing schedules one, so this
+	#     shape has NO periodic refresh at all today. That is a real gap, and it is
+	#     stated here rather than papered over with a call to a verb that does
+	#     nothing: closing it needs a daemon-side timer (or a real `ruleset update`),
+	#     not a shell loop, because only the daemon can force a rebuild past the
+	#     config-hash gate.
+	#
+	# `config blocklist` url items are a different mechanism and DO refresh — see
+	# shater_run_due_blocklists below.
 
 	[ -n "$changed" ] && echo 1
 }
@@ -256,6 +294,171 @@ shater_watchdog() {
 	echo "$dead"
 }
 
+# --- crash-loop watchdog ----------------------------------------------------
+#
+# THE HOLE. shater_watchdog above answers "is a daemon there?" once every TICK
+# seconds. /etc/init.d/shater sets `respawn 3600 5 0`, so a daemon that dies a few
+# seconds into startup is back 5s later and that one sample nearly always finds a
+# process: the dead-counter resets, never reaches WATCHDOG_TICKS, and the single
+# failure the watchdog exists for — a new binary or a bad config that cannot get
+# an engine up while the fail-closed plane holds the LAN shut — is the one it can
+# never see. The daemon also serves the panel, so in that state the operator has
+# neither internet nor a way to look at the box.
+#
+# THE SIGNAL. Not "is it there" but "is it the SAME one". The tick's sleep is
+# spent taking an identity sample every LOOP_POLL seconds instead of sleeping
+# blind, and a tick in which LOOP_MIN_GENS different daemons lived is a churn
+# tick. LOOP_WINDOWS consecutive churn ticks is the verdict.
+#
+# WHY A LEGITIMATE RESTART CANNOT REACH IT. Four independent reasons, in order of
+# how much they are relied on:
+#
+#   1. A bounce replaces the daemon ONCE. One restart scores 2 generations in the
+#      tick it happens in and 1 in every tick after, so it cannot even produce a
+#      single churn tick at LOOP_MIN_GENS=3, let alone LOOP_WINDOWS of them in a
+#      row. Reaching the verdict takes >= 4 replacements inside 2 consecutive
+#      minutes, >= 2 in each.
+#   2. Bounces are ANNOUNCED. /etc/init.d/shater raises RESTART_FLAG in
+#      stop_service and clears ACTIVE_FLAG for the whole stop->start, and either
+#      one seen in any sample of a tick discards that tick outright.
+#   3. The panel's Apply does not restart anything: it writes UCI and applies over
+#      the daemon's control socket, in process. Only `restart`, a LuCI Save &
+#      Apply (config.change -> reload) and a package transaction bounce the
+#      daemon, and a human cannot produce those at four a minute.
+#   4. The sample names THE daemon via its pidfile, not `pidof shaterd` — the
+#      short-lived CLI verbs this very loop runs share that process name.
+#
+# WHAT IT DOES NOT COVER, stated rather than implied: a daemon that dies
+# INSTANTLY (well under a second) is almost never caught alive by a 5s sample, so
+# it scores few generations and this detector stays quiet. That case is exactly
+# the one the existing dead-tick counter does see — its `pidof` misses too, tick
+# after tick — so the two cover opposite ends and are deliberately left as two
+# independent instruments rather than merged into one clever number.
+
+# One identity sample: echoes the pid of the live `shaterd run`, or "-" for none.
+#
+# Through the PIDFILE, which `shaterd run` writes before it builds anything and
+# removes on a clean exit, because that is the only handle that names THE daemon:
+# `pidof shaterd` also matches `shaterd sub update` / `reconcile` / `schedule due`.
+# /proc/<pid>/comm is checked so a stale pidfile whose pid has been reused by an
+# unrelated process cannot read as a live daemon. No forks: `read` is a builtin.
+shater_sample_pid() {
+	local pid="" comm=""
+	[ -r "$PIDFILE" ] && read -r pid 2>/dev/null < "$PIDFILE"
+	case "$pid" in
+		''|*[!0-9]*) echo -; return ;;
+	esac
+	[ -r "/proc/$pid/comm" ] && read -r comm 2>/dev/null < "/proc/$pid/comm"
+	[ "$comm" = "shaterd" ] || { echo -; return; }
+	echo "$pid"
+}
+
+# shater_churn_scan <sample>...  ->  "<generations> <absent-samples>"
+#
+# A GENERATION is one distinct daemon lifetime observed during the tick: a live
+# pid that differs from the last live pid seen. A daemon that simply keeps running
+# therefore scores exactly 1 generation and 0 absent samples for as long as it
+# runs — the signal is flat unless something is actually being replaced.
+#
+# A GAP (samples with no daemon at all, e.g. procd's 5s respawn hole) is counted
+# but does NOT by itself open a new generation: only a different pid does. An
+# earlier draft reset the comparison across a gap so that "same pid seen again
+# after a gap" would score two. That case cannot occur — a respawn always gets a
+# fresh pid — so it was unfalsifiable code, and resetting also meant a momentarily
+# unreadable pidfile could inflate the count. Not resetting is both simpler and
+# the safer direction.
+#
+# Pure: no I/O, no globals, every input on the command line. That is what lets the
+# gate drive it with synthetic sample streams instead of a live router.
+shater_churn_scan() {
+	local gens=0 absent=0 last="" s
+	for s in "$@"; do
+		if [ "$s" = "-" ]; then
+			absent=$(( absent + 1 ))
+			continue
+		fi
+		[ "$s" = "$last" ] || gens=$(( gens + 1 ))
+		last="$s"
+	done
+	echo "$gens $absent"
+}
+
+# shater_churn_verdict <gens> <samples> <announced> <churn-so-far>
+#   -> the new consecutive-churn-tick count
+#
+# Also pure. `announced`=1 means a sample during the tick saw RESTART_FLAG up or
+# ACTIVE_FLAG down, i.e. /etc/init.d/shater said out loud that it was bouncing the
+# daemon: that tick proves nothing and resets the run. A tick with no samples at
+# all (the first pass through the loop) likewise scores 0 rather than guessing.
+shater_churn_verdict() {
+	local gens="$1" n="$2" announced="$3" churn="$4"
+	[ "$announced" = "1" ] && { echo 0; return; }
+	[ "$n" -gt 0 ] || { echo 0; return; }
+	if [ "$gens" -ge "$LOOP_MIN_GENS" ]; then
+		echo $(( churn + 1 ))
+		return
+	fi
+	echo 0
+}
+
+# shater_churn_action <churn-ticks> <kill_switch>  ->  none | log | stop
+#
+# WHAT TO DO, and why it is not our call to make twice. A crash loop leaves the
+# box in the same state a dead daemon does — no engine, fail-closed plane standing
+# — so the answer is the one the operator already gave with kill_switch, not a new
+# policy invented here:
+#
+#   open   The operator asked for connectivity over interception. Stop the stack,
+#          exactly as shater_watchdog does for a sustained-dead daemon: the plane
+#          comes down and the LAN returns to plain routing. It also disarms the
+#          boot armor, so the NEXT boot is clean too instead of repeating the loop
+#          behind a closed LAN. Nothing else can end the loop: procd's retries are
+#          infinite by design.
+#   closed The operator asked for blocked-over-leaking. Blocked is what they get,
+#          and opening their LAN from a background loop would be the opposite of
+#          what the knob says. Report it loudly and let the person decide; the
+#          message names the one command that opens it.
+#
+# The list is POSITIVE and CLOSED, and the fall-through goes to `log`: an absent
+# or unrecognised kill_switch is the model's documented default ("closed", see
+# shater/model/model.go DefaultGlobals), and `log` is the recoverable side — it
+# changes nothing and can be acted on, where a wrong `stop` silently drops a
+# household onto the unproxied WAN.
+#
+# NOTE (not changed here, deliberately): shater_watchdog above answers the same
+# question with `if closed ... else stop`, so for an ABSENT kill_switch it fails
+# open — the opposite of the documented default. It is left alone because that
+# behaviour predates this file's crash-loop work; it is reported upward instead.
+shater_churn_action() {
+	local churn="$1" ks="$2"
+	[ "$churn" -ge "$LOOP_WINDOWS" ] || { echo none; return; }
+	case "$ks" in
+		open)   echo stop ;;
+		closed) echo log ;;
+		*)      echo log ;;
+	esac
+}
+
+# Sleep out one tick in LOOP_POLL slices, sampling the daemon's identity as we go.
+# Publishes CHURN_SAMPLES / CHURN_N / CHURN_ANNOUNCED for the next pass of loop().
+# Deliberately NOT a subshell (globals must survive), and it always returns 0 so a
+# false `[ -f ]` at the end cannot look like a failure.
+shater_tick_sample() {
+	local slept=0
+	CHURN_SAMPLES=""
+	CHURN_N=0
+	CHURN_ANNOUNCED=0
+	while [ "$slept" -lt "$TICK" ]; do
+		sleep "$LOOP_POLL"
+		slept=$(( slept + LOOP_POLL ))
+		CHURN_SAMPLES="$CHURN_SAMPLES $(shater_sample_pid)"
+		CHURN_N=$(( CHURN_N + 1 ))
+		[ -f "$RESTART_FLAG" ] && CHURN_ANNOUNCED=1
+		[ -f "$ACTIVE_FLAG" ] || CHURN_ANNOUNCED=1
+	done
+	return 0
+}
+
 # loop: the foreground body supervised by procd. Never exits on its own — it
 # idles while disabled/inactive so procd is not respawn-churned by a
 # self-exiting body when the stack is off.
@@ -274,7 +477,12 @@ loop() {
 	# the flock immediately and keeps children (sleep/shaterd) from inheriting
 	# it. A no-op where fd 1000 is not open (older procd.sh without procd_lock).
 	exec 1000>&-
-	local changed dead=0
+	local changed dead=0 churn=0 quiet=0 scan gens absent ks act
+	# No tick has been sampled yet on the first pass; shater_churn_verdict scores
+	# an empty tick as 0 rather than guessing.
+	CHURN_SAMPLES=""
+	CHURN_N=0
+	CHURN_ANNOUNCED=0
 	mkdir -p "$STAMP_DIR"
 	while :; do
 		if shater_enabled && shater_active; then
@@ -299,10 +507,44 @@ loop() {
 				"$SHATERD" schedule due >/dev/null 2>&1
 			fi
 			dead=$(shater_watchdog "$dead")
+
+			# Crash-loop verdict on the tick that has just elapsed. Unquoted on
+			# purpose: CHURN_SAMPLES is a whitespace-separated token list and word
+			# splitting is how it becomes arguments.
+			scan=$(shater_churn_scan $CHURN_SAMPLES)
+			gens=${scan%% *}
+			absent=${scan##* }
+			churn=$(shater_churn_verdict "$gens" "$CHURN_N" "$CHURN_ANNOUNCED" "$churn")
+			ks=$(uci -q get shater.globals.kill_switch)
+			act=$(shater_churn_action "$churn" "$ks")
+			case "$act" in
+				stop)
+					_slog -p daemon.crit \
+						"shaterd is CRASH-LOOPING: $gens distinct daemons in the last ${TICK}s (absent in $absent of $CHURN_N samples), $churn such windows in a row — it is being respawned faster than it can bring an engine up. kill_switch=open, so shater is being STOPPED: interception comes down and the LAN returns to plain, UNPROXIED routing. Find the reason with 'logread -e shaterd', then '/etc/init.d/shater start'."
+					"$SHATER_INIT" stop
+					churn=0
+					quiet="$LOOP_REPORT_TICKS"
+					;;
+				log)
+					# Rate-limited: a standing condition, not an event. Never
+					# silent for good, though — an operator who looks at the log an
+					# hour later must still find it being said.
+					if [ "$quiet" -le 0 ]; then
+						_slog -p daemon.crit \
+							"shaterd is CRASH-LOOPING: $gens distinct daemons in the last ${TICK}s (absent in $absent of $CHURN_N samples), $churn such windows in a row — it is being respawned faster than it can bring an engine up. kill_switch=${ks:-closed} keeps the fail-closed plane standing, so the LAN stays blocked and the admin panel is down with the daemon that serves it. Nothing is decided for you: find the reason with 'logread -e shaterd', or open the LAN with '/etc/init.d/shater stop'."
+						quiet="$LOOP_REPORT_TICKS"
+					fi
+					churn=0
+					;;
+			esac
+			[ "$quiet" -gt 0 ] && quiet=$(( quiet - 1 ))
 		else
 			dead=0
+			churn=0
+			quiet=0
 		fi
-		sleep "$TICK"
+		# Sleeps out the tick, sampling the daemon's identity while it does.
+		shater_tick_sample
 	done
 }
 

openwrt/shater-core/files/etc/uci-defaults/30_shater-core

@@ -59,6 +59,199 @@ if uci -q get shater.globals >/dev/null 2>&1 || [ -f /etc/config/shater ]; then
 	uci -q commit shater
 fi
 
+# Introduce the daemon-created `shater-l3*` TUN to fw4 (L3 ingress, D-L3). The
+# daemon policy-routes LAN ICMP into that device from OUR nft table
+# `inet shater`, but nftables runs EVERY table on every packet and a drop in
+# any one of them wins — an accept in `inet shater` cannot override fw4. And
+# fw4 WILL drop this forward: netifd knows nothing about a device the daemon
+# creates at runtime, so it belongs to no zone and falls into fw4's zone-less
+# defaults (REJECT). The device has to be declared to fw4 itself; it cannot be
+# fixed from our own table.
+#
+# Seeded UNCONDITIONALLY (not gated on globals.l3_tunnel): uci-defaults run
+# once, so gating on the option would require re-running this script when the
+# option is flipped later — which never happens. An idle zone is harmless: its
+# device match is a plain iifname/oifname STRING compare that simply never hits
+# while the TUN does not exist.
+#
+# Idempotency: `config zone`/`config forwarding` are normally ANONYMOUS
+# sections, and a naive `uci add firewall zone` would append a duplicate on
+# every re-run (uci-defaults re-run on package upgrade/reinstall). The zone is
+# NAMED instead, guarded by an existence check — a re-run re-finds the section
+# and touches nothing. The forwardings are named too where the name is free, but
+# their guard is a scan of the actual src/dest pairs, which is stronger; see
+# seed_l3_forwarding below.
+seed_l3_zone() {
+	# No fw4 on this image (bare nftables build) => nothing drops the forward
+	# on fw4's behalf and there is nothing to punch through.
+	[ -f /etc/config/firewall ] || return 0
+	if ! uci -q get firewall.shater_l3 >/dev/null; then
+		uci set firewall.shater_l3=zone
+		uci set firewall.shater_l3.name='shater_l3'
+		uci set firewall.shater_l3.input='REJECT'
+		uci set firewall.shater_l3.output='ACCEPT'
+		uci set firewall.shater_l3.forward='REJECT'
+		uci set firewall.shater_l3.masq='0'
+		# INERT TODAY, kept for the day it is not. mtu_fix clamps forwarded TCP
+		# MSS to the route MTU — but the L3 TUN is 65535 (deliberately: at any
+		# smaller value the kernel fragments into the device, and the flow
+		# dispatcher refuses to judge a fragment and lets the stack forge the
+		# echo reply — see l3MTU in shater/generate/inbound.go), so the clamp has
+		# nothing to clamp to. And only ICMP is ever marked into this device, so
+		# no TCP rides here to be clamped in the first place. It earns its keep
+		# the moment either of those changes; removing it would make that day
+		# silent.
+		uci set firewall.shater_l3.mtu_fix='1'
+		# `list device`, deliberately NOT the usual `list network`: fw4
+		# resolves a zone's networks through netifd, and netifd never learns
+		# about a device the daemon creates at runtime — a stub interface
+		# (proto none) would need to be brought UP to contribute an l3_device,
+		# and nothing ever brings it up, so `list network` resolves to an
+		# EMPTY device set and fw4 keeps dropping the forward. `list device`
+		# instead compiles to an iifname/oifname STRING match, valid before
+		# the TUN exists and matching from the moment shaterd creates it —
+		# no netifd involvement and no firewall reload at enable time. Do not
+		# "normalize" this to `list network` in a refactor; it breaks silently.
+		#
+		# The WILDCARD is load-bearing too. The daemon no longer opens one fixed
+		# device: it alternates between `shater-l3a` and `shater-l3b` so that a
+		# new engine generation never has to reopen the name the previous one is
+		# still holding (that collision — TUNSETIFF: device or resource busy —
+		# took the whole LAN down on the production router, because the recovery
+		# path rebuilt the same config and hit the same busy name). fw4 compiles
+		# `shater-l3*` to `iifname "shater-l3*"` / `oifname "shater-l3*"`,
+		# verified on ImmortalWrt 25.12.1 with nftables 1.1.6, so ONE zone covers
+		# every slot and no firewall reload is needed when the slot changes.
+		uci add_list firewall.shater_l3.device='shater-l3*'
+	fi
+	seed_l3_forwardings
+	uci -q commit firewall
+}
+
+# EVERY zone gets a forwarding into shater_l3, not just `lan`.
+#
+# The bug this closes is silent by construction. The daemon's divert set is built
+# from every enabled `config inbound`'s network PLUS every device a rule names
+# through an `iface:`/`zone:` source (shater/netplane/nft.go, nftDivertRefs) — so
+# on a router with several LAN zones, ICMP from ALL of them is marked and routed
+# into the TUN by our table. Our table then accepts it and fw4 drops it anyway,
+# because the forward is judged in `forward_<source zone>` and only `lan` had a
+# jump to `accept_to_shater_l3`. Result: ping through the tunnel works from one
+# subnet and not from the next, with nothing in any log to say why — fw4's drop
+# is the zone's policy verdict, not a rule with a name. The owner's production
+# router has a single LAN zone, which is exactly why this went unnoticed; his
+# second router has three.
+#
+# Every zone, including an uplink zone, and that is deliberate rather than lazy:
+#
+#   - The alternative is guessing which zones hold clients, and every available
+#     signal is wrong somewhere. `masq='1'` marks the WAN on a stock config and
+#     also marks a double-NAT LAN. The name `wan*` is a convention, not a rule.
+#     A guess that is wrong reintroduces exactly the silent breakage above, while
+#     a superfluous entry costs a line of ruleset.
+#   - A forwarding into shater_l3 permits nothing on its own. It authorises the
+#     forward of packets ROUTED INTO the TUN, and the only thing that routes a
+#     packet there is our own fwmark rule, which matches solely on the divert
+#     device set. A packet arriving on the WAN is not marked and never reaches
+#     this decision; if an operator ever puts a WAN device in the divert set,
+#     they meant to and this is the entry that makes it work.
+#   - The reverse direction is NOT opened: no `src shater_l3` forwarding exists,
+#     so nothing comes out of the TUN into a zone by way of these sections. The
+#     engine's own replies return on the conntrack `established,related accept`
+#     at the top of fw4's forward chain.
+#
+# LIMIT, stated because it is not obvious: this is a SNAPSHOT. uci-defaults run
+# at first boot and on package install/upgrade, so a zone created AFTER the last
+# shater-core install has no forwarding until the next one. Re-running this
+# script (or reinstalling the package) re-seeds. The durable fix belongs in the
+# daemon, which recomputes the divert set on every apply and already knows which
+# zones are in it; it is deliberately not attempted from here.
+seed_l3_forwardings() {
+	uci -q show firewall 2>/dev/null |
+		sed -n "s/^firewall\.\([^.=]*\)=zone\$/\1/p" |
+		while read -r sid; do
+			zone=$(uci -q get "firewall.$sid.name")
+			# Unnamed zone: fw4 cannot reference it from a forwarding either.
+			[ -n "$zone" ] || continue
+			# Our own zone: a forwarding from shater_l3 to itself is meaningless.
+			[ "$zone" = "shater_l3" ] && continue
+			seed_l3_forwarding "$zone"
+		done
+}
+
+# One `config forwarding` <zone> -> shater_l3, created only if no such forwarding
+# exists yet.
+#
+# The guard scans the ACTUAL src/dest pairs rather than trusting a section id,
+# which covers all three ways one can already be there: the legacy named section
+# `shater_l3_fwd` seeded by earlier releases (src=lan), the per-zone names this
+# function writes, and an anonymous one an operator added by hand. Without that,
+# a re-run — uci-defaults re-run on every package upgrade — would append a
+# duplicate for `lan` on every upgrade.
+seed_l3_forwarding() {
+	local zone="$1" sid found
+
+	found=$(uci -q show firewall 2>/dev/null |
+		sed -n "s/^firewall\.\([^.=]*\)=forwarding\$/\1/p" |
+		while read -r f; do
+			[ "$(uci -q get "firewall.$f.dest")" = "shater_l3" ] || continue
+			[ "$(uci -q get "firewall.$f.src")" = "$zone" ] || continue
+			echo yes
+			break
+		done)
+	[ -n "$found" ] && return 0
+
+	# Section ids are [a-zA-Z0-9_] only, while a zone name may legally carry a
+	# hyphen — sanitise, and keep the legacy id for `lan` so an existing install
+	# is recognised as already seeded rather than gaining a second section.
+	if [ "$zone" = "lan" ]; then
+		sid="shater_l3_fwd"
+	else
+		sid="shater_l3_fwd_$(printf '%s' "$zone" | sed 's/[^a-zA-Z0-9_]/_/g')"
+	fi
+	# The id may still be taken — by a section for a DIFFERENT zone whose name
+	# sanitises to the same thing, or by something else entirely. Fall back to an
+	# anonymous section rather than overwrite: the src/dest scan above is what
+	# makes this idempotent, the name is only there to be readable.
+	if uci -q get "firewall.$sid" >/dev/null; then
+		sid=$(uci add firewall forwarding) || return 0
+	else
+		uci set "firewall.$sid=forwarding"
+	fi
+	uci set "firewall.$sid.src=$zone"
+	uci set "firewall.$sid.dest=shater_l3"
+}
+seed_l3_zone
+
+# Upgrade path for routers seeded by a pre-slot build.
+#
+# The block above only runs when the zone does NOT exist, which is exactly right
+# for idempotency and exactly wrong here: an already-installed router has the
+# zone with the OLD exact device `shater-l3`, that name matches no slot, and fw4
+# would go back to dropping the forward — i.e. LAN ping through the tunnel dies
+# silently on upgrade while everything reports healthy. Rewrite it in place.
+#
+# Narrow on purpose: only the literal legacy entry is replaced, and only when the
+# wildcard is not already listed, so an operator who added devices of their own
+# keeps them and a re-run changes nothing (uci-defaults re-run on every package
+# upgrade). No `fw4 reload` here — uci-defaults run before the firewall starts on
+# boot, and on a package upgrade the daemon's next apply is what needs the zone,
+# not this script.
+migrate_l3_zone_wildcard() {
+	[ -f /etc/config/firewall ] || return 0
+	uci -q get firewall.shater_l3 >/dev/null || return 0
+	devs=$(uci -q get firewall.shater_l3.device) || return 0
+	case " $devs " in
+		*" shater-l3* "*) return 0 ;;   # already migrated
+		*" shater-l3 "*) ;;             # legacy exact name present
+		*) return 0 ;;
+	esac
+	uci -q del_list firewall.shater_l3.device='shater-l3'
+	uci add_list firewall.shater_l3.device='shater-l3*'
+	uci -q commit firewall
+}
+migrate_l3_zone_wildcard
+
 # Bring the UCI schema forward on upgrade (idempotent; refuses a newer schema).
 [ -x /usr/bin/shaterd ] && /usr/bin/shaterd migrate >/dev/null 2>&1
 
@@ -110,8 +303,27 @@ SHATER_BRINGUP='
 	done
 	[ -x /etc/init.d/shater ] && /etc/init.d/shater enable
 	[ -x /etc/init.d/shater-cron ] && /etc/init.d/shater-cron enable
+	# The boot-time fail-closed armor. `enable` only — it is a one-shot that loads
+	# the persisted holding plane at START=21, and running it NOW would install a
+	# block on a live box moments before the daemon replaces it anyway. It has to
+	# be enabled here regardless of whether the stack is on: the file it loads only
+	# exists while the daemon wants it to, so an enabled-but-unarmed service is a
+	# no-op, and enabling it later would mean the first boot after an upgrade is
+	# the one boot still exposed.
+	[ -x /etc/init.d/shater-armor ] && /etc/init.d/shater-armor enable
 	[ -x /etc/init.d/shater ] && /etc/init.d/shater restart
 	[ -x /etc/init.d/shater-cron ] && /etc/init.d/shater-cron restart
+	# Fold the seeded shater_l3 zone into the LIVE ruleset — matters on a live
+	# opkg/apk install only, where firewall started long before our commit and
+	# nothing else would re-read it until the next reboot. Gated on the fw4
+	# table actually being loaded: at FIRST boot this job can run before the
+	# S19 firewall start, and an early reload would install a ruleset built
+	# from a half-initialized netifd AND make the later start a no-op (fw4
+	# start skips when its table already exists). No table => the pending S19
+	# start reads the committed config by itself, no reload needed.
+	if nft list tables 2>/dev/null | grep -q "inet fw4"; then
+		[ -x /etc/init.d/firewall ] && /etc/init.d/firewall reload
+	fi
 	exit 0
 '
 SHATER_TMO=""

openwrt/shater-core/files/lib/upgrade/keep.d/shater-core

@@ -0,0 +1,80 @@
+# /lib/upgrade/keep.d/shater-core — what sysupgrade and LuCI "Backup" must carry
+# out of /etc/shater.
+#
+# HOW THIS FILE IS READ. /sbin/sysupgrade (base-files, list_static_conffiles):
+#
+#	find $(sed -ne '/^[[:space:]]*$/d; /^#/d; p' \
+#		/etc/sysupgrade.conf /lib/upgrade/keep.d/* 2>/dev/null) \
+#		\( -type f -o -type l \) $filter 2>/dev/null
+#
+# so blank lines and lines starting with '#' are stripped, and every other line is
+# a path handed to `find`: a directory is recursed, a path that does not exist is
+# silently skipped (hence a trailing '/' for the two directories, and no need to
+# guard for a fresh install that has neither). The result is tarred and, on a real
+# sysupgrade, HELD IN RAM across the flash — which is why this is a per-file
+# decision and not simply "/etc/shater/".
+#
+# WHY IT EXISTS. Everything the product knows besides /etc/config/shater lives in
+# /etc/shater, and nothing shipped a keep.d entry for it. A "keep settings"
+# sysupgrade, or a LuCI backup restored onto a new router, therefore produced a
+# box whose config looked complete and whose node inventory was EMPTY — silently.
+#
+# /etc/config/shater is NOT listed here: it is declared in
+# Package/shater-core/conffiles, and sysupgrade backs CHANGED conffiles up on its
+# own (list_changed_conffiles). Listing it again would work, but it would claim
+# ownership of a mechanism that already covers it.
+
+# THE NODE INVENTORY. Subscription-fetched nodes deliberately live OUTSIDE UCI
+# (shater/model/subcache.go) — one JSON file per subscription. Without them the
+# restored box has groups and rules that reference nodes which do not exist, so no
+# tunnel comes up, and the only repair is `sub update`, which needs the internet
+# the tunnel was supposed to be providing. Indented JSON: a few hundred KiB even
+# for a several-hundred-node subscription.
+/etc/shater/subs/
+
+# THE BOOT-ARMOR ARM TOKEN. Its PRESENCE is what lets /etc/init.d/shater-armor
+# (START=21) load the fail-closed plane before fw4's `lan -> wan ACCEPT` is the
+# only rule on the box. Without it the first boot after a restore forwards LAN to
+# WAN in the clear until the daemon has built an engine. One small nft script.
+/etc/shater/boot.nft
+
+# COMPILED LIST ARTIFACTS (.srs). Losing these fails SILENTLY in the worst
+# direction: a missing LOCAL rule-set is left out of the generated config and the
+# engine starts perfectly happily with the filtering simply gone
+# (shater/generate/ruleset.go, compiledListRuleSet). "It will re-download itself"
+# is NOT true for them either — a compiled url list is rebuilt only by the next
+# generate, and nothing schedules one (see the note in /etc/init.d/shater-cron
+# about `ruleset update`). Cheap to keep: compiled .srs is 3-6% of the source
+# text (~80 KiB for a 150k-domain list), under a 4 MiB soft cap.
+/etc/shater/lists/
+
+# ALERT DE-DUPLICATION STATE. A few hundred bytes mapping subscription -> when its
+# expiry warning last fired. Without it every subscription already announced
+# announces itself again on the restored box — the exact re-alert storm the file
+# was created to prevent (shater/alert/expiry.go).
+/etc/shater/alert-state.json
+
+# DELIBERATELY NOT KEPT. Each of these is history or cache, and the backup is
+# built in RAM:
+#
+#   /etc/shater/stats.db     Traffic/query HISTORY, not configuration. Bounded
+#                            only by globals.stats_disk_limit_mb, whose default is
+#                            64 MB and whose 0 means UNLIMITED — one file able to
+#                            outweigh everything else here by two orders of
+#                            magnitude, and the only entry whose loss costs the
+#                            operator nothing but a chart.
+#   /etc/shater/cache.db     sing-box's own cache (8 MiB cap, deleted above it).
+#                            Rebuilt on demand by design, and a stale rule-set
+#                            cache carried onto a different box is worse than no
+#                            cache at all.
+#   /etc/shater/shaterd.log  A log (capped by globals.log_max_kb). A restored box
+#                            wants its own log, and this one carries the DNS query
+#                            history of the box it came from — which is not
+#                            something to move into an archive a person then puts
+#                            somewhere else.
+#
+# ON SECRECY, since this archive routinely ends up in cloud storage: subs/*.json
+# carries every node's credentials (UUID/password/keys). That is not a NEW
+# exposure — /etc/config/shater already carries the subscription URLs and every
+# manual node's credentials, and it is already in the backup as a conffile — but a
+# shater backup is a secret-bearing file and should be treated as one.

openwrt/shaterd/Makefile

@@ -38,9 +38,9 @@ PKG_NAME:=shaterd
 # VERSIONING — derived from the git tag, NOT hand-maintained here (bug B4).
 # ci/version.sh turns `git describe` into SHATER_PKG_VERSION/SHATER_PKG_RELEASE
 # (tag vX.Y.Z -> X.Y.Z + r1; off-tag -> last tag + r<commits+1>), and
-# ci/build-feed.sh / ci/build-feed-apk.sh export them into the SDK build env of
-# both lanes. Both lanes then ASSERT that the produced .ipk/.apk really carries
-# that version, so a lost env can never silently ship a stale one again.
+# ci/build-feed-apk.sh exports them into the SDK build env. ci/sdk-build-apk.sh
+# then ASSERTS that the produced .apk really carries that version, so a lost env
+# can never silently ship a stale one again.
 # The literals below are ONLY the manual/offline fallback (no CI, no git) — they
 # are not "the release version"; releases are named by the tag.
 PKG_VERSION:=$(if $(SHATER_PKG_VERSION),$(SHATER_PKG_VERSION),0.2.0)
@@ -104,8 +104,8 @@ define Package/shaterd/install
 	$(INSTALL_BIN) $(CURDIR)/files/$(SHATERD_BIN) $(1)/usr/bin/shaterd
 endef
 
-# This package ships ONLY the binary — no init script — so opkg's default
-# postinst never touches the running service. On `opkg upgrade shaterd` the new
+# This package ships ONLY the binary — no init script — so the package manager's
+# postinst never touches the running service. On `apk upgrade shaterd` the new
 # ELF lands at /usr/bin/shaterd while the OLD image keeps running from its
 # unlinked inode: the upgrade silently has no effect until the next reboot, and
 # meanwhile the new CLI (`shaterd reconcile`, `status`, `mint-token` — invoked by

option/group.go

@@ -18,6 +18,32 @@ type URLTestOutboundOptions struct {
 	// lx: SPEC 019 v2 — load-balancing.
 	Mode     string                  `json:"mode,omitempty"` // least_test (default) | round_robin
 	Balancer *URLTestBalancerOptions `json:"balancer,omitempty"`
+	// lx: health board §5.C — SelfCheck stands the group's OWN background
+	// health-check up or down. nil/absent == true, so every existing config keeps
+	// today's behaviour.
+	//
+	// Why this exists at all: a urltest group probes its members BY ITSELF — a
+	// warm-up sweep at PostStart and a ticker for as long as traffic keeps
+	// touching it — and it dials the members' outbounds DIRECTLY, from the
+	// router, over whatever the default WAN route is. For a group that traffic
+	// actually flows through, that is exactly right: the probe travels the same
+	// path the connections do. But for a group NO routing rule reaches, that
+	// same probe measures a path nothing uses — and it stores the result under
+	// the members' BASE tags, which every health consumer then reads as "the
+	// node's health". A node that is blocked on the direct WAN and perfectly
+	// alive behind a tunnel therefore reads "dead" the moment such a group
+	// probes it; the reading is not merely stale, it is FALSE, and it poisons
+	// the shared board for everyone (selection, the panel, the observatory's
+	// freshness gate). SelfCheck=false is how the control plane stands such a
+	// group's own schedule down: the shater engine computes which groups the
+	// applied rules actually reach (the observatory's used-set) and disables
+	// the self-check on the rest, so the ONLY prober left is the observatory —
+	// which probes along the real dial paths and nothing else.
+	//
+	// The flag suppresses only the group's own SCHEDULE (the PostStart warm-up
+	// and the Touch ticker). An EXPLICIT CheckOutbounds/URLTest call — the
+	// adapter interface a human or an API invokes on purpose — still works.
+	SelfCheck *bool `json:"self_check,omitempty"`
 }
 
 // URLTestBalancerOptions configures round_robin: a fixed-size pool of live nodes, lazily

panel/package.json

@@ -8,7 +8,8 @@
     "dev": "vite",
     "build": "tsc --noEmit && vite build",
     "preview": "vite preview",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "test": "node --test src/*.test.ts"
   },
   "dependencies": {
     "react": "^18.3.1",

panel/src/App.css

@@ -262,6 +262,150 @@
   }
 }
 
+/* ---- fixture band (dev builds only; see App.tsx MockBanner) ----
+   Deliberately outside the crit/amber vocabulary: nothing is wrong with the
+   router, there is no router. The hazard hatch is the service-sticker language a
+   piece of network hardware already uses for "this unit is not in service". */
+.mock-band {
+  display: flex;
+  align-items: center;
+  gap: calc(var(--u, 8px) * 1.5);
+  margin-top: calc(var(--u, 8px) * 2);
+  padding: 10px 14px;
+  border: 1px dashed var(--faint);
+  border-radius: 9px;
+  background: repeating-linear-gradient(
+    -45deg,
+    var(--sink),
+    var(--sink) 9px,
+    var(--panel) 9px,
+    var(--panel) 18px
+  );
+}
+.mock-band-tag {
+  flex-shrink: 0;
+  align-self: flex-start;
+  padding: 3px 7px;
+  border: 1px solid var(--faint);
+  border-radius: 4px;
+  background: var(--raised);
+  font-family: var(--font-mono);
+  font-size: 10px;
+  font-weight: 700;
+  letter-spacing: 0.14em;
+  color: var(--dim);
+}
+.mock-band-copy {
+  flex: 1;
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+}
+.mock-band-headline {
+  font-family: var(--font-mono);
+  font-size: 12.5px;
+  font-weight: 700;
+  letter-spacing: 0.02em;
+  color: var(--ink);
+}
+.mock-band-detail {
+  font-size: 12.5px;
+  line-height: 1.5;
+  color: var(--dim);
+  max-width: 76ch;
+}
+.mock-band-detail code {
+  font-family: var(--font-mono);
+  font-size: 11.5px;
+  color: var(--ink);
+}
+
+/* ---- commit-confirm band (every page except Apply, which has the full panel) ----
+   Same plate as the protection banner so the two read as one family; the seconds
+   are the loud element because they are the only thing that is running out. */
+.cfm-band {
+  display: flex;
+  align-items: center;
+  gap: calc(var(--u, 8px) * 1.5);
+  margin-top: calc(var(--u, 8px) * 2);
+  padding: 10px 14px;
+  border: 1px solid color-mix(in srgb, var(--amber) 50%, var(--groove));
+  border-radius: 9px;
+  background: linear-gradient(180deg, color-mix(in srgb, var(--amber) 10%, var(--raised)), var(--raised));
+  box-shadow: 0 1px 0 var(--edge) inset;
+}
+.cfm-band-count {
+  display: flex;
+  align-items: baseline;
+  gap: 2px;
+  flex-shrink: 0;
+  font-family: var(--font-mono);
+  color: var(--amber);
+}
+.cfm-band-num {
+  font-size: 22px;
+  font-weight: 700;
+  font-variant-numeric: tabular-nums;
+  line-height: 1;
+}
+.cfm-band-unit {
+  font-size: 11px;
+  letter-spacing: 0.06em;
+}
+.cfm-band-copy {
+  flex: 1;
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 3px;
+}
+.cfm-band-headline {
+  font-family: var(--font-mono);
+  font-size: 12.5px;
+  font-weight: 700;
+  letter-spacing: 0.02em;
+  color: var(--ink);
+}
+.cfm-band-detail {
+  font-size: 12.5px;
+  line-height: 1.5;
+  color: var(--dim);
+  max-width: 76ch;
+}
+.cfm-band-actions {
+  display: flex;
+  align-items: center;
+  gap: calc(var(--u, 8px) * 1);
+  flex-shrink: 0;
+}
+.cfm-band-link {
+  padding: 6px 11px;
+  border: 1px solid var(--groove);
+  border-radius: 6px;
+  font-family: var(--font-mono);
+  font-size: 11px;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  text-decoration: none;
+  color: var(--ink);
+  background: var(--raised);
+}
+.cfm-band-link:hover {
+  border-color: var(--accent);
+  color: var(--accent);
+}
+
+@media (max-width: 720px) {
+  .cfm-band {
+    flex-wrap: wrap;
+  }
+  .cfm-band-actions {
+    width: 100%;
+    justify-content: flex-end;
+  }
+}
+
 /* ---- last-apply findings (Overview) ----
    Severity carries the colour; the accent is reserved for interactive controls. */
 .findings {
@@ -312,6 +456,13 @@
 .finding--warning {
   border-color: color-mix(in srgb, var(--amber) 40%, var(--groove));
 }
+/* The daemon's "the list is capped" disclosure. Dashed, because the row is about
+   what ISN'T here — it must not read as one more finding to work through. */
+.finding--truncated {
+  border-style: dashed;
+  border-color: color-mix(in srgb, var(--amber) 40%, var(--groove));
+  background: var(--panel);
+}
 .finding-copy {
   flex: 1;
   min-width: 0;
@@ -405,3 +556,73 @@
   color: var(--dim);
   max-width: 74ch;
 }
+
+/* ---- inline rename (shared) ----
+   The pencil-in-the-row interaction: click the ✎ beside a name, type over it,
+   Enter commits / Esc cancels / blur commits. Lifted out of Devices.css when
+   Nodes grew the same affordance — one interaction, one set of rules, so the two
+   pages can never drift apart. `--locked` is the same control with the action
+   withheld: it stays visible and focusable-looking so a missing rename reads as
+   a stated rule, not a dead button. */
+.inline-rename {
+  flex: none;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 22px;
+  height: 22px;
+  padding: 0;
+  border: 1px solid transparent;
+  border-radius: 5px;
+  background: none;
+  color: var(--faint);
+  font-size: 12px;
+  line-height: 1;
+  cursor: pointer;
+  transition: color 0.15s, background 0.15s, border-color 0.15s;
+}
+.inline-rename:hover:not(:disabled) {
+  color: var(--accent);
+  background: color-mix(in srgb, var(--accent) 12%, transparent);
+}
+.inline-rename:focus-visible {
+  color: var(--accent);
+  border-color: var(--accent);
+  outline: 2px solid var(--accent);
+  outline-offset: 1px;
+}
+.inline-rename:disabled {
+  opacity: 0.5;
+  cursor: default;
+}
+/* Withheld, not broken: keep the glyph readable and let the cursor say "there is
+   a reason" rather than dimming it into invisibility. */
+.inline-rename--locked {
+  opacity: 0.75;
+  cursor: help;
+}
+.inline-rename--locked:hover {
+  color: var(--dim);
+  background: none;
+}
+
+.inline-rename-input {
+  min-width: 0;
+  max-width: 24ch;
+  padding: 4px 8px;
+  border: 1px solid var(--accent);
+  border-radius: 6px;
+  background: var(--sink);
+  color: var(--ink);
+  font-size: 13px;
+  font-weight: 600;
+  letter-spacing: 0.01em;
+  box-shadow: 0 1px 2px var(--shadow) inset;
+}
+.inline-rename-input:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: 1px;
+}
+.inline-rename-input:disabled {
+  opacity: 0.55;
+}

panel/src/App.tsx

@@ -1,12 +1,14 @@
 import './App.css'
 import { useCallback, useEffect, useState } from 'react'
-import { Faceplate, FaceplateHeader, Led, Module } from './components'
+import { Button, Faceplate, FaceplateHeader, Led, Module } from './components'
 import type { LedVariant } from './components'
-import { ApiError, MOCK, getStatus } from './api'
+import { ApiError, MOCK, confirm as apiConfirm, getStatus } from './api'
 import type { Status } from './api'
+import { usePendingConfirm } from './pendingConfirm'
 import { bootstrapSession } from './session'
 import { ROUTES, navigate, useRoute } from './router'
-import { protectionState } from './planeState'
+import { engineState, protectionState } from './planeState'
+import { truncationNote } from './findings'
 import type { Route } from './router'
 import { Overview, Placeholder, Nodes, Routing, Apply, DNS, Devices, Targets, Settings, Profiles, Insights, Networks } from './pages'
 
@@ -99,12 +101,102 @@ export function App() {
       footer={<StatusBar status={status} />}
     >
       <Nav route={route} />
+      <MockBanner />
       <PlaneBanner status={status} route={route} />
+      <ConfirmBand route={route} onChanged={() => void refreshStatus()} />
       <Page route={route} status={status} onStatusChange={() => void refreshStatus()} />
     </Faceplate>
   )
 }
 
+/**
+ * The commit-confirm countdown, on every page.
+ *
+ * The daemon arms an auto-rollback on EVERY apply, but only the Apply page ever
+ * said so: press Apply on Routing, read "Applied", walk away, and the router
+ * reverts a minute later with nothing on screen having mentioned it. This band
+ * carries that deadline — and the button that stops it — to wherever the operator
+ * actually is.
+ *
+ * Suppressed on Apply, which renders the full control room for the same window
+ * (and reads the same record, so a reload no longer loses the countdown there
+ * either).
+ */
+function ConfirmBand({ route, onChanged }: { route: Route; onChanged: () => void }) {
+  const armed = usePendingConfirm()
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  // Keeping the config is the only action offered here; rolling back early is a
+  // deliberate act with its own before/after readout, and that lives on Apply.
+  const keep = useCallback(async () => {
+    setBusy(true)
+    setError(null)
+    try {
+      const r = await apiConfirm()
+      if (r.error) setError(r.error)
+    } catch (e) {
+      setError(e instanceof Error ? e.message : 'request failed')
+    } finally {
+      setBusy(false)
+      onChanged()
+    }
+  }, [onChanged])
+
+  if (!armed || route === 'apply') return null
+
+  return (
+    <div className="cfm-band" role="alert">
+      <Led variant="amber" pulse />
+      <div className="cfm-band-count" role="timer" aria-label={`${armed.remaining} seconds until auto-rollback`}>
+        <span className="cfm-band-num">{armed.remaining}</span>
+        <span className="cfm-band-unit">s</span>
+      </div>
+      <div className="cfm-band-copy">
+        <span className="cfm-band-headline">This config is live but not kept</span>
+        <span className="cfm-band-detail">
+          {error
+            ? `Couldn’t keep it — ${error}. Try again, or open Apply.`
+            : 'Every apply arms an auto-rollback. Keep this config before the timer runs out, or the router reverts to the last-good one.'}
+        </span>
+      </div>
+      <div className="cfm-band-actions">
+        <Button variant="primary" onClick={() => void keep()} disabled={busy}>
+          {busy ? 'Keeping…' : 'Keep this config'}
+        </Button>
+        <a className="cfm-band-link" href="#/apply" onClick={() => navigate('apply')}>
+          Apply page
+        </a>
+      </div>
+    </div>
+  )
+}
+
+/**
+ * Says, on every page, that nothing on screen came from a router.
+ *
+ * Only a DEV build can ever render this — the fixtures are not in a production
+ * bundle (api.ts initMockBackend), so an operator cannot reach this state at all.
+ * It is here for the person who CAN: a footer line reading "DEMO DATA" is easy to
+ * work past for an afternoon and then screenshot into a bug report, and every
+ * number above it is invented.
+ */
+function MockBanner() {
+  if (!MOCK) return null
+  return (
+    <div className="mock-band" role="status">
+      <span className="mock-band-tag">FIXTURES</span>
+      <div className="mock-band-copy">
+        <span className="mock-band-headline">No router is being read</span>
+        <span className="mock-band-detail">
+          Every reading on this page is invented by <code>src/mock.ts</code> for offline
+          development. Drop <code>?mock</code> from the address to talk to a daemon.
+        </span>
+      </div>
+    </div>
+  )
+}
+
 /**
  * The protection state, pinned under the nav on every page EXCEPT Overview
  * (which shows the same state as its own headline readout — see planeState.ts).
@@ -130,12 +222,15 @@ function PlaneBanner({ status, route }: { status: Status | null; route: Route })
 
   const criticals = (status.warnings ?? []).filter((w) => w.severity === 'critical').length
   const state = protectionState(status)
+  // The published list is capped at 50, so with a note attached the count is a
+  // floor. Say "at least" rather than quoting a total the daemon didn't send.
+  const atLeast = truncationNote(status.warnings) ? 'At least ' : ''
 
   // Wording comes from the shared source of truth so the banner and Overview can
   // never describe the same router differently.
   const headline = state.alarm
     ? state.headline
-    : `${criticals} protection ${criticals === 1 ? 'gap' : 'gaps'} from the last apply`
+    : `${atLeast}${criticals} protection ${criticals === 1 ? 'gap' : 'gaps'} from the last apply`
   const detail = state.alarm
     ? state.detail
     : 'Something you configured isn’t in effect. Review the findings before relying on it.'
@@ -225,14 +320,30 @@ function StatusBar({ status }: { status: Status | null }) {
   )
 }
 
+/**
+ * The one lamp that is on screen no matter which page you are on.
+ *
+ * It used to read `status.running`, which the daemon hardcoded to `true` — so the
+ * "Offline" branch could never be reached and the plate said "Online" through an
+ * engine that had failed to start. It now asks {@link engineState}, whose whole
+ * job is to be able to answer "down", and refuses to guess when nothing has been
+ * reported: an unlit socket, not a green light.
+ */
 function masterIndicator(
   phase: Phase,
   status: Status | null,
 ): { label: string; variant: LedVariant; pulse?: boolean } {
   if (phase === 'loading' || !status) return { label: 'Linking', variant: 'off' }
-  if (status.running && status.active) return { label: 'Online', variant: 'on', pulse: true }
-  if (status.running) return { label: 'Standby', variant: 'amber' }
-  return { label: 'Offline', variant: 'crit' }
+  switch (engineState(status)) {
+    case 'down':
+      return { label: 'Engine down', variant: 'crit' }
+    case 'up':
+      return status.active
+        ? { label: 'Online', variant: 'on', pulse: true }
+        : { label: 'Standby', variant: 'amber' }
+    default:
+      return { label: 'Unknown', variant: 'off' }
+  }
 }
 
 function UnauthPlate() {
@@ -240,8 +351,15 @@ function UnauthPlate() {
     <Faceplate ariaLabel="shater — not authenticated" header={<FaceplateHeader wordmark="SHATER" subline="v0.2 · openwrt appliance" />}>
       <div className="plate-msg">
         <Module name="Session" value="LOCKED" led={{ variant: 'amber' }}>
+          {/* THE ONLY RECOVERY INSTRUCTION THE PRODUCT GIVES, so it has to point at
+              the real menu entry. It said "System → shater"; the page is registered
+              at `admin/services/shater` (luci-app-shater/root/usr/share/luci/menu.d/
+              luci-app-shater.json, title "Shater"), which LuCI renders under
+              SERVICES. Anyone reading this line has just lost access to the panel
+              and is looking for the one door back — sending them to the wrong menu
+              costs far more than its size. */}
           <p className="placeholder-note">
-            No active session. Open the panel from the LuCI menu (System → shater →{' '}
+            No active session. Open the panel from the LuCI menu (Services → Shater →{' '}
             <strong>Open panel</strong>) to hand off a fresh access token.
           </p>
         </Module>

panel/src/api.ts

@@ -13,8 +13,13 @@
 // serves in-memory fixtures instead of hitting the network, so `npm run dev`
 // and screenshot runs render without a live backend. A real backend in dev is
 // reachable instead via the Vite proxy in vite.config.ts (no flag ⇒ real fetch).
+//
+// THE FIXTURES ARE A DEV-BUILD-ONLY ARTEFACT — see initMockBackend below. They
+// used to be a plain static import, decided at RUNTIME off `location.search`, so
+// the invented router shipped inside the binary that goes on real hardware and a
+// link ending in `?dev` painted a healthy appliance without making one request.
 
-import * as mock from './mock'
+import { armPendingConfirm, clearPendingConfirm, noteConfirmTimeout } from './pendingConfirm'
 
 // --- error type -------------------------------------------------------------
 
@@ -51,6 +56,38 @@ export class ApiError extends Error {
  */
 export type Plane = 'full' | 'hold' | 'none'
 
+/**
+ * Where the router's traffic actually ENDS UP, decided by the daemon from the
+ * engine config it is running (apply.Status.traffic ← generate.TrafficOf).
+ *
+ *   tunnel  — the default route goes into a tunnel: everything not matched by a
+ *             more specific rule is proxied.
+ *   split   — the default leaves directly, but some rules do tunnel their traffic.
+ *   direct  — the default leaves directly and nothing is tunnelled at all.
+ *   blocked — the default is the fail-closed backstop: unmatched traffic is
+ *             dropped, not let out. Nothing leaks.
+ *
+ * `plane` DOES NOT ANSWER THIS and must never be read as if it did. `plane` says
+ * how much of the data plane is installed (nft table, policy routing, engine up);
+ * a router whose only rule is `default → direct` has all of it and sends the whole
+ * LAN out the plain WAN with its real address. That combination — plane "full",
+ * traffic "direct" — was live on a user's router under a green "Protected" LED.
+ */
+export type TrafficVerdict = 'tunnel' | 'split' | 'direct' | 'blocked'
+
+export interface Traffic {
+  // '' or absent ⇒ not known (daemon that predates this field, nothing applied
+  // yet, or the plane is on hold). NEVER treat unknown as 'tunnel'.
+  verdict?: TrafficVerdict | ''
+  // The outbound tag the engine's default route names, in the engine's own
+  // vocabulary ("direct", "block", a node/group tag). Diagnostic — wording is
+  // driven by `verdict`, never by parsing this.
+  default?: string
+  // How many of the engine's route rules send their matched traffic into a tunnel.
+  // Separates "some of your traffic is protected" from "none of it is".
+  tunnel_rules?: number
+}
+
 /**
  * One thing the last apply could not do. Deliberately fail-OPEN with a warning
  * rather than refusing the whole config (the alternative was taking the network
@@ -75,19 +112,65 @@ export interface StatusWarning {
 /** GET /api/status — live daemon + data-plane state. */
 export interface Status {
   running: boolean
+  /**
+   * `globals.enabled` in UCI — MEANINGLESS unless `config_readable` is true. Test
+   * that first; see it for why "off" and "cannot tell" must never share a branch.
+   */
   enabled: boolean
   active: boolean
   table: boolean
   hash: string
   version: string
+  // The RAW `option kill_switch` string, echoed straight off model.Globals
+  // (apply.go: `s.KillSwitch = m.Globals.KillSwitch`) — NOT normalised. So it can
+  // be "Closed", " closed ", or "" as well as the two documented spellings, and
+  // the daemon reads it as closed unless it case-insensitively equals "open"
+  // (apply.killSwitchClosed). Never compare it with `===`; use
+  // planeState.killSwitchClosed, which is that same rule.
   kill_switch?: string // "closed" (fail-closed) | "open"
-  panel_port?: number // configured admin-panel port (default 8088)
+  // The CONFIGURED admin-panel port (default 8088) — NOT a port anything has
+  // confirmed is being listened on. The daemon echoes the config value, and a
+  // failed listen is only `logger.Warn("panel server unavailable (daemon
+  // continues)")`, so this field reads exactly the same whether the panel is up or
+  // was never bound. Do not render it as "the panel is at :N": say configured.
+  panel_port?: number
+  /**
+   * COULD THE CONFIGURATION BE READ AT ALL when this status was taken?
+   *
+   * It QUALIFIES the only three fields sourced from the config — `enabled`,
+   * `kill_switch`, `panel_port`. When it is false those three are zero values and
+   * mean NOTHING: not "switched off", not "kill switch unset", not "port 0". Test
+   * it before reading any of them.
+   *
+   * The phrasing is positive on purpose, and the panel must keep it that way: a
+   * client that predates the field sees it missing, reads `false`, and lands on the
+   * ALARMING side. Reading it as `!== false` would invert that and hand the
+   * reassuring branch to every daemon too old to answer.
+   *
+   * Why it matters more than it looks: the failure is a full /overlay, or a
+   * `uci commit` caught half-written — precisely when the fail-closed plane has the
+   * whole LAN cut off on purpose. The daemon then publishes `plane:"hold"` WITH
+   * `enabled:false`, and a panel that checks `!enabled` first renders "Turned off",
+   * amber, no alarm, and points at a Settings page backed by the same unreadable
+   * file. It tells the owner they did this to themselves while the house has no
+   * internet. See planeState.protectionState, where the order of those two checks
+   * is the whole fix.
+   */
+  config_readable?: boolean
+  /** Why the config read failed, verbatim, or absent/"" when it did not. A
+   *  diagnostic, not the operator-facing sentence — that one is published as a
+   *  critical warning in section "config", name "unreadable". */
+  config_error?: string
   can_rollback?: boolean // a rollback would revert something (armed snapshot or engine last-good)
   // Is the sing-box engine process actually up? Absent on older daemons.
   engine_running?: boolean
   // How much of the data plane is installed. Absent on older daemons ⇒ unknown,
   // in which case the UI shows nothing rather than guessing "full".
   plane?: Plane
+  // Where the traffic actually goes under the running config. Absent on older
+  // daemons ⇒ unknown; see TrafficVerdict for why this is a separate question
+  // from `plane`.
+  traffic?: Traffic
   // Findings from the last apply. ALWAYS an array from the daemon (never null);
   // empty means the last apply was clean. Pre-sorted critical-first and capped at
   // 50, where a truncated list ends with an `info` entry saying "suppressed".
@@ -354,19 +437,142 @@ export interface GroupHealth {
  * any more and nothing to report here beyond the groups themselves.
  */
 
+/**
+ * One hop of one chain, measured where that hop actually sits in the path.
+ *
+ * This is the reading the daemon always took and never showed. A chain is not a
+ * target with a single health — it is an ordered series of them, and the only
+ * question an operator ever asks about a broken chain is WHICH hop broke. The
+ * end-to-end exit reading cannot answer that: it says "the path is dead" for a
+ * four-hop chain and leaves the person to guess between four suspects.
+ *
+ * WIRE ORDER. `index` is 1-based and counts hops in the order the router dials
+ * them: hop 1 is the first physical hop, and each later hop is dialled THROUGH
+ * the ones before it. The hop carrying `exit: true` — always the largest index —
+ * is where traffic leaves for the internet. A leading `egress:` in the chain's
+ * configured Hops is NOT a numbered hop: the daemon lifts it into the entry
+ * detour of hop 1, so a chain written `egress:ewan → node:awgout → group:sub0`
+ * reports two hops, not three. Anything zipping this against the model's Hops
+ * must drop that leading egress first and give up on labelling entirely if the
+ * counts still disagree — a chain that splices sub-chains gets flattened here,
+ * and a confidently WRONG hop name is worse than no name.
+ *
+ * `tag` is the engine-side outbound (`chain-<name>-h2`). Debugging and tooltips
+ * only; it is never a label to put in front of a person.
+ *
+ * ORDERED WALK — THE READING STOPS AT THE FIRST DEAD HOP. Hops are NOT measured
+ * independently, and never were measurable that way: hop 3 is dialled THROUGH
+ * hop 2, so probing hop 3 while hop 2 is down measures hop 2 a second time and
+ * learns nothing about hop 3. The daemon therefore walks the path in wire order
+ * and stops at the first hop that does not answer. Every hop below that one is
+ * left undialled and reported `state: "untested"` — no measurement exists —
+ * carrying {@link ChainHopBlock} in `blocked_by` to name the hop that stopped the
+ * walk. So a chain never reports a dead hop with a live hop below it; that shape
+ * is not a rare case, it is unreachable.
+ *
+ * NODE HOP vs GROUP HOP. For `kind: "node"` the hop IS the measurement: `total`
+ * is 1, the counters follow its own state, and `selected` is ''. For
+ * `kind: "group"` the counters roll up that hop's per-hop member COPIES — the
+ * copies dialled through the hops in front of it, which is exactly why they can
+ * read alive here while the same group's standalone card reads dead. Both
+ * readings are true; they measure different dial paths. `selected` is the node
+ * NAME the hop routes through right now, and `delay_ms` / `age_seconds` belong
+ * to that selected member (or the freshest alive one).
+ *
+ * Invariants the daemon guarantees — never re-derive them, just read them:
+ * `tested === alive + dead` and `alive + dead + untested === total`.
+ *
+ * `state` is a closed set of THREE. `untested` is NEVER "dead" and never
+ * "healthy": it means nothing fresh enough is known. Without `blocked_by` that is
+ * a matter of timing — for a used chain it resolves on its own within seconds.
+ * With `blocked_by` it will not resolve until the named hop is fixed. There is no
+ * fourth state for that; the state stays `untested` because that is what it is.
+ * `age_seconds: -1` means the age is unknown.
+ */
+export interface ChainHopHealth {
+  /** 1-based WIRE order. Hop 1 is dialled first; see the note above. */
+  index: number
+  /** Engine outbound tag (`chain-<name>-h2`) — tooltips/debugging, never a label. */
+  tag: string
+  /** `node` ⇒ the hop is the measurement. `group` ⇒ the counters roll up members. */
+  kind: 'node' | 'group'
+  /** This hop is where traffic leaves for the internet. Always the largest index. */
+  exit: boolean
+  /** Closed set — switch on it exhaustively. `untested` is never "dead". */
+  state: 'alive' | 'dead' | 'untested'
+  /** RTT of the selected/freshest alive member; 0 (meaningless) when not alive. */
+  delay_ms: number
+  /** Age of that measurement in seconds; -1 when unknown. */
+  age_seconds: number
+  /** Node name this GROUP hop routes through right now; '' for a node hop. */
+  selected: string
+  total: number
+  tested: number
+  alive: number
+  dead: number
+  untested: number
+  /**
+   * PRESENT ONLY on a hop the ordered walk never reached — i.e. a hop sitting
+   * below one the prober found `dead`. The key is omitted otherwise; absent is
+   * the normal case and means "this hop was actually dialled".
+   *
+   * Its presence is the daemon's own statement that this hop has NO measurement,
+   * and it comes with the rest of that statement already filled in: `state` is
+   * `untested`, `delay_ms` is 0, `age_seconds` is -1, and the counters are
+   * `alive: 0, dead: 0, tested: 0, untested: total`. Read those; do not re-derive
+   * a verdict from them, and do not infer a block from zeroed counters either —
+   * an unprobed-yet hop has the same numbers and a very different meaning.
+   * `selected` MAY still be non-empty: the wrapper does have a pick, it simply
+   * was not measured, so it says which node the hop would use, not which node is
+   * carrying traffic.
+   */
+  blocked_by?: ChainHopBlock
+}
+
+/**
+ * The hop that stopped the ordered walk, as reported on every hop below it.
+ *
+ * This exists because "no reading" and "no reading, and here is whose fault that
+ * is" are different answers to the operator's actual question. Without it a
+ * blocked hop is indistinguishable from one the observatory has not come round to
+ * yet, and the interface can only shrug.
+ *
+ * `index` is the 1-based WIRE index of the blocking hop and is ALWAYS smaller
+ * than the index of the hop carrying it, so it points at a hop already on screen.
+ * `tag` is that hop's engine outbound (`chain-<name>-h3`) — debugging and
+ * tooltips only, never a label to put in front of a person, exactly as on
+ * {@link ChainHopHealth}.tag.
+ */
+export interface ChainHopBlock {
+  /** 1-based wire index of the hop that did not answer. Always < this hop's index. */
+  index: number
+  /** That hop's engine outbound tag — tooltips/debugging, never a label. */
+  tag: string
+}
+
 /** Per-chain reachability, the chain analogue of {@link GroupHealth}.used (plan
  *  §5.E): a chain no enabled routing rule routes through is outside the
- *  observatory's plan, so its exit is never probed and the Targets card renders it
- *  "unused" instead of an exit-test readout. A chain has no membership counters —
- *  it is a fixed path, and its end-to-end health is the exit test's job. */
+ *  observatory's plan, so nothing probes it and the Targets card says so instead
+ *  of rendering a health reading. A chain has no membership counters of its own —
+ *  it is a fixed path, and its health lives on its {@link ChainHopHealth} hops. */
 export interface ChainHealth {
   name: string
   /** An enabled routing rule (the Final target, a DNS-resolver detour, a device
-   *  target, …) reaches this chain, so the observatory probes its exit in the
+   *  target, …) reaches this chain, so the observatory probes its hops in the
    *  background. false ⇒ nothing routes through the chain: it is skipped by the
-   *  background probing and its end-to-end health stays untested. That is an
-   *  "unused" note about the ROUTING CONFIG, never a health problem. */
+   *  background probing and its health stays untested. That is an "unused" note
+   *  about the ROUTING CONFIG, never a health problem. */
   used: boolean
+  /**
+   * Per-hop health in wire order (see {@link ChainHopHealth}).
+   *
+   * MAY BE ABSENT, and absent does not mean "this chain has no hops". It means
+   * the engine never materialised per-hop outbounds for it: the chain is unused,
+   * or it collapses to a single hop and the daemon points traffic straight at
+   * that target instead of building a copy of it. Read a missing key as "nothing
+   * measured per hop", never as an empty path or as a fault.
+   */
+  hops?: ChainHopHealth[]
 }
 
 export interface GroupsHealth {
@@ -419,12 +625,46 @@ export interface Stats {
 
 // --- Model shapes (PascalCase keys; slices may be null) ---------------------
 
+/**
+ * `T` with every key REQUIRED to be written down — `undefined` still allowed as a
+ * VALUE, so nothing changes on the wire (`JSON.stringify` omits undefined, and the
+ * result stays assignable to `T`).
+ *
+ * WHAT IT IS FOR. Several editors REBUILD a model object from their form controls
+ * instead of extending the one they were given, because rebuilding is what stops a
+ * stale field surviving a change of shape (an inbound switched from `socks` to
+ * `tproxy` must not keep its old `Listen`). The cost is that the rebuild is only
+ * correct for as long as somebody remembers to touch it: add a sixteenth field to
+ * `Inbound` and every edit silently drops it, with no error anywhere. That already
+ * happened once, to `Ruleset.Format` (see ruleset.ts), and the value could only be
+ * put back over SSH.
+ *
+ * Annotating the rebuilt literal `Complete<T>` turns the next occurrence into a
+ * BUILD failure, in the function that has to decide, naming the field it forgot.
+ * Writing `undefined` for a field this shape has no use for is then a statement
+ * rather than an omission.
+ *
+ * Only the OPTIONAL keys get `| undefined`. A bare `{[K in keyof T]-?: T[K] |
+ * undefined}` would widen the required ones too — `Name: string | undefined` —
+ * which both weakens them and stops the result being assignable back to `T`; an
+ * intersection with `T` does not fix it either, since intersecting an optional
+ * `string` with `string | undefined` collapses back to `string`. So the two halves
+ * are split explicitly.
+ */
+type OptionalKeys<T> = { [K in keyof T]-?: object extends Pick<T, K> ? K : never }[keyof T]
+export type Complete<T> = Pick<T, Exclude<keyof T, OptionalKeys<T>>> & {
+  [K in OptionalKeys<T>]-?: T[K] | undefined
+}
+
 export interface Globals {
   Enabled: boolean
   // debug|info|warning|error|none. `none` really is silent — it is emitted as the
   // engine's own log-disable switch, not as a quieter level. Anything unrecognised
   // falls back to warning (an unknown level fails engine start outright).
   LogLevel: string
+  // The saved policy, verbatim. Same caveat as Status.kill_switch: the daemon
+  // normalises with EqualFold+TrimSpace and defaults to CLOSED, so read it through
+  // planeState.killSwitchClosed rather than comparing the string.
   KillSwitch: string // "closed" | "open"
   // There is deliberately no DNSMode. It was removed from the Go model (see
   // model.go's package comment): "nftset" named the v0.1 dnsmasq architecture that
@@ -457,19 +697,60 @@ export interface Globals {
    * no representation in them. So this traffic can only be dropped or let out
    * directly; there is no third physical option, and the setting picks WHICH.
    *
-   *   block  — (default) drop it all. No ping/traceroute out, no multicast IPTV,
-   *            no client IPsec/PPTP passthrough. Nothing leaks.
+   *   block  — (default) drop it all. No ping/traceroute out, no client
+   *            IPsec/PPTP passthrough. Nothing leaks.
    *   icmp   — let ICMP/ICMPv6 echo out directly. Ping and traceroute work; the
-   *            host being pinged sees the real WAN IP. IPTV/VPN passthrough stay
-   *            blocked.
-   *   direct — let all of it out directly. Ping, IPTV and IPsec/PPTP passthrough
-   *            work, and all of it bypasses the tunnel with the real IP.
+   *            host being pinged sees the real WAN IP. The rest gets out only
+   *            toward addresses the routing rules already send direct.
+   *   direct — let all of it out directly. Ping and IPsec/PPTP passthrough work,
+   *            and all of it bypasses the tunnel with the real IP.
+   *
+   * MULTICAST IPTV IS NOT ONE OF THE THINGS THIS DECIDES, on any of the three.
+   * The stream is UDP, every line this policy emits carries `meta l4proto !=
+   * { tcp, udp }` (netplane/untunnelable.go), and the fail-closed forward chain's
+   * surviving accepts cover the RFC1918/link-local daddr sets only — 224.0.0.0/4
+   * is not among them (netplane/nft.go). The daemon says so itself in the notes it
+   * publishes for this section. Listing IPTV as something `direct` restores is the
+   * one lie this comment previously told.
    *
    * Absent, empty, or unrecognised ⇒ `block` (the daemon normalises to the safe
-   * side). Note the policy is inert while KillSwitch is "open", because then
-   * nothing is being blocked in the first place.
+   * side). Three other settings override it, and the panel must read them before
+   * describing it: an OPEN KillSwitch (the forward chain then has no drops at all,
+   * so nothing is blocked whatever this says), L3Tunnel (takes ICMP echo into the
+   * tunnel in prerouting, before the forward chain is consulted), and
+   * UntunnelableEgress (routes ESP/AH/GRE/IGMP/SCTP — and ICMP too, when L3Tunnel
+   * is off — out a named interface). See netplane/nft.go's prerouting chain.
    */
   Untunnelable?: string // block|icmp|direct
+  /**
+   * The L3 ingress (model.Globals.L3Tunnel, UCI `l3_tunnel`). The engine opens a
+   * TUN device and prerouting policy-routes ICMP ECHO AND NOTHING ELSE into it,
+   * where the engine's own route rules pick the outbound — so ping and Windows
+   * tracert travel THROUGH the tunnel toward every address the rules send to an
+   * outbound that can carry plain IP (WireGuard/AmneziaWG), and are not answered
+   * at all for addresses routed to a stream-only outbound. Raw ESP/AH/GRE cannot
+   * enter it: sing-tun's dispatcher NATs through a port-shaped selector they do
+   * not have.
+   *
+   * Load-bearing for the panel because it happens BEFORE the forward chain, so it
+   * silently rewrites the ICMP half of every Untunnelable promise. Absent ⇒ false
+   * (opt-in), so read it as `=== true`.
+   */
+  L3Tunnel?: boolean
+  /**
+   * The name of an interface/tunnel egress that carries what the engine will not
+   * dispatch — ESP, AH, GRE, IGMP, SCTP, plus ICMP when L3Tunnel is off
+   * (model.Globals.UntunnelableEgress, UCI `untunnelable_egress`). The kernel
+   * routes those packets out that device with its own NAT; the forward chain,
+   * where Untunnelable's verdicts live, never decides them.
+   *
+   * It is NOT necessarily a tunnel — the option takes any interface/tunnel egress,
+   * and a second WAN is just another uplink whose real address the far end sees.
+   * The daemon's own note for this section says which, from whether the device is
+   * point-to-point, so the panel does not guess. "" (the default) ⇒ Untunnelable
+   * is in sole charge.
+   */
+  UntunnelableEgress?: string
   DNSFilter?: boolean // master enable for the in-engine blocklist filter
   DNSIntercept?: boolean // force ALL LAN plaintext DNS (:53) through the engine, incl. router-addressed queries
   BlockDoH?: boolean // block known public DoH resolvers (by host + IP:443 + Firefox canary) so clients fall back to plaintext :53
@@ -499,13 +780,20 @@ export interface Globals {
   StatsTimelineMinutes?: number // trailing per-minute sparkline buckets; 0 = unlimited
   StatsMaxDomains?: number // network-wide domain-map size before prune; 0 = unlimited
   StatsRetentionDisabled?: boolean // master switch: disable trimming for all aggregates
-  // SQLite-only: hard cap on the on-disk stats.db size, in MB. 0 = unlimited (bounded
-  // only by the device); a positive N caps the DB at N MB (oldest rows pruned + VACUUM).
-  // Applies only when StatsBackend === "sqlite"; ignored for off/memory.
+  // Disk-backend only: hard cap on the on-disk stats.db size, in MB. 0 = unlimited
+  // (bounded only by the device); a positive N aims the DB at N MB — oldest rows are
+  // deleted, then the file is REBUILT to give the pages back (stats/boltring.go:
+  // bbolt.Compact into a temp file + atomic swap). Not sqlite and not VACUUM: the
+  // store is bbolt, and the rebuild is SKIPPED when the filesystem cannot fit the
+  // transient second copy, which leaves the DB over its cap until space frees up.
+  // Applies only when StatsBackend === "sqlite" (a historical value name — see
+  // StatsBackend below); ignored for off/memory.
   StatsDiskLimitMB?: number // stats.db disk cap in MB; 0 = unlimited
   // Logging/stats backend selector. "off" collects nothing (all stats lists empty);
-  // "memory" keeps aggregates in RAM (lost on restart); "sqlite" persists the query
-  // and connection logs to an on-disk, disk-bounded store that survives a restart
+  // "memory" keeps aggregates in RAM (lost on restart); "sqlite" — a HISTORICAL value
+  // name, kept because it is on disk in every shipped config; the store behind it is
+  // bbolt (stats/boltring.go), pure Go and already linked into the binary — persists
+  // the query and connection logs to an on-disk, disk-bounded store that survives a restart
   // (the DNS/nft aggregates stay in RAM; if the DB can't be opened it falls back to
   // memory and the snapshot honestly reports "memory"). Default "memory". The
   // EFFECTIVE running backend is echoed on the /api/stats snapshot.
@@ -795,11 +1083,22 @@ export interface Inbound {
  * address. Route to a group/node/chain for the former, and to the `block` TARGET
  * for the latter.
  */
+/*
+ * THERE IS DELIBERATELY NO `Target`. It was declared here as "legacy field of the
+ * removed `proxy` type; read by nothing", and it is not in the Go model at all —
+ * so it could only ever be `undefined`, which made every panel branch asking
+ * "which egress points at this node/group?" (Nodes.tsx, Targets.tsx) permanently
+ * unreachable: dead code that read as coverage. The other end was worse than
+ * inert. PUT /api/config decodes with DisallowUnknownFields, so the day anything
+ * had put a string on it — a rename pass, a migration, a hand-written fixture —
+ * `JSON.stringify` would have started emitting it and the daemon would have
+ * rejected the WHOLE write with `json: unknown field "Target"` (verified against
+ * the running daemon), losing an unrelated edit somewhere else on the page.
+ */
 export interface Egress {
   Name: string
   Type: string // interface|direct|byedpi
   Interface?: string // type=interface: the UCI interface name
-  Target?: string // legacy field of the removed `proxy` type; read by nothing
   Port?: number // type=byedpi ONLY: the local ciadpi listen port (default 1080)
   DPI?: string // type=interface|direct: off|fragment|record|spoof (byedpi desyncs itself)
 }
@@ -809,9 +1108,17 @@ export interface Rule {
   Enabled: boolean
   Order: number
   Src?: string[] | null
-  DstDomain?: string[] | null
+  /**
+   * WHERE the traffic is going — the rule's only destination matcher. Each entry
+   * names a {@link Ruleset}; the rule matches when ANY of them matches.
+   *
+   * There is no inline domain or address list on a rule. `dst_domain`/`dst_ip`
+   * were removed in schema v2, and `shaterd migrate` folds every existing one
+   * into a generated `rule-<name>` ruleset, so a destination list is written and
+   * edited in exactly one place and compiled once into a .srs that every rule
+   * referencing it shares.
+   */
   DstRuleset?: string[] | null
-  DstIP?: string[] | null
   DstPort?: string
   /**
    * Narrow the rule to one transport or one sniffed application protocol. A
@@ -952,12 +1259,59 @@ export interface Model {
 
 // --- transport --------------------------------------------------------------
 
-/** True when the URL asks for the offline fixture backend (?mock or ?dev). */
-export const MOCK: boolean = (() => {
+// --- the offline fixture backend (dev builds only) ---------------------------
+
+/**
+ * True when the in-memory fixtures are serving this session instead of the
+ * daemon. ALWAYS false in a production build — see {@link initMockBackend}.
+ *
+ * A live binding, not a constant: it is decided once during boot, before the
+ * first render, and every importer sees the same value for the whole session.
+ */
+export let MOCK = false
+
+/** The loaded fixture module. `null` unless a dev build was asked for `?mock`. */
+let fixtures: typeof import('./mock') | null = null
+
+/**
+ * Load the fixture backend, if this build has one and the URL asks for it.
+ * Call ONCE from the entry point and await it before the first render — the
+ * pages read {@link MOCK} while they render, so flipping it afterwards would
+ * leave a half-mocked screen.
+ *
+ * Two gates, and the order matters. `import.meta.env.DEV` is folded to a literal
+ * `false` by Vite at build time, so in a production build the whole body is
+ * unreachable, `import('./mock')` is tree-shaken out of the module graph, and the
+ * fixtures are not in the emitted bundle AT ALL — not lazily, not behind a flag.
+ * `vite.config.ts` fails the build if that ever stops being true.
+ *
+ * This is deliberately stronger than "hide the mock behind a query flag". The
+ * flag was the bug: `?dev` on a production URL rendered an invented healthy
+ * router — 119 of 122 nodes alive, "Protected" — with no request made and one
+ * line of small print in the footer to say so. A person cannot audit a bundle;
+ * the only honest guarantee is that the invented data is not in it.
+ */
+export async function initMockBackend(): Promise<boolean> {
+  if (import.meta.env.DEV && mockRequested()) {
+    fixtures = await import('./mock')
+    MOCK = true
+  }
+  return MOCK
+}
+
+/** Does the URL ask for the offline fixture backend (`?mock` or `?dev`)? */
+function mockRequested(): boolean {
   if (typeof location === 'undefined') return false
   const q = new URLSearchParams(location.search)
   return q.has('mock') || q.has('dev')
-})()
+}
+
+/** The fixture backend, for the `MOCK ? … : …` branches below. Throws rather
+ *  than inventing data if it is ever reached without having been loaded. */
+function mock(): NonNullable<typeof fixtures> {
+  if (!fixtures) throw new Error('mock backend not loaded — call initMockBackend() first')
+  return fixtures
+}
 
 /** A decoded response plus the raw Headers, for endpoints whose contract puts
  *  pagination metadata outside the JSON body (see the stats log endpoints). */
@@ -1006,33 +1360,54 @@ async function req<T>(path: string, init?: RequestInit): Promise<T> {
 // --- endpoints --------------------------------------------------------------
 
 export function getStatus(): Promise<Status> {
-  return MOCK ? mock.getStatus() : req<Status>('api/status')
+  return MOCK ? mock().getStatus() : req<Status>('api/status')
 }
 
-export function getConfig(): Promise<Model> {
-  return MOCK ? mock.getConfig() : req<Model>('api/config')
+export async function getConfig(): Promise<Model> {
+  const m = await (MOCK ? mock().getConfig() : req<Model>('api/config'))
+  // Every page reads the config, and the commit-confirm window's length is the
+  // only thing needed to arm a countdown — so it is captured here once instead of
+  // being threaded through eight pages. See pendingConfirm.ts.
+  noteConfirmTimeout(m.Globals?.ConfirmTimeout)
+  return m
 }
 
 export function putConfig(m: Model): Promise<{ ok: boolean; applied: boolean }> {
   return MOCK
-    ? mock.putConfig(m)
+    ? mock().putConfig(m)
     : req('api/config', { method: 'PUT', body: JSON.stringify(m) })
 }
 
-export function apply(): Promise<ApplyResult> {
-  return MOCK ? mock.apply() : req<ApplyResult>('api/apply', { method: 'POST' })
+/**
+ * POST /api/apply.
+ *
+ * The daemon arms an auto-rollback on EVERY successful apply that changed
+ * something (panel/api.go handleApply → ArmRollback), whichever page's button was
+ * pressed. Recording it here — the one place every one of those buttons goes
+ * through — is what lets the countdown and the "Keep this config" control follow
+ * the operator around the panel instead of living in the Apply page's local
+ * state. See pendingConfirm.ts.
+ */
+export async function apply(): Promise<ApplyResult> {
+  const r = await (MOCK ? mock().apply() : req<ApplyResult>('api/apply', { method: 'POST' }))
+  if (!r.error && r.changed) armPendingConfirm()
+  return r
 }
 
-export function confirm(): Promise<ApplyResult> {
-  return MOCK ? mock.confirm() : req<ApplyResult>('api/confirm', { method: 'POST' })
+export async function confirm(): Promise<ApplyResult> {
+  const r = await (MOCK ? mock().confirm() : req<ApplyResult>('api/confirm', { method: 'POST' }))
+  if (!r.error) clearPendingConfirm()
+  return r
 }
 
-export function rollback(): Promise<ApplyResult> {
-  return MOCK ? mock.rollback() : req<ApplyResult>('api/rollback', { method: 'POST' })
+export async function rollback(): Promise<ApplyResult> {
+  const r = await (MOCK ? mock().rollback() : req<ApplyResult>('api/rollback', { method: 'POST' }))
+  if (!r.error) clearPendingConfirm()
+  return r
 }
 
 export function getStats(): Promise<Stats> {
-  return MOCK ? mock.getStats() : req<Stats>('api/stats')
+  return MOCK ? mock().getStats() : req<Stats>('api/stats')
 }
 
 // --- daemon log download ------------------------------------------------------
@@ -1084,7 +1459,7 @@ function saveBlob(blob: Blob, filename: string): void {
  */
 export async function downloadLog(range: LogRange): Promise<void> {
   if (MOCK) {
-    saveBlob(new Blob([mock.getLogText(range)], { type: 'text/plain' }), `shater-log-${range}.txt`)
+    saveBlob(new Blob([mock().getLogText(range)], { type: 'text/plain' }), `shater-log-${range}.txt`)
     return
   }
   let res: Response
@@ -1163,14 +1538,14 @@ function logPage<T>(env: { body: T[] | null; headers: Headers }): StatsLogPage<T
 /** GET /api/stats/log — one page of the DNS query log with its cursor metadata. */
 export function getStatsLogPage(q: StatsLogQuery = {}): Promise<StatsLogPage<QueryLogEntry>> {
   return MOCK
-    ? mock.getStatsLogPage(q)
+    ? mock().getStatsLogPage(q)
     : reqFull<QueryLogEntry[] | null>(`api/stats/log${statsLogQS(q)}`).then(logPage)
 }
 
 /** GET /api/stats/conns — one page of the connection log with its cursor metadata. */
 export function getStatsConnsPage(q: StatsLogQuery = {}): Promise<StatsLogPage<ConnLogEntry>> {
   return MOCK
-    ? mock.getStatsConnsPage(q)
+    ? mock().getStatsConnsPage(q)
     : reqFull<ConnLogEntry[] | null>(`api/stats/conns${statsLogQS(q)}`).then(logPage)
 }
 
@@ -1178,13 +1553,13 @@ export function getStatsConnsPage(q: StatsLogQuery = {}): Promise<StatsLogPage<C
  *  Rows only; callers that tail the stream want {@link getStatsLogPage} instead. */
 export function getStatsLog(q: number | StatsLogQuery = {}): Promise<QueryLogEntry[]> {
   const o: StatsLogQuery = typeof q === 'number' ? { limit: q } : q
-  return MOCK ? mock.getStatsLog(o) : req<QueryLogEntry[]>(`api/stats/log${statsLogQS(o)}`)
+  return MOCK ? mock().getStatsLog(o) : req<QueryLogEntry[]>(`api/stats/log${statsLogQS(o)}`)
 }
 
 /** GET /api/stats/conns — the live connection-event log (device→dest), newest first. */
 export function getStatsConns(q: number | StatsLogQuery = {}): Promise<ConnLogEntry[]> {
   const o: StatsLogQuery = typeof q === 'number' ? { limit: q } : q
-  return MOCK ? mock.getStatsConns(o) : req<ConnLogEntry[]>(`api/stats/conns${statsLogQS(o)}`)
+  return MOCK ? mock().getStatsConns(o) : req<ConnLogEntry[]>(`api/stats/conns${statsLogQS(o)}`)
 }
 
 /**
@@ -1218,6 +1593,17 @@ export interface RuleReach {
   shadowed_by_order?: number
   /** Operator-facing sentence; absent when `unreachable` is false. */
   reason?: string
+  /**
+   * Whether the rule is IN FORCE right now — `Rule.Enabled` after the active WAN
+   * profile's overrides. This is NOT `GET /api/config`'s `Enabled`: that one is
+   * the desired state the page PUTs back, and on a router with profiles the two
+   * legitimately disagree. Draw rows from this; keep the switch on the other.
+   */
+  effective_enabled: boolean
+  /** The active profile that CHANGED this rule's state; absent when none did. */
+  overridden_by?: string
+  /** Which way it went. Absent together with `overridden_by`. */
+  override?: 'enabled' | 'disabled'
 }
 
 /** GET /api/rules/reachability. `rules` is ALWAYS an array, one entry per rule in
@@ -1228,12 +1614,12 @@ export interface RulesReachability {
 
 /** GET /api/rules/reachability — which routing rules can never fire, and why. */
 export function getRulesReachability(): Promise<RulesReachability> {
-  return MOCK ? mock.getRulesReachability() : req<RulesReachability>('api/rules/reachability')
+  return MOCK ? mock().getRulesReachability() : req<RulesReachability>('api/rules/reachability')
 }
 
 /** GET /api/ruleset/status — remote rule-set / blocklist freshness + rule counts. */
 export function getRulesetStatus(): Promise<RulesetStatus[]> {
-  return MOCK ? mock.getRulesetStatus() : req<RulesetStatus[]>('api/ruleset/status')
+  return MOCK ? mock().getRulesetStatus() : req<RulesetStatus[]>('api/ruleset/status')
 }
 
 /**
@@ -1244,7 +1630,7 @@ export function getRulesetStatus(): Promise<RulesetStatus[]> {
  */
 export function updateRuleset(tag: string): Promise<RulesetStatus | { ok: boolean }> {
   return MOCK
-    ? mock.updateRuleset(tag)
+    ? mock().updateRuleset(tag)
     : req('api/ruleset/update', { method: 'POST', body: JSON.stringify({ tag }) })
 }
 
@@ -1272,7 +1658,7 @@ export interface RulesetCheck {
  */
 export function checkRulesetCategory(source: string, category: string): Promise<RulesetCheck> {
   return MOCK
-    ? mock.checkRulesetCategory(source, category)
+    ? mock().checkRulesetCategory(source, category)
     : req<RulesetCheck>('api/ruleset/check', {
         method: 'POST',
         body: JSON.stringify({ source, category }),
@@ -1301,18 +1687,18 @@ export interface RulesetCategories {
  */
 export function getRulesetCategories(source: string): Promise<RulesetCategories> {
   return MOCK
-    ? mock.getRulesetCategories(source)
+    ? mock().getRulesetCategories(source)
     : req<RulesetCategories>(`api/ruleset/categories?source=${encodeURIComponent(source)}`)
 }
 
 /** GET /api/devices — discovered LAN clients merged with per-device config. */
 export function getDevices(): Promise<DiscoveredDevice[]> {
-  return MOCK ? mock.getDevices() : req<DiscoveredDevice[]>('api/devices')
+  return MOCK ? mock().getDevices() : req<DiscoveredDevice[]>('api/devices')
 }
 
 /** GET /api/interfaces — the router's UCI network interfaces for the egress picker. */
 export function getInterfaces(): Promise<Interface[]> {
-  return MOCK ? mock.getInterfaces() : req<Interface[]>('api/interfaces')
+  return MOCK ? mock().getInterfaces() : req<Interface[]>('api/interfaces')
 }
 
 /** POST /api/session — exchange a single-use handoff token for a session cookie. */
@@ -1348,7 +1734,7 @@ export function importWg(conf: string): Promise<{ uri: string; name: string }> {
  */
 export function updateSubscription(name: string): Promise<{ added: number }> {
   return MOCK
-    ? mock.updateSubscription(name)
+    ? mock().updateSubscription(name)
     : req('api/subscription/update', { method: 'POST', body: JSON.stringify({ name }) })
 }
 
@@ -1368,7 +1754,7 @@ export function updateSubscription(name: string): Promise<{ added: number }> {
 export function getGroupsHealth(
   opts: { group?: string; members?: boolean } = {},
 ): Promise<GroupsHealth> {
-  if (MOCK) return mock.getGroupsHealth(opts)
+  if (MOCK) return mock().getGroupsHealth(opts)
   const p = new URLSearchParams()
   if (opts.group) p.set('group', opts.group)
   if (opts.members) p.set('members', '1')
@@ -1377,8 +1763,21 @@ export function getGroupsHealth(
 }
 
 /**
- * One group's (or chain's) last test: which member the balancer picked, how fast
- * it answered, and what the internet saw as the source address.
+ * What the OBSERVATORY measured for one group or chain — not a dial the panel
+ * made.
+ *
+ * This shape used to come from a fresh connection opened on demand, straight at
+ * the target. That was a lie on any router whose proxies are blocked when dialled
+ * directly and work only as a hop behind a tunnel: the card reported dead for a
+ * path that carries traffic all day. The daemon now has exactly one thing that
+ * measures — the background observatory, which probes along the REAL dial path,
+ * per-hop copies and all — and this endpoint reports what it found. There is no
+ * second measurement anywhere, and the panel never opens a connection of its own.
+ *
+ * So read the fields as a READ, not as a test run: `ok` and `delay_ms` are the
+ * observatory's verdict for the path traffic actually takes, and `tested_unix`
+ * (router clock, seconds) is when the OBSERVATORY took that measurement — which
+ * can be a few seconds before the refresh was asked for.
  *
  * `ok:true` with an EMPTY `exit_ip`/`exit_country` is a valid, successful result,
  * not a partial failure: the delay was measured but the exit address could not be
@@ -1387,10 +1786,23 @@ export function getGroupsHealth(
  *
  * Chains ride the same endpoint. For a chain row, `group` carries the CHAIN's
  * name and `selected` the node its last group hop picked ('' when the exit hop
- * isn't a group). Everything else reads the same way.
+ * isn't a group). Per-hop detail is a different read: {@link ChainHopHealth}.
  *
- * `ok:false` ⇒ the test failed and `error` carries the human reason; every other
- * field is meaningless. `tested_unix` is the router's clock, in seconds.
+ * `ok:false` ⇒ there is no usable measurement and `error` carries the human
+ * reason; every other field is meaningless. Four of those reasons are about the
+ * observatory rather than the path, and must not be rendered as "your target is
+ * broken":
+ *
+ *   "not routed by any enabled rule, so nothing measures it — the observatory
+ *    only probes paths the rules use"
+ *   "the observatory has not reached this target yet — it refreshes on the
+ *    global probe interval"
+ *   "background probing is disabled, so there is nothing to measure this target
+ *    with"
+ *   "the observatory's probe through this path failed"
+ *
+ * Only the last one is a health finding. The first three say the measurement
+ * does not exist, which is a different thing and a different fix.
  */
 export interface GroupTestResult {
   group: string // group name — or a chain name for a chain row
@@ -1407,7 +1819,11 @@ export interface GroupTestResult {
  * GET /api/groups/test — progress plus every result so far. `results` is ALWAYS
  * an array (never null); `done`/`total` count finished vs targeted groups and
  * chains while `running` is true. Idle reads `{running:false}` with the last
- * run's results still attached, so a reload after a test still shows what it found.
+ * run's results still attached, so a reload still shows what was last read.
+ *
+ * "Running" means the observatory is working through an out-of-turn refresh pass
+ * over the named targets and this endpoint is collecting what it measures. It is
+ * not the panel dialling anything.
  */
 export interface GroupTestStatus {
   running: boolean
@@ -1440,18 +1856,24 @@ export interface GroupTestStart {
 }
 
 /**
- * POST /api/groups/test — measure a target's delay and exit address. Pass a
- * group or chain name to test one; pass nothing (or '') to test every group
- * and every chain. Singleton: a second call while a run is in flight resolves
- * to `{started:false, reason:'already running'}` rather than failing.
+ * POST /api/groups/test — ask the observatory for an out-of-turn refresh pass,
+ * then report what it measured. Pass a group or chain name to refresh one; pass
+ * nothing (or '') for every group and every chain.
+ *
+ * It does NOT dial. The observatory is the only thing in the daemon that
+ * measures anything, and it measures along the real dial path — so this is the
+ * "don't wait for the next probe interval" button, not a second opinion. The
+ * numbers it returns are the same numbers the cards are already showing, just
+ * fresher. Singleton: a second call while a pass is in flight resolves to
+ * `{started:false, reason:'already running'}` rather than failing.
  */
 export function postGroupsTest(name = ''): Promise<GroupTestStart> {
   return MOCK
-    ? mock.postGroupsTest(name)
+    ? mock().postGroupsTest(name)
     : req<GroupTestStart>('api/groups/test', { method: 'POST', body: JSON.stringify({ name }) })
 }
 
 /** GET /api/groups/test — progress + results of the current/last group test. */
 export function getGroupsTest(): Promise<GroupTestStatus> {
-  return MOCK ? mock.getGroupsTest() : req<GroupTestStatus>('api/groups/test')
+  return MOCK ? mock().getGroupsTest() : req<GroupTestStatus>('api/groups/test')
 }

panel/src/components/Button.css

@@ -1,4 +1,5 @@
-/* Buttons — mono, uppercase. .btn is ghost; .btn.primary is solid orange. */
+/* Buttons — mono, uppercase. .btn is ghost; .btn.primary is solid orange;
+ * .btn.crit is the solid-red destructive commit. */
 .btn {
   display: inline-block;
   padding: 7px 12px;
@@ -30,3 +31,16 @@
   color: #fff;
   filter: brightness(1.05);
 }
+
+/* Destructive commit. The fill is crit stepped a little toward black so white
+ * label text clears 4.5:1 in BOTH themes — the raw --crit is bright enough in
+ * dark mode to fall under it. Red here always means "this removes something". */
+.btn.crit {
+  border-color: transparent;
+  background: color-mix(in srgb, var(--crit) 88%, #000);
+  color: #fff;
+}
+.btn.crit:hover {
+  color: #fff;
+  filter: brightness(1.08);
+}

panel/src/components/Button.tsx

@@ -1,19 +1,27 @@
 import './Button.css'
+import { forwardRef } from 'react'
 import type { ButtonHTMLAttributes } from 'react'
 
 export interface ButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {
-  /** `primary` is the solid-orange call to action; `ghost` is the default. */
-  variant?: 'ghost' | 'primary'
+  /**
+   * `primary` is the solid-orange call to action; `crit` is the solid-red
+   * destructive commit (delete, remove) — semantic crit, never the accent;
+   * `ghost` is the default.
+   */
+  variant?: 'ghost' | 'primary' | 'crit'
 }
 
-export function Button({ variant = 'ghost', className, type, ...rest }: ButtonProps) {
+/** Ref-forwarding so a dialog can park focus on a specific button. */
+export const Button = forwardRef<HTMLButtonElement, ButtonProps>(function Button(
+  { variant = 'ghost', className, type, ...rest },
+  ref,
+) {
   return (
     <button
+      ref={ref}
       type={type ?? 'button'}
-      className={['btn', variant === 'primary' ? 'primary' : '', className]
-        .filter(Boolean)
-        .join(' ')}
+      className={['btn', variant === 'ghost' ? '' : variant, className].filter(Boolean).join(' ')}
       {...rest}
     />
   )
-}
+})

panel/src/components/Clock.tsx

@@ -1,11 +1,49 @@
 import { useEffect, useState } from 'react'
 
+/**
+ * The panel's wall clock, in the SAME timezone as every timestamp under it.
+ *
+ * It used to read `getUTCHours()` and print "UTC", while `format.ts` renders every
+ * log line, connection event and date through `toLocaleTimeString` — i.e. the
+ * browser's zone. In Moscow that put two clocks three hours apart on one plate,
+ * and the header was the one nobody could reconcile: the router's "started" time
+ * read later than the current time while the uptime said it had been up for hours.
+ *
+ * So the clock follows the rest of the panel — local, and it SAYS which offset
+ * that is, because a bare "12:41:07" beside a router in another zone is the
+ * ambiguity that started this. The zone label is the browser's UTC offset, not an
+ * abbreviation: "MSK"/"CEST" are not derivable everywhere, an offset always is.
+ *
+ * This is the BROWSER's clock, not the router's — the appliance has no RTC. Every
+ * router-sourced instant in the panel is converted to this clock before it is
+ * shown, which is what makes one label at the top honest for the whole page.
+ */
+function zoneLabel(d: Date): string {
+  // getTimezoneOffset() is minutes WEST of UTC, so the sign is inverted.
+  const min = -d.getTimezoneOffset()
+  if (min === 0) return 'UTC'
+  const sign = min < 0 ? '−' : '+'
+  const a = Math.abs(min)
+  const h = Math.floor(a / 60)
+  const m = a % 60
+  return `UTC${sign}${h}${m ? `:${String(m).padStart(2, '0')}` : ''}`
+}
+
 function format(d: Date): string {
   const p = (n: number) => String(n).padStart(2, '0')
-  return `${p(d.getUTCHours())}:${p(d.getUTCMinutes())}:${p(d.getUTCSeconds())} UTC`
+  return `${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())} ${zoneLabel(d)}`
 }
 
-/** Live UTC readout, tabular digits, ticking once a second. */
+/** The full zone name, for the title — "Europe/Moscow" says more than "+3" does. */
+function zoneName(): string {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone || ''
+  } catch {
+    return ''
+  }
+}
+
+/** Live local readout, tabular digits, ticking once a second. */
 export function Clock({ className }: { className?: string }) {
   const [now, setNow] = useState(() => format(new Date()))
 
@@ -14,5 +52,13 @@ export function Clock({ className }: { className?: string }) {
     return () => window.clearInterval(id)
   }, [])
 
-  return <span className={['clock', className].filter(Boolean).join(' ')}>{now}</span>
+  const zone = zoneName()
+  return (
+    <span
+      className={['clock', className].filter(Boolean).join(' ')}
+      title={zone ? `Your device's clock — ${zone}. Every time in the panel is shown in this zone.` : undefined}
+    >
+      {now}
+    </span>
+  )
 }

panel/src/components/ConfirmDialog.css

@@ -0,0 +1,162 @@
+/* <ConfirmDialog> — the safety interlock plate.
+ *
+ * This replaces the browser's native confirm dialog, which a browser can mute for
+ * good ("prevent this page from creating additional dialogs"): after that it
+ * returns false with no dialog at all, so every delete button in the panel goes
+ * dead and silent with no way to recover short of a page reload. We draw the
+ * plate ourselves, so nothing can suppress it.
+ *
+ * Faceplate language: a small rack module lifted off the panel — corner screws
+ * (reused from Faceplate.css), an engraved label, a groove above the actions.
+ * Destructive intent is carried by the crit semantic, never by the orange accent:
+ * accent means "this control is active", crit means "this destroys something".
+ */
+
+/* The veil is a fixed dark wash in both themes — a light scrim over a light
+ * panel would not read as "the panel is out of reach". Follows the tokens.css
+ * pattern: light base, dark via media query, data-theme overrides win both ways. */
+.cfm-scrim {
+  --cfm-veil: rgba(33, 29, 21, 0.52);
+}
+@media (prefers-color-scheme: dark) {
+  .cfm-scrim {
+    --cfm-veil: rgba(0, 0, 0, 0.66);
+  }
+}
+:root[data-theme='light'] .cfm-scrim {
+  --cfm-veil: rgba(33, 29, 21, 0.52);
+}
+:root[data-theme='dark'] .cfm-scrim {
+  --cfm-veil: rgba(0, 0, 0, 0.66);
+}
+
+.cfm-scrim {
+  position: fixed;
+  inset: 0;
+  z-index: 200;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  /* Short viewports: the plate scrolls with the veil instead of being clipped. */
+  overflow-y: auto;
+  padding: calc(var(--u, 8px) * 2);
+  background: var(--cfm-veil);
+  animation: cfm-veil-in 0.14s ease-out;
+}
+
+.cfm-card {
+  position: relative;
+  width: min(32rem, 100%);
+  max-height: calc(100dvh - var(--u, 8px) * 4);
+  overflow-y: auto;
+  padding: calc(var(--u, 8px) * 3.25);
+  border: 1px solid var(--groove);
+  border-radius: 12px;
+  /* same brushed plate as <Faceplate>, one step brighter so it reads as lifted */
+  background:
+    repeating-linear-gradient(
+      90deg,
+      transparent 0 2px,
+      color-mix(in srgb, var(--edge) 30%, transparent) 2px 3px
+    ),
+    linear-gradient(180deg, var(--raised), color-mix(in srgb, var(--raised) 82%, var(--panel)));
+  box-shadow:
+    0 1px 0 var(--edge) inset,
+    0 30px 60px -22px var(--shadow),
+    0 4px 12px var(--shadow);
+  animation: cfm-card-in 0.18s cubic-bezier(0.2, 0.7, 0.3, 1);
+}
+.cfm-card:focus {
+  outline: none;
+}
+
+/* `still` is set from usePrefersReducedMotion — the plate appears, it never
+ * travels. (The global reduced-motion rule in tokens.css also neutralises the
+ * duration; this keeps the intent explicit at the component.) */
+.cfm-scrim.still,
+.cfm-scrim.still .cfm-card {
+  animation: none;
+}
+
+@keyframes cfm-veil-in {
+  from {
+    opacity: 0;
+  }
+  to {
+    opacity: 1;
+  }
+}
+@keyframes cfm-card-in {
+  from {
+    opacity: 0;
+    transform: translateY(6px) scale(0.99);
+  }
+  to {
+    opacity: 1;
+    transform: none;
+  }
+}
+
+/* ---- header: engraved label + state LED ---- */
+.cfm-hd {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin-bottom: calc(var(--u, 8px) * 1.5);
+}
+.cfm-label {
+  flex: 1;
+  font-family: var(--font-mono);
+  font-size: 10px;
+  letter-spacing: var(--track-label-wide, 0.24em);
+  color: var(--dim);
+  text-transform: uppercase;
+}
+
+/* ---- copy ---- */
+.cfm-title {
+  margin: 0;
+  font-family: var(--font-mono);
+  font-weight: 700;
+  font-size: 17px;
+  line-height: 1.35;
+  color: var(--ink);
+  /* names can be long and unbroken — wrap rather than push the plate wide */
+  overflow-wrap: anywhere;
+}
+.cfm-body {
+  margin: calc(var(--u, 8px) * 1.5) 0 0;
+  max-width: 52ch;
+  font-family: var(--font-sans);
+  font-size: 13.5px;
+  line-height: 1.6;
+  color: var(--dim);
+  overflow-wrap: anywhere;
+}
+
+/* ---- action bar ---- */
+.cfm-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: calc(var(--u, 8px));
+  margin-top: calc(var(--u, 8px) * 3);
+  padding-top: calc(var(--u, 8px) * 2);
+  border-top: 1px solid var(--groove);
+}
+
+@media (max-width: 420px) {
+  .cfm-card {
+    padding: calc(var(--u, 8px) * 2.5);
+  }
+  .cfm-actions {
+    flex-wrap: wrap;
+  }
+  .cfm-actions .btn {
+    flex: 1 1 auto;
+    text-align: center;
+  }
+  /* screws crowd a small plate — drop them rather than collide with the copy */
+  .cfm-card > .screw {
+    display: none;
+  }
+}

panel/src/components/ConfirmDialog.tsx

@@ -0,0 +1,281 @@
+import './ConfirmDialog.css'
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useId,
+  useRef,
+  useState,
+} from 'react'
+import type { ReactNode } from 'react'
+import { createPortal } from 'react-dom'
+import { Button } from './Button'
+import { Led } from './Led'
+import { usePrefersReducedMotion } from './usePrefersReducedMotion'
+
+/**
+ * How the confirming button is painted.
+ *
+ *   crit    — the action destroys something. Semantic crit, never the accent.
+ *   neutral — the action is a normal commit the operator should read first
+ *             (a warning before saving); the accent's call-to-action is correct.
+ */
+export type ConfirmTone = 'crit' | 'neutral'
+
+export interface ConfirmOptions {
+  /** Engraved eyebrow, e.g. "DELETE RULE". Names the operation, not the object. */
+  label?: string
+  /** The question. One line, ends in "?". */
+  title: string
+  /** The consequence — what changes on the router if this goes through. */
+  body?: ReactNode
+  /** Verb on the confirming button. Defaults to "Delete". */
+  confirmLabel?: string
+  /** Verb on the dismissing button. Defaults to "Cancel". */
+  cancelLabel?: string
+  /** Defaults to `crit` — the overwhelmingly common case is a delete. */
+  tone?: ConfirmTone
+}
+
+export interface ConfirmDialogProps extends ConfirmOptions {
+  open: boolean
+  /** Called exactly once per dialog, with the operator's answer. */
+  onResolve: (confirmed: boolean) => void
+}
+
+const FOCUSABLE =
+  'button:not([disabled]), [href], input:not([disabled]), select:not([disabled]), textarea:not([disabled]), [tabindex]:not([tabindex="-1"])'
+
+/**
+ * The modal plate itself. Normally reached through `useConfirm()`; exported so a
+ * page that wants to own the open state can render it directly.
+ *
+ * Keyboard contract:
+ *   - focus moves to Cancel on open, so a reflex Enter dismisses, never deletes;
+ *   - Tab / Shift+Tab cycle inside the plate and cannot reach the page behind it;
+ *   - Esc answers "no";
+ *   - on close, focus returns to whatever opened the dialog.
+ */
+export function ConfirmDialog({
+  open,
+  onResolve,
+  label,
+  title,
+  body,
+  confirmLabel = 'Delete',
+  cancelLabel = 'Cancel',
+  tone = 'crit',
+}: ConfirmDialogProps) {
+  const titleId = useId()
+  const bodyId = useId()
+  const cardRef = useRef<HTMLDivElement>(null)
+  const cancelRef = useRef<HTMLButtonElement>(null)
+  const openerRef = useRef<HTMLElement | null>(null)
+  const reduced = usePrefersReducedMotion()
+
+  // Take the page out of the tab order, park focus on Cancel, and hand focus
+  // back to the opener when the plate goes away.
+  useEffect(() => {
+    if (!open) return
+    const opener = document.activeElement
+    openerRef.current = opener instanceof HTMLElement ? opener : null
+
+    const prevOverflow = document.body.style.overflow
+    document.body.style.overflow = 'hidden'
+
+    // Cancel is the resting place: an Enter or a Space meant for the page lands
+    // on "no". The destructive button is one Tab away, deliberately.
+    ;(cancelRef.current ?? cardRef.current)?.focus()
+
+    return () => {
+      document.body.style.overflow = prevOverflow
+      const back = openerRef.current
+      openerRef.current = null
+      if (back && document.contains(back)) back.focus()
+    }
+  }, [open])
+
+  // Esc answers no; Tab is caged. Capture phase so a page-level key handler
+  // never sees keys aimed at the dialog.
+  useEffect(() => {
+    if (!open) return
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === 'Escape') {
+        e.preventDefault()
+        e.stopPropagation()
+        onResolve(false)
+        return
+      }
+      if (e.key !== 'Tab') return
+      const card = cardRef.current
+      if (!card) return
+      const list = Array.from(card.querySelectorAll<HTMLElement>(FOCUSABLE))
+      if (list.length === 0) {
+        e.preventDefault()
+        card.focus()
+        return
+      }
+      const first = list[0]
+      const last = list[list.length - 1]
+      const active = document.activeElement as HTMLElement | null
+      if (!active || !card.contains(active)) {
+        e.preventDefault()
+        ;(e.shiftKey ? last : first).focus()
+      } else if (e.shiftKey && active === first) {
+        e.preventDefault()
+        last.focus()
+      } else if (!e.shiftKey && active === last) {
+        e.preventDefault()
+        first.focus()
+      }
+    }
+    document.addEventListener('keydown', onKey, true)
+    return () => document.removeEventListener('keydown', onKey, true)
+  }, [open, onResolve])
+
+  if (!open) return null
+
+  return createPortal(
+    <div
+      className={['cfm-scrim', reduced ? 'still' : ''].filter(Boolean).join(' ')}
+      // A click on the field around the plate means "not now". Mousedown (not
+      // click) so a text selection dragged out of the plate can't dismiss it.
+      onMouseDown={(e) => {
+        if (e.target === e.currentTarget) onResolve(false)
+      }}
+    >
+      <div
+        className={`cfm-card tone-${tone}`}
+        ref={cardRef}
+        tabIndex={-1}
+        role="alertdialog"
+        aria-modal="true"
+        aria-labelledby={titleId}
+        aria-describedby={body != null ? bodyId : undefined}
+      >
+        <i className="screw tl" aria-hidden="true" />
+        <i className="screw tr" aria-hidden="true" />
+        <i className="screw bl" aria-hidden="true" />
+        <i className="screw br" aria-hidden="true" />
+
+        {/* Lamp first, then the engraved label — the way a real panel reads, and
+            it keeps the LED off the corner screw. */}
+        <div className="cfm-hd">
+          <Led variant={tone === 'crit' ? 'crit' : 'amber'} />
+          <span className="cfm-label">{label ?? (tone === 'crit' ? 'Confirm delete' : 'Confirm')}</span>
+        </div>
+
+        <h2 className="cfm-title" id={titleId}>
+          {title}
+        </h2>
+        {body != null && (
+          <p className="cfm-body" id={bodyId}>
+            {body}
+          </p>
+        )}
+
+        <div className="cfm-actions">
+          <Button ref={cancelRef} onClick={() => onResolve(false)}>
+            {cancelLabel}
+          </Button>
+          <Button variant={tone === 'crit' ? 'crit' : 'primary'} onClick={() => onResolve(true)}>
+            {confirmLabel}
+          </Button>
+        </div>
+      </div>
+    </div>,
+    document.body,
+  )
+}
+
+// ---- provider + hook --------------------------------------------------------
+
+interface Request extends ConfirmOptions {
+  id: number
+  resolve: (v: boolean) => void
+}
+
+const ConfirmCtx = createContext<((o: ConfirmOptions) => Promise<boolean>) | null>(null)
+
+/**
+ * Mount once at the app root. Everything below can then ask a question and await
+ * the answer.
+ */
+export function ConfirmProvider({ children }: { children: ReactNode }) {
+  const [req, setReq] = useState<Request | null>(null)
+  const pending = useRef<Request | null>(null)
+  const seq = useRef(0)
+
+  const confirm = useCallback(
+    (opts: ConfirmOptions) =>
+      new Promise<boolean>((resolve) => {
+        // A second question while one is open answers the first with "no" rather
+        // than leaving its promise — and its caller — hanging forever.
+        pending.current?.resolve(false)
+        seq.current += 1
+        const next: Request = { ...opts, id: seq.current, resolve }
+        pending.current = next
+        setReq(next)
+      }),
+    [],
+  )
+
+  const settle = useCallback((confirmed: boolean) => {
+    const open = pending.current
+    pending.current = null
+    setReq(null)
+    open?.resolve(confirmed)
+  }, [])
+
+  // Teardown must not strand a caller mid-await.
+  useEffect(
+    () => () => {
+      pending.current?.resolve(false)
+      pending.current = null
+    },
+    [],
+  )
+
+  // A question belongs to the page that asked it. The provider outlives the
+  // hash router, so a navigation would otherwise leave a stale plate floating
+  // over a page it has nothing to do with — answer it "no" and clear it.
+  useEffect(() => {
+    const onNav = () => {
+      if (pending.current) settle(false)
+    }
+    window.addEventListener('hashchange', onNav)
+    return () => window.removeEventListener('hashchange', onNav)
+  }, [settle])
+
+  return (
+    <ConfirmCtx.Provider value={confirm}>
+      {children}
+      {req !== null && <ConfirmDialog key={req.id} open onResolve={settle} {...req} />}
+    </ConfirmCtx.Provider>
+  )
+}
+
+/**
+ * Ask the operator, get a definite answer:
+ *
+ *   const confirm = useConfirm()
+ *   if (!(await confirm({ title: 'Delete rule "x"?', body: '…' }))) return
+ *
+ * The returned function is stable, so it is safe in a useCallback dep list. It
+ * always settles — cancel, Esc, click-outside and teardown all resolve `false`;
+ * only the confirming button resolves `true`.
+ *
+ * Name it `confirm` at the call site on purpose: the local binding shadows the
+ * global one inside that component, so an accidental bare `confirm(...)` cannot
+ * reach the suppressible native dialog.
+ */
+export function useConfirm(): (o: ConfirmOptions) => Promise<boolean> {
+  const ctx = useContext(ConfirmCtx)
+  if (!ctx) {
+    // Loud on purpose. A fallback that quietly resolved false would rebuild the
+    // exact bug this component exists to kill.
+    throw new Error('useConfirm() needs <ConfirmProvider> above it (mounted in main.tsx)')
+  }
+  return ctx
+}

panel/src/components/index.ts

@@ -17,6 +17,8 @@ export { Button } from './Button'
 export type { ButtonProps } from './Button'
 export { Select } from './Select'
 export type { SelectProps, SelectOption } from './Select'
+export { ConfirmDialog, ConfirmProvider, useConfirm } from './ConfirmDialog'
+export type { ConfirmDialogProps, ConfirmOptions, ConfirmTone } from './ConfirmDialog'
 export { Clock } from './Clock'
 export { CatSuggest } from './CatSuggest'
 export { SrcPicker } from './SrcPicker'

panel/src/egressEdit.test.ts

@@ -0,0 +1,116 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import type { Egress } from './api.ts'
+import {
+  DPI_TYPES,
+  EGRESS_TYPES,
+  UNKNOWN_EGRESS_TYPE_HINT,
+  isKnownEgressType,
+  nextEgress,
+} from './egressEdit.ts'
+
+// The egress editor's save merge. The defect these pin: the submit handler
+// cleared Interface, Port and DPI for every type it did not have a branch for —
+// including types it renders no field for at all — so opening an egress the
+// panel calls "(unknown)" and changing only its NAME deleted its interface. On a
+// `tunnel` egress that was live damage: the data plane routed it for real, and
+// `untunnelable_egress` resolves through exactly that field, so the ESP/AH/GRE/
+// IGMP/SCTP carrier silently stopped existing and those protocols fell back to
+// the untunnelable policy.
+
+test('an unknown type keeps the fields the editor never showed', () => {
+  const initial: Egress = { Name: 'vpn', Type: 'wireguard', Interface: 'wg0', DPI: 'fragment' }
+  // The form as the editor would hold it for an unknown type: no Interface
+  // input is rendered, no port input, no DPI select. Only the name was touched.
+  const out = nextEgress(initial, {
+    name: 'vpn-renamed',
+    type: 'wireguard',
+    iface: 'wg0',
+    port: '',
+    dpi: 'off',
+  })
+  assert.equal(out.Name, 'vpn-renamed')
+  assert.equal(out.Type, 'wireguard')
+  assert.equal(
+    out.Interface,
+    'wg0',
+    'renaming an egress whose type this panel does not know must not delete its interface',
+  )
+  assert.equal(out.DPI, 'fragment', 'nor any other field the form declined to display')
+})
+
+test('an unknown type with a blank form state still keeps what was stored', () => {
+  // The stricter version: the editor's `iface` state is seeded from `initial`,
+  // so a test that passes the same value back could pass on a broken merge too.
+  // Blank the form and the stored value must still survive.
+  const initial: Egress = { Name: 'vpn', Type: 'wireguard', Interface: 'wg0', Port: 9050 }
+  const out = nextEgress(initial, { name: 'vpn', type: 'wireguard', iface: '', port: '', dpi: '' })
+  assert.equal(out.Interface, 'wg0')
+  assert.equal(out.Port, 9050)
+})
+
+test('the inputs are not mutated — the caller keeps a usable `initial`', () => {
+  const initial: Egress = { Name: 'vpn', Type: 'wireguard', Interface: 'wg0' }
+  nextEgress(initial, { name: 'other', type: 'interface', iface: 'wan2', port: '', dpi: 'off' })
+  assert.deepEqual(initial, { Name: 'vpn', Type: 'wireguard', Interface: 'wg0' })
+})
+
+test('a known type still clears the fields it does not use', () => {
+  // The other half of the contract: for a type the editor DOES render, stale
+  // settings from the previous type must go, or the config keeps a value the new
+  // type ignores and the panel shows a setting that does nothing.
+  const initial: Egress = { Name: 'e', Type: 'interface', Interface: 'wan2', DPI: 'fragment' }
+  const out = nextEgress(initial, { name: 'e', type: 'byedpi', iface: 'wan2', port: '1081', dpi: 'fragment' })
+  assert.equal(out.Type, 'byedpi')
+  assert.equal(out.Interface, undefined, 'a byedpi egress has no interface')
+  assert.equal(out.Port, 1081)
+  assert.equal(out.DPI, undefined, 'byedpi desyncs itself; the native preset is not applied')
+})
+
+test('an interface egress carries its interface and DPI, and no port', () => {
+  const out = nextEgress(undefined, {
+    name: '  wan-direct  ',
+    type: 'interface',
+    iface: '  wan2  ',
+    port: '1080',
+    dpi: 'record',
+  })
+  assert.equal(out.Name, 'wan-direct', 'the name is trimmed')
+  assert.equal(out.Interface, 'wan2', 'the interface is trimmed')
+  assert.equal(out.Port, undefined, 'only a byedpi egress dials a port')
+  assert.equal(out.DPI, 'record')
+})
+
+test('a byedpi egress with no port falls back to the ciadpi default', () => {
+  const out = nextEgress(undefined, { name: 'b', type: 'byedpi', iface: '', port: '  ', dpi: 'off' })
+  assert.equal(out.Port, 1080)
+})
+
+test('the type list is the closed set the daemon builds outbounds for', () => {
+  // model.KnownEgressTypes. `tunnel` must NOT be here: the daemon folds it to
+  // `interface` on read (model.NormalizeEgressTypes), so the panel receives the
+  // canonical spelling and a second entry would put the split back into the UI.
+  assert.deepEqual(
+    EGRESS_TYPES.map((t) => t.id),
+    ['interface', 'direct', 'byedpi'],
+  )
+  assert.equal(isKnownEgressType('tunnel'), false)
+  assert.equal(isKnownEgressType('interface'), true)
+  assert.deepEqual([...DPI_TYPES].sort(), ['direct', 'interface'])
+})
+
+test('the unknown-type hint describes what actually happens, both halves of it', () => {
+  // It has to name the ROUTING as well as the outbound — the old text said only
+  // "this engine builds no outbound", which was false for the one unknown type
+  // anybody had, because the data plane was building that egress a real routing
+  // table at the same time. And it has to promise what nextEgress now keeps.
+  assert.match(UNKNOWN_EGRESS_TYPE_HINT, /routing rule or table/)
+  assert.match(UNKNOWN_EGRESS_TYPE_HINT, /no outbound/)
+  assert.match(UNKNOWN_EGRESS_TYPE_HINT, /blocked/)
+  assert.match(UNKNOWN_EGRESS_TYPE_HINT, /leaves this egress’s other settings/)
+  assert.doesNotMatch(
+    UNKNOWN_EGRESS_TYPE_HINT,
+    /This engine builds no outbound for that type/,
+    'the superseded sentence claimed the engine was the only half involved',
+  )
+})

panel/src/egressEdit.ts

@@ -0,0 +1,142 @@
+import type { Egress } from './api'
+
+/**
+ * The egress editor's data half — the closed type list and the one function that
+ * decides which fields a save writes.
+ *
+ * It lives outside `pages/Targets.tsx` because it is the part that must be
+ * TESTED, and the panel's test runner is `node --test src/*.test.ts`: plain
+ * modules only, no JSX, no DOM. Extracting it is not tidiness — the bug below
+ * shipped precisely because "which fields does Save write?" was three lines
+ * buried in a submit handler that nothing could call.
+ */
+
+/**
+ * The three egress kinds that produce a real way out, in the order the editor
+ * offers them. This is the panel's copy of `model.KnownEgressTypes` and must
+ * stay equal to it: the daemon builds no outbound for anything else, and the
+ * router installs no mark, no `ip rule` and no routing table for it either, so
+ * every node, group and rule bound to such an egress is blocked.
+ *
+ * `tunnel` is deliberately NOT here. It is an accepted spelling in
+ * `/etc/config/shater`, but the daemon folds it to `interface` on read
+ * (model.NormalizeEgressTypes), so an egress written that way arrives at this
+ * panel already saying `interface` — with its Interface field rendered, its
+ * blurb correct and no "(unknown)" label. Adding a fourth entry here would put
+ * the second spelling back into a UI that has to agree with two backend halves.
+ *
+ * `proxy` and `block` were removed: neither ever created an outbound, so
+ * everything bound to them fell through to the plain WAN with the real address.
+ * Send traffic through a proxy by routing it at a group/node/chain, and drop it
+ * with the `block` target on a rule.
+ */
+export const EGRESS_TYPES: ReadonlyArray<{ id: string; label: string; blurb: string }> = [
+  {
+    id: 'interface',
+    label: 'Interface — out a specific WAN or tunnel',
+    blurb: 'Binds to one device (wan, wg0, …) so this traffic leaves over that uplink.',
+  },
+  {
+    id: 'direct',
+    label: 'Direct — straight out, with an optional DPI preset',
+    blurb: 'Uses the normal route. Its point is the DPI preset below, applied to what you route here.',
+  },
+  {
+    id: 'byedpi',
+    label: 'ByeDPI — through the local ciadpi desync proxy',
+    blurb: 'Hands traffic to ciadpi on 127.0.0.1, which desyncs it and goes out direct.',
+  },
+]
+
+/** Lookup by id, or undefined when the stored type is not one this panel knows. */
+export function egressTypeInfo(type: string): (typeof EGRESS_TYPES)[number] | undefined {
+  return EGRESS_TYPES.find((t) => t.id === type)
+}
+
+/** Whether this panel has a definition — and therefore its own fields — for the type. */
+export function isKnownEgressType(type: string): boolean {
+  return egressTypeInfo(type) !== undefined
+}
+
+/**
+ * Types whose native DPI-bypass preset applies. NOT byedpi: the desync happens
+ * inside the ciadpi process, and the engine's tls_* flags are never stamped on
+ * top of it — so the control is hidden there rather than accepted and dropped.
+ */
+export const DPI_TYPES: ReadonlySet<string> = new Set(['interface', 'direct'])
+
+/**
+ * What the editor shows under the Type select when the stored type is not one of
+ * the three. It has to describe what the router actually does with such an
+ * egress, and what THIS FORM does to it on save — both halves were wrong before.
+ *
+ * It used to read: "This engine builds no outbound for that type, so everything
+ * routed here is blocked. Pick one above." Two problems. It said "this engine",
+ * as if only the engine were involved, at a time when the data plane happily
+ * built an `ip rule`, a routing table and a mark bypass for a `tunnel` egress and
+ * `untunnelable_egress` carried live ESP/GRE out of it — so the sentence was
+ * flatly false for the one unknown type anybody had. And it stayed silent about
+ * the thing this form was doing to the egress: saving it wiped `Interface`,
+ * because the field is only rendered for `type === 'interface'` and the submit
+ * handler cleared every field it did not render. That is fixed in nextEgress
+ * below, and the text now says so, because a promise about saving is only worth
+ * making next to the code that keeps it.
+ */
+export const UNKNOWN_EGRESS_TYPE_HINT =
+  'The router does not recognise this type: it builds no outbound for it and installs no ' +
+  'routing rule or table, so everything routed here is blocked — never sent out over the ' +
+  'plain WAN. Pick a type above to fix it; saving leaves this egress’s other settings ' +
+  'exactly as they are until you do.'
+
+/** The editor's form state, as strings straight out of the inputs. */
+export interface EgressForm {
+  name: string
+  type: string
+  iface: string
+  port: string
+  dpi: string
+}
+
+/**
+ * Merge the form back onto the egress being edited.
+ *
+ * # The rule, and why it is the rule
+ *
+ * A save may only CLEAR a field the editor was in a position to show. For the
+ * three known types the editor renders every field that type uses, so clearing
+ * the others is right: switching `interface` → `byedpi` must drop the stale
+ * interface name, or the config keeps a setting the new type ignores.
+ *
+ * For a type this panel has no definition for, the editor renders NONE of those
+ * fields — and used to clear all three anyway:
+ *
+ *     base.Interface = type === 'interface' ? iface.trim() : undefined
+ *
+ * So opening an egress the panel calls "(unknown)", changing nothing but its
+ * name, and pressing Save silently deleted its `interface`. That was not
+ * hypothetical damage. `tunnel` was such a type, the data plane routed it for
+ * real, and `untunnelable_egress` pointing at it is resolved by
+ * netplane.UntunnelableEgressBinding through exactly that field: with the
+ * interface gone the binding fails, the ESP/AH/GRE/IGMP/SCTP protection quietly
+ * stops existing, and those protocols fall back to the untunnelable policy —
+ * from one rename, with no message anywhere.
+ *
+ * The daemon no longer hands this panel a `tunnel` (it is folded to `interface`
+ * on read), so that particular type is gone. The rule stays, because the next
+ * type the backend gains before the panel learns it would repeat the whole
+ * thing: an editor must not delete what it declines to display.
+ *
+ * `initial` is never mutated — the caller keeps a usable object if the save
+ * fails.
+ */
+export function nextEgress(initial: Egress | undefined, form: EgressForm): Egress {
+  const type = form.type
+  const base: Egress = { ...(initial ?? ({} as Egress)), Name: form.name.trim(), Type: type }
+  // There is no `Target` to clear — the field is not in the Go model, so GET
+  // never delivers one and the spread above cannot produce one.
+  if (!isKnownEgressType(type)) return base
+  base.Interface = type === 'interface' ? form.iface.trim() : undefined
+  base.Port = type === 'byedpi' ? Number(form.port.trim()) || 1080 : undefined
+  base.DPI = DPI_TYPES.has(type) ? form.dpi : undefined
+  return base
+}

panel/src/findings.test.ts

@@ -0,0 +1,127 @@
+// findings.ts — which apply-time finding is shown where.
+//
+// Run with `npm test` (node's built-in test runner + native TypeScript
+// stripping; no test dependency is added to the SPA, which ships inside the
+// daemon binary).
+//
+// Two defects are pinned here.
+//
+// 1. THE TRUNCATION NOTE WAS UNREACHABLE. The daemon caps Status.warnings at 50
+//    and overwrites the last slot with an `info` note counting what it dropped.
+//    Overview filtered `info` away wholesale, and the settings-page route keys on
+//    a section (`generate`) that no page owns — so the single line telling the
+//    operator "you are not seeing all of it" reached no screen at all.
+//
+// 2. FINDINGS ABOUT AN ENTITY NEVER REACHED THAT ENTITY'S PAGE. The generator
+//    drops a node it cannot build and names it; the Nodes page rendered that node
+//    as an ordinary row with a green toggle, because it never read the findings.
+
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+
+import {
+  attentionFindings,
+  entityFindings,
+  findingsByName,
+  sectionNotes,
+  truncationNote,
+  worstSeverity,
+} from './findings.ts'
+import type { StatusWarning } from './api.ts'
+
+const crit = (section: string, name: string, message = 'broken'): StatusWarning => ({
+  severity: 'critical',
+  section,
+  name,
+  message,
+})
+const warn = (section: string, name: string, message = 'degraded'): StatusWarning => ({
+  severity: 'warning',
+  section,
+  name,
+  message,
+})
+const info = (section: string, name: string, message: string): StatusWarning => ({
+  severity: 'info',
+  section,
+  name,
+  message,
+})
+
+/** Verbatim from apply/warnings.go finalizeWarnings. */
+const SUPPRESSED = info(
+  'generate',
+  '',
+  '7 further warning(s) suppressed; run `logread -e shater` for the full list',
+)
+
+// --- the truncation note ----------------------------------------------------
+
+test('the truncation note is found, whatever else is in the list', () => {
+  const note = truncationNote([crit('rule', 'a'), warn('node', 'b'), SUPPRESSED])
+  assert.notEqual(note, null)
+  assert.match(note!.message, /7 further warning/)
+})
+
+test('a whole list has no truncation note', () => {
+  assert.equal(truncationNote([crit('rule', 'a'), warn('node', 'b')]), null)
+  assert.equal(truncationNote([]), null)
+  assert.equal(truncationNote(undefined), null)
+})
+
+test('an ordinary info note is not mistaken for the truncation note', () => {
+  const notes = [info('untunnelable', 'block', 'Ping and traceroute do not work…')]
+  assert.equal(truncationNote(notes), null)
+})
+
+test('the truncation note is kept out of the settings-page notes it would pollute', () => {
+  const all = [info('generate', '', 'cache: moved to /overlay'), SUPPRESSED]
+  const notes = sectionNotes(all, 'generate')
+  assert.equal(notes.length, 1)
+  assert.match(notes[0].message, /cache:/)
+})
+
+test('the attention list still carries only critical and warning', () => {
+  const all = [crit('rule', 'a'), warn('node', 'b'), info('untunnelable', 'block', 'x'), SUPPRESSED]
+  const attention = attentionFindings(all)
+  assert.equal(attention.length, 2)
+  assert.ok(attention.every((w) => w.severity !== 'info'))
+})
+
+// --- per-entity findings ----------------------------------------------------
+
+test('a page takes only the sections it owns', () => {
+  const all = [
+    crit('node', 'tokyo-01', 'parse share-link: bad scheme (skipped)'),
+    warn('subscription', 'qomar', 'fetch failed'),
+    crit('rule', 'default', 'never applies'),
+    info('generate', '', 'cache: x'),
+  ]
+  const mine = entityFindings(all, ['node', 'subscription'])
+  assert.deepEqual(
+    mine.map((w) => w.name),
+    ['tokyo-01', 'qomar'],
+  )
+})
+
+test('entity findings never include info notes', () => {
+  const all = [info('node', 'tokyo-01', 'just a note'), SUPPRESSED]
+  assert.equal(entityFindings(all, ['node', 'generate']).length, 0)
+})
+
+test('findings index by name, and global (unnamed) ones are left out', () => {
+  const all = [
+    crit('node', 'tokyo-01', 'first'),
+    warn('node', 'tokyo-01', 'second'),
+    crit('node', '', 'global to the section'),
+  ]
+  const byName = findingsByName(entityFindings(all, ['node']))
+  assert.equal(byName.size, 1)
+  assert.equal(byName.get('tokyo-01')!.length, 2)
+})
+
+test('one lamp per row takes the loudest severity', () => {
+  assert.equal(worstSeverity([warn('node', 'a'), crit('node', 'a')]), 'critical')
+  assert.equal(worstSeverity([warn('node', 'a')]), 'warning')
+  assert.equal(worstSeverity([]), null)
+})

panel/src/findings.ts

@@ -6,7 +6,8 @@
 //
 //   critical / warning — something needs attention: a protection promise is
 //     broken, or something you configured isn't in effect. These belong on
-//     Overview, where the operator looks first.
+//     Overview, where the operator looks first — and, when they name an entity,
+//     ALSO on the page that owns that entity (see `entityFindings`).
 //
 //   info — a statement ABOUT the configuration, not a problem. It never clears,
 //     because nothing is wrong: it is simply describing a choice that was made.
@@ -16,9 +17,49 @@
 // page that never goes away and never asks for anything trains people to skim
 // the list — which is exactly how a real critical finding gets missed. Anything
 // standing in the findings list should be something you could act on.
+//
+// The one exception is carved out below: the daemon's own note that it dropped
+// findings to fit the cap. It is `info` by severity and unactionable by nature,
+// and it is the single most important line in the list, because it is the list
+// telling you it is not the whole list.
 
 import type { StatusWarning } from './api'
 
+/**
+ * The daemon's truncation disclosure, verbatim from apply/warnings.go
+ * finalizeWarnings:
+ *
+ *   "%d further warning(s) suppressed; run `logread -e shater` for the full list"
+ *
+ * Matched on the stable clause rather than the whole sentence so a reworded tail
+ * still registers. If this ever stops matching, the failure mode is a list that
+ * silently claims to be complete — which is why `truncationNote` is tested.
+ */
+const SUPPRESSED_RE = /further warning\(s\) suppressed/
+
+/**
+ * The daemon's "this list is incomplete" note, or null when the list is whole.
+ *
+ * Status.warnings is capped at 50, sorted critical-first, and the last slot is
+ * REPLACED by an `info` note counting what was dropped. That note therefore
+ * arrives on the one channel the panel filtered away wholesale: `info` never
+ * reached Overview, and the settings-page route (`sectionNotes`) keys on
+ * section `generate`, which no page owns. So the single line saying "there are
+ * findings you are not being shown" was the only one guaranteed to be invisible.
+ *
+ * Callers must render this WITH the attention list, not instead of it.
+ */
+export function truncationNote(warnings: StatusWarning[] | undefined): StatusWarning | null {
+  return (
+    (warnings ?? []).find((w) => w.severity === 'info' && SUPPRESSED_RE.test(w.message)) ?? null
+  )
+}
+
+/** Is this the truncation disclosure rather than an ordinary note? */
+function isTruncationNote(w: StatusWarning): boolean {
+  return w.severity === 'info' && SUPPRESSED_RE.test(w.message)
+}
+
 /** Findings that need attention — the Overview list. Info notes are excluded. */
 export function attentionFindings(warnings: StatusWarning[] | undefined): StatusWarning[] {
   return (warnings ?? []).filter((w) => w.severity === 'critical' || w.severity === 'warning')
@@ -29,10 +70,58 @@ export function attentionFindings(warnings: StatusWarning[] | undefined): Status
  * (e.g. `untunnelable` → the Networks page's "Other traffic" section). Only info:
  * a critical/warning is an attention item and stays on Overview, so it can't be
  * quietly buried on a settings page instead.
+ *
+ * The truncation note is excluded: it is about the LIST, not about any section,
+ * and it has its own home beside the list ({@link truncationNote}).
  */
 export function sectionNotes(
   warnings: StatusWarning[] | undefined,
   section: string,
 ): StatusWarning[] {
-  return (warnings ?? []).filter((w) => w.severity === 'info' && w.section === section)
+  return (warnings ?? []).filter(
+    (w) => w.severity === 'info' && w.section === section && !isTruncationNote(w),
+  )
+}
+
+/**
+ * The attention findings about entities ONE page owns — for that page to show
+ * beside the entities themselves.
+ *
+ * Overview is where you look when you already suspect something; a page like
+ * Nodes is where you look when you don't. The generator drops a node it cannot
+ * build — an unparseable share link, a WireGuard key materialised twice — and
+ * says so by name ("node \"x\": parse share-link: … (skipped)"), yet that node
+ * kept rendering as an ordinary row with a green toggle, because the page never
+ * read the findings at all. The switch says on; the engine has no such outbound.
+ *
+ * This does NOT move anything off Overview: the same finding appears in both
+ * places, which is correct — one list is "what is wrong with this router", the
+ * other is "what is wrong with this node".
+ */
+export function entityFindings(
+  warnings: StatusWarning[] | undefined,
+  sections: readonly string[],
+): StatusWarning[] {
+  const want = new Set(sections)
+  return attentionFindings(warnings).filter((w) => want.has(w.section))
+}
+
+/** Index attention findings by entity name, for badging a row directly. Entries
+ *  with an empty `name` are global to their section and are left out. */
+export function findingsByName(findings: StatusWarning[]): Map<string, StatusWarning[]> {
+  const out = new Map<string, StatusWarning[]>()
+  for (const f of findings) {
+    if (!f.name) continue
+    const list = out.get(f.name)
+    if (list) list.push(f)
+    else out.set(f.name, [f])
+  }
+  return out
+}
+
+/** The loudest severity in a set — for a row badge that has room for one lamp. */
+export function worstSeverity(findings: StatusWarning[]): 'critical' | 'warning' | null {
+  if (findings.some((f) => f.severity === 'critical')) return 'critical'
+  if (findings.length > 0) return 'warning'
+  return null
 }

panel/src/format.ts

@@ -77,6 +77,39 @@ export function fmtDateTime(unix: number): string {
   return d && t ? `${d}, ${t}` : d || t
 }
 
+// --- remote-list freshness ---------------------------------------------------
+// A url/geo-sourced list re-fetches on a cadence and the engine reports when it
+// last pulled (GET /api/ruleset/status). Routing shows this for rule-sets and DNS
+// shows it for blocklists, so the two readings live here and cannot drift apart.
+
+/** "updated 3h ago" / "never updated" for a remote list's last fetch (RFC3339). */
+export function relFetch(iso: string): string {
+  if (!iso) return 'never updated'
+  const t = Date.parse(iso)
+  if (Number.isNaN(t)) return 'never updated'
+  const s = Math.max(0, Math.floor((Date.now() - t) / 1000))
+  if (s < 45) return 'updated just now'
+  const m = Math.floor(s / 60)
+  if (m < 60) return `updated ${m}m ago`
+  const h = Math.floor(m / 60)
+  if (h < 24) return `updated ${h}h ago`
+  const d = Math.floor(h / 24)
+  return `updated ${d}d ago`
+}
+
+/** "every 24h" for an auto-update cadence in seconds ("" when there is none). */
+export function everyLabel(sec: number): string {
+  if (!sec || sec <= 0) return ''
+  if (sec % 3600 === 0) {
+    const h = sec / 3600
+    if (h < 48) return `every ${h}h`
+    if (sec % 86400 === 0) return `every ${sec / 86400}d`
+    return `every ${h}h`
+  }
+  if (sec % 60 === 0) return `every ${sec / 60}m`
+  return `every ${sec}s`
+}
+
 /**
  * A coarse "how long until / since" reading for a unix deadline, relative to now.
  *

panel/src/main.tsx

@@ -2,12 +2,33 @@ import { StrictMode } from 'react'
 import { createRoot } from 'react-dom/client'
 import './tokens.css'
 import { App } from './App'
+import { initMockBackend } from './api'
+import { ConfirmProvider } from './components'
 
 const rootEl = document.getElementById('root')
 if (!rootEl) throw new Error('#root not found')
 
-createRoot(rootEl).render(
-  <StrictMode>
-    <App />
-  </StrictMode>,
-)
+// Settle the fixture question BEFORE the first render: pages read `MOCK` while
+// they render, so a backend that arrives afterwards would paint half a screen
+// from the daemon and half from fixtures. In a production build this resolves
+// immediately and to `false` — the fixtures are not in the bundle to load (see
+// api.ts initMockBackend and the assertNoMockFixtures plugin in vite.config.ts).
+function mount() {
+  // ConfirmProvider sits ABOVE <App> so it survives App's early returns (the
+  // unauth / no-link plates) — useConfirm() can never find itself without a host.
+  createRoot(rootEl!).render(
+    <StrictMode>
+      <ConfirmProvider>
+        <App />
+      </ConfirmProvider>
+    </StrictMode>,
+  )
+}
+
+// A fixture module that fails to load is a broken dev checkout, not a reason to
+// hand the operator a blank plate — mount anyway and let the shell report that it
+// cannot reach a daemon, which by then is the truth.
+void initMockBackend().then(mount, (e) => {
+  console.error('mock backend failed to load; continuing against the real API', e)
+  mount()
+})

panel/src/mock.ts

@@ -6,7 +6,14 @@
 // state mutates in-memory so the Apply / Confirm / Rollback flow is exercisable.
 //
 // Type-only imports from api.ts (erased at build) keep this free of a runtime cycle.
-import type { ApplyResult, ChainHealth, ConnLogEntry, DiscoveredDevice, GroupHealth, GroupMemberHealth, GroupsHealth, GroupTestResult, GroupTestStart, GroupTestStatus, Interface, Model, QueryLogEntry, RuleReach, RulesReachability, RulesetCategories, RulesetCheck, RulesetStatus, Stats, StatsLogPage, StatsLogQuery, Status, StatusWarning } from './api'
+import { killSwitchClosed } from './planeState'
+import type { ApplyResult, ChainHealth, ChainHopHealth, ConnLogEntry, DiscoveredDevice, GroupHealth, GroupMemberHealth, GroupsHealth, GroupTestResult, GroupTestStart, GroupTestStatus, Interface, Model, Profile, QueryLogEntry, RuleReach, RulesReachability, RulesetCategories, RulesetCheck, RulesetStatus, Stats, StatsLogPage, StatsLogQuery, Status, StatusWarning, Traffic } from './api'
+
+/** One URL knob, safe to read before `location` exists (SSR-less builds/tests). */
+function mockParam(name: string): string | null {
+  if (typeof location === 'undefined') return null
+  return new URLSearchParams(location.search).get(name)
+}
 
 let armed = false // a pending commit-confirm auto-rollback
 let hasLastGood = false // a predecessor config exists to roll back to (post-apply)
@@ -33,7 +40,13 @@ const CONFIG: Model = {
     ActiveProfile: 'mobile-uplink',
     // Policy for traffic TPROXY physically can't carry (non-TCP/UDP). Override
     // from the URL — ?mock&untun=icmp / &untun=direct — to see all three states.
-    Untunnelable: new URLSearchParams(typeof location === 'undefined' ? '' : location.search).get('untun') ?? 'block',
+    Untunnelable: mockParam('untun') ?? 'block',
+    // The two settings that decide part of the untunnelable traffic BEFORE the
+    // policy above is consulted, so the Networks copy has to change shape for
+    // them: ?mock&l3=1 (ping rides the tunnel) and ?mock&uegress=wg0 (the kernel
+    // routes ESP/GRE/SCTP out that interface). Both off by default, as shipped.
+    L3Tunnel: mockParam('l3') === '1',
+    UntunnelableEgress: mockParam('uegress') ?? '',
     DNSIntercept: true, // force ALL LAN plaintext DNS (:53) through the engine
     BlockDoH: false, // block known public DoH resolvers so clients fall back to plaintext :53
     GroupHealth: true, // observatory: background probing of used groups/chains + Targets health stats (default on)
@@ -42,7 +55,7 @@ const CONFIG: Model = {
     StatsMaxDomains: 5000, // fixed cap — shows the "limit" rendering (5000)
     StatsRetentionDisabled: false,
     StatsBackend: 'memory', // logging backend: off | memory | sqlite
-    StatsDiskLimitMB: 64, // SQLite-only disk cap (MB); shows once backend=sqlite (0 ⇒ Unlimited)
+    StatsDiskLimitMB: 64, // disk-backend-only cap (MB); shows once backend=sqlite (0 ⇒ Unlimited)
     // Daemon operational log (shaterd's own log): both destinations on, file in
     // tmpfs (the default), 2 MB cap — the defaults a fresh install ships with.
     LogToSyslog: true,
@@ -129,9 +142,25 @@ const CONFIG: Model = {
     { Name: 'via-tunnel', Source: 'subscription', Subscription: 'primary', Strategy: 'leastping', Egress: 'awg' },
     { Name: 'fallback', Source: 'subscription', Subscription: 'backup', Strategy: 'roundrobin', Egress: '' },
   ],
-  // One multi-hop chain so `?mock` exercises the chain card's Test button and
-  // its result readout: enters through the awg tunnel, exits via the auto group.
-  Chains: [{ Name: 'relay', Hops: ['egress:awg', 'group:auto'] }],
+  // Three chains, one per state the hop readout has to render.
+  Chains: [
+    // The owner's real production shape: leave through a WAN interface, cross an
+    // AmneziaWG node, then three subscription groups in series. The leading
+    // `egress:` is NOT a numbered hop — the daemon lifts it into hop 1's entry
+    // detour — so this reports FOUR hops, and hop 3 is dead while its neighbours
+    // answer. That single red notch in the middle of a live path is the entire
+    // reason per-hop health exists, so `?mock` must show it at a glance.
+    {
+      Name: 'ewan-wg-subs',
+      Hops: ['egress:wan', 'node:home-wg', 'group:auto', 'group:stealth', 'group:via-tunnel'],
+    },
+    // Used, but the observatory hasn't come round yet — every hop untested. Not
+    // dead and not healthy: the state the panel most easily renders as a fault.
+    { Name: 'sub-fresh', Hops: ['node:home-wg', 'group:fallback'] },
+    // No enabled rule targets it, so the observatory skips it entirely and the
+    // daemon never materialises its hops: `used:false` and NO `hops` key.
+    { Name: 'relay', Hops: ['egress:awg', 'group:auto'] },
+  ],
   Egresses: [
     { Name: 'wan', Type: 'interface', Interface: 'wan' },
     // An AmneziaWG tunnel — the whole point of a group-level egress binding.
@@ -145,6 +174,13 @@ const CONFIG: Model = {
   Rules: [
     { Name: 'block-ads', Enabled: true, Order: 10, DstRuleset: ['ad-hosts'], Target: 'block' },
     { Name: 'ru-bypass', Enabled: true, Order: 20, DstRuleset: ['ru-inside'], Target: 'direct' },
+    // These two are what make the chains USED — the observatory probes only the
+    // paths an enabled rule can reach, so without them every chain card would
+    // read "not routed" and the hop rail would never appear in `?mock`. Kept
+    // ABOVE the condition-less rule at Order 40, which would otherwise swallow
+    // everything below it and mark them "never applies".
+    { Name: 'media-via-chain', Enabled: true, Order: 22, DstRuleset: ['yt-geosite'], Target: 'chain:ewan-wg-subs' },
+    { Name: 'spare-via-chain', Enabled: true, Order: 24, DstRuleset: ['ad-hosts'], Target: 'chain:sub-fresh' },
     { Name: 'private-direct', Enabled: true, Order: 30, DstRuleset: ['private-nets'], Target: 'direct' },
     // A SECOND condition-less rule, above the real default. It reads like a working
     // rule and does nothing: a rule with no conditions becomes the router's default,
@@ -171,6 +207,7 @@ const CONFIG: Model = {
   // to an official remote list; the others are the usual url / inline lists.
   Blocklists: [
     { Name: 'StevenBlack', Enabled: true, Source: 'url', URL: 'https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts', Response: 'nxdomain', UpdateInterval: '24h' },
+    { Name: 'oisd-basic', Enabled: true, Source: 'url', URL: 'https://big.oisd.nl/domainswild', Response: 'nxdomain', UpdateInterval: '24h' },
     { Name: 'telegram-block', Enabled: false, Source: 'geosite', Categories: ['telegram'], Response: 'nxdomain', UpdateInterval: '24h' },
   ],
   Resolvers: [
@@ -300,34 +337,98 @@ const RULESET_STATUS: RulesetStatus[] = [
     rule_count: 903,
   },
   { tag: 'rs-ru-geoip-ru', name: 'ru-geoip', category: 'ru', kind: 'ruleset', remote: true, last_updated: '', interval_seconds: 86_400, rule_count: 0 },
+  // Blocklists report through the same endpoint under `bl-<name>`, which the DNS
+  // page never asked for — so a list that has NEVER been fetched still read
+  // "filtering". StevenBlack is that case here; oisd-basic is the healthy one, so
+  // both readings are exercisable offline.
+  { tag: 'bl-StevenBlack', name: 'StevenBlack', category: '', kind: 'blocklist', remote: true, last_updated: '', interval_seconds: 86_400, rule_count: 0 },
+  {
+    tag: 'bl-oisd-basic',
+    name: 'oisd-basic',
+    category: '',
+    kind: 'blocklist',
+    remote: true,
+    last_updated: new Date(Date.now() - 6 * 3600_000).toISOString(),
+    interval_seconds: 86_400,
+    rule_count: 218_431,
+  },
+  // Disabled in CONFIG, so the row reads "off" whatever this says — it exists to
+  // prove the row does not start claiming things the moment a status appears.
+  { tag: 'bl-telegram-block-telegram', name: 'telegram-block', category: 'telegram', kind: 'blocklist', remote: true, last_updated: '', interval_seconds: 86_400, rule_count: 0 },
 ]
 
 /** GET /api/rules/reachability. Mirrors the daemon's analysis over CONFIG.Rules:
  *  a rule with no conditions is the router's default, and the LAST such rule by
  *  Order wins — every earlier one can never apply. It reads the live CONFIG so
- *  edits made in `?mock` keep the badge honest. */
+ *  edits made in `?mock` keep the badge honest.
+ *
+ *  It also mirrors model.ResolveActiveProfile + ApplyProfileRuleOverrides, because
+ *  `effective_enabled` is the whole point of the endpoint: CONFIG's `mobile-uplink`
+ *  is active and both enables and disables rules, so `?mock` shows the same
+ *  desired-vs-effective split the field config does. */
 export async function getRulesReachability(): Promise<RulesReachability> {
   await wait(60)
   const rules = CONFIG.Rules ?? []
+
+  // A pin naming an existing, ENABLED profile wins outright. Otherwise auto-select:
+  // highest Priority among enabled profiles, ties by Name, skipping any with an
+  // iface condition (the WAN watcher owns those and expresses its verdict as the pin).
+  const profiles = CONFIG.Profiles ?? []
+  const pinned = String(CONFIG.Globals?.ActiveProfile ?? '').trim()
+  let prof: Profile | null = profiles.find((p) => p.Enabled && p.Name === pinned) ?? null
+  if (!prof) {
+    for (const p of profiles) {
+      if (!p.Enabled || (p.MatchIface ?? []).length > 0) continue
+      const pp = p.Priority ?? 0
+      const bp = prof?.Priority ?? 0
+      if (!prof || pp > bp || (pp === bp && p.Name < prof.Name)) prof = p
+    }
+  }
+  // Enable first, then Disable, so a name in both ends up disabled (Disable wins).
+  const effective = rules.map((r) => Boolean(r.Enabled))
+  if (prof) {
+    const force = (names: string[] | null | undefined, on: boolean) => {
+      for (const raw of names ?? []) {
+        const n = raw.trim()
+        rules.forEach((r, i) => {
+          if (r.Name === n) effective[i] = on
+        })
+      }
+    }
+    force(prof.EnableRules, true)
+    force(prof.DisableRules, false)
+  }
+  const activeProfile = prof
+
   const out: RuleReach[] = rules.map((r, index) => ({
     index,
     name: String(r.Name ?? ''),
     order: Number(r.Order ?? 0),
     unreachable: false,
     shadowed_by_index: -1,
+    effective_enabled: effective[index],
+    // Annotate only where the profile actually FLIPPED the outcome — a profile that
+    // disables an already-off rule has overridden nothing the operator can see.
+    ...(activeProfile && effective[index] !== Boolean(r.Enabled)
+      ? {
+          overridden_by: activeProfile.Name,
+          override: effective[index] ? ('enabled' as const) : ('disabled' as const),
+        }
+      : {}),
   }))
   const conditionless = (r: (typeof rules)[number]): boolean =>
     !(r.Src ?? []).length &&
-    !(r.DstDomain ?? []).length &&
     !(r.DstRuleset ?? []).length &&
-    !(r.DstIP ?? []).length &&
     !String(r.DstPort ?? '').trim() &&
     !String(r.Proto ?? '').trim()
   const target = (r: (typeof rules)[number]): string =>
     String(r.Target ?? '').trim() || (r.Egress ? `egress:${String(r.Egress).trim()}` : '')
   const defaults = rules
     .map((r, index) => ({ r, index }))
-    .filter(({ r }) => r.Enabled && conditionless(r) && target(r))
+    // The EFFECTIVE flag, not the configured one: a rule the active profile
+    // switched off is not in force and cannot retire anything (model's
+    // RuleReachability runs over the effective set for the same reason).
+    .filter(({ r, index }) => effective[index] && conditionless(r) && target(r))
     .sort((a, b) => Number(a.r.Order ?? 0) - Number(b.r.Order ?? 0) || a.index - b.index)
   const winner = defaults[defaults.length - 1]
   if (winner) {
@@ -407,17 +508,60 @@ export async function getRulesetCategories(source: string): Promise<RulesetCateg
 //   ?mock&warn=1     → a full warning set (critical + warning + info) on top
 //   ?mock&ks=open    → healthy plane but a FAIL-OPEN kill-switch, which is what
 //                      makes the untunnelable policy inert (F8 case 4)
-function mockPlane(): { plane: 'full' | 'hold' | 'none'; engine: boolean; killSwitch: string } {
+//   ?mock&traffic=…  → with the plane FULL, where the traffic actually ends up:
+//                      split | direct | blocked | blackout | unknown. `direct` is
+//                      the field case the readout used to call "Protected" (one
+//                      rule, `default → direct`); `unknown` is a daemon too old to
+//                      report. Default: tunnel.
+//   ?mock&plane=unreported → a daemon that sends NO `plane` field. The panel then
+//                      knows nothing about what is installed, which is the state
+//                      the Kill-switch module used to render as a green "ARMED"
+//                      (`undefined !== 'none'` is true).
+function mockPlane(): {
+  plane: 'full' | 'hold' | 'none' | undefined
+  engine: boolean
+  killSwitch: string
+} {
   const q = typeof location === 'undefined' ? '' : location.search
   const params = new URLSearchParams(q)
-  const killSwitch = params.get('ks') === 'open' ? 'open' : 'closed'
+  // Passed through VERBATIM, because that is what the daemon does: apply.go sets
+  // `s.KillSwitch = m.Globals.KillSwitch` with no normalisation, so `?ks=Closed`,
+  // `?ks=%20closed%20` and `?ks=` are all reachable readings of a router that
+  // BLOCKS. The mock used to fold everything that wasn't "open" to "closed",
+  // which made the panel's own `=== 'closed'` bug unreproducible here.
+  const killSwitch = params.get('ks') ?? 'closed'
   const p = params.get('plane')
   if (p === 'hold') return { plane: 'hold', engine: false, killSwitch: 'closed' }
   if (p === 'none') return { plane: 'none', engine: false, killSwitch }
   if (p === 'open') return { plane: 'none', engine: false, killSwitch: 'open' }
+  if (p === 'unreported') return { plane: undefined, engine: true, killSwitch }
   return { plane: 'full', engine: true, killSwitch }
 }
 
+// The daemon's verdict on where traffic goes (apply.Status.traffic). Only
+// meaningful with the plane installed: with the engine down there is no running
+// config to judge, and the daemon reports the unknown/zero value — so do the same
+// here rather than leaving a stale "tunnel" behind a dead engine.
+function mockTraffic(plane: 'full' | 'hold' | 'none' | undefined): Traffic | undefined {
+  if (plane !== 'full') return { verdict: '', default: '', tunnel_rules: 0 }
+  const params = new URLSearchParams(typeof location === 'undefined' ? '' : location.search)
+  switch (params.get('traffic')) {
+    case 'split':
+      return { verdict: 'split', default: 'direct', tunnel_rules: 3 }
+    case 'direct':
+      return { verdict: 'direct', default: 'direct', tunnel_rules: 0 }
+    case 'blocked':
+      return { verdict: 'blocked', default: 'block', tunnel_rules: 2 }
+    case 'blackout':
+      return { verdict: 'blocked', default: 'block', tunnel_rules: 0 }
+    case 'unknown':
+      // A daemon that predates the field sends no `traffic` at all.
+      return undefined
+    default:
+      return { verdict: 'tunnel', default: 'auto', tunnel_rules: 1 }
+  }
+}
+
 const MOCK_WARNINGS: StatusWarning[] = [
   {
     severity: 'critical',
@@ -443,6 +587,29 @@ const MOCK_WARNINGS: StatusWarning[] = [
     name: 'fakeip-pool',
     message: 'fake-IP resolver cannot be used as a fallback; the failover chain was not built',
   },
+  // Two findings the generator attributes to a NODE by name — the class that the
+  // Nodes page never showed, leaving a node the engine threw away rendered as an
+  // ordinary row with a green toggle. Both name real fixture nodes so the row
+  // badge, the collapsed-bucket "N flagged" count and the per-row strip all fire.
+  {
+    severity: 'warning',
+    section: 'node',
+    name: 'fi-trojan',
+    message: 'parse share-link: unsupported scheme "trojan+ws" (skipped)',
+  },
+  {
+    severity: 'warning',
+    section: 'node',
+    name: 'home-wg',
+    message:
+      'this WireGuard node is materialised twice in the engine config — as "home-wg" and as "group-stealth-m1-home-wg" — and traffic can reach both. A WireGuard peer keeps ONE session per public key, so two devices built from one private key evict each other continuously and NEITHER tunnel passes traffic. Only "home-wg" is kept; everything that routed through "group-stealth-m1-home-wg" is fail-closed (blocked) instead of leaving over the plain WAN',
+  },
+  {
+    severity: 'warning',
+    section: 'subscription',
+    name: 'backup',
+    message: 'fetch failed: dial tcp 203.0.113.9:443: i/o timeout — serving the nodes cached earlier',
+  },
   {
     severity: 'info',
     section: 'generate',
@@ -451,6 +618,34 @@ const MOCK_WARNINGS: StatusWarning[] = [
   },
 ]
 
+/**
+ * The daemon's truncation disclosure, exactly as apply/warnings.go writes it when
+ * the published set overflows the 50-entry cap. Served under `?mock&trunc` so the
+ * "this list is incomplete" rendering is exercisable — it used to be dropped
+ * wholesale by the panel's `info` filter and reached no screen at all.
+ */
+/**
+ * The daemon's own critical finding when it cannot read the configuration
+ * (apply.go, section "config" / name "unreadable"). Copied close to verbatim: the
+ * sentence about NOT switching anything off is the load-bearing one — the instinct
+ * in front of a dead LAN is to turn things off, and that is the single action that
+ * makes this worse.
+ */
+const CONFIG_UNREADABLE_WARNING: StatusWarning = {
+  severity: 'critical',
+  section: 'config',
+  name: 'unreadable',
+  message:
+    "the router's configuration could NOT be read (uci show shater: exit status 1), so this status cannot say whether shater is switched on, whether the kill switch is closed, or which port this panel is served on — enabled, kill_switch and panel_port are placeholders here, not readings. If traffic is being blocked, that is the fail-closed plane doing its job and NOT the service being switched off: do not turn anything off to fix it. The usual causes are a full /overlay and a `uci commit` interrupted part-way; free space, check /etc/config/shater, then restart shaterd.",
+}
+
+const MOCK_TRUNCATION: StatusWarning = {
+  severity: 'info',
+  section: 'generate',
+  name: '',
+  message: '7 further warning(s) suppressed; run `logread -e shater` for the full list',
+}
+
 /**
  * The standing `untunnelable` note the daemon reports. It is INFO, never a
  * problem: it states a correct, chosen configuration. Two shapes, mirroring the
@@ -458,7 +653,36 @@ const MOCK_WARNINGS: StatusWarning[] = [
  * is inert entirely while the kill-switch is open.
  */
 function untunnelableNote(mode: string, killSwitch: string): StatusWarning[] {
-  if (killSwitch === 'open') {
+  const g = CONFIG.Globals as { L3Tunnel?: boolean; UntunnelableEgress?: string }
+  const egress = (g.UntunnelableEgress ?? '').trim()
+  // The daemon's own precedence: the egress carrier owns the whole story, then
+  // the L3 ingress, then the kill-switch, then the policy (apply/warnings.go).
+  if (egress) {
+    return [
+      {
+        severity: 'info',
+        section: 'untunnelable',
+        name: egress,
+        message:
+          (g.L3Tunnel
+            ? 'ping and Windows tracert travel THROUGH the tunnel; everything else the tunnel cannot carry — IPsec (ESP/AH), PPTP/GRE, SCTP — now leaves'
+            : 'ping, Windows tracert, IPsec (ESP/AH), PPTP/GRE, SCTP and every other protocol that is neither TCP nor UDP now leave') +
+          ` through egress "${egress}": the kernel routes them out that interface with that interface's own NAT, and none of it follows your routing rules. Multicast IPTV does not pass this router under any setting, and carrying IGMP out an egress cannot change that.`,
+      },
+    ]
+  }
+  if (g.L3Tunnel) {
+    return [
+      {
+        severity: 'info',
+        section: 'untunnelable',
+        name: '',
+        message:
+          'ping and Windows tracert work and travel THROUGH the tunnel, toward every address your rules send to an outbound that can carry plain IP (WireGuard/AmneziaWG); addresses your rules send anywhere else cannot be pinged at all, deliberately. Raw VPN passthrough (IPsec ESP/AH, PPTP/GRE) cannot enter the tunnel and stays with the untunnelable policy. Multicast IPTV does not pass this router on any setting; the L3 ingress does not change that.',
+      },
+    ]
+  }
+  if (!killSwitchClosed(killSwitch)) {
     return [
       {
         severity: 'info',
@@ -497,9 +721,12 @@ function mockWarnings(killSwitch: string): StatusWarning[] {
   const params = new URLSearchParams(q)
   const mode = (CONFIG.Globals as { Untunnelable?: string }).Untunnelable ?? 'block'
   const notes = untunnelableNote(mode, killSwitch)
+  // `?trunc` adds the daemon's "the published list is capped" disclosure, which
+  // it appends IN PLACE OF the last entry it had room for.
+  const trunc = params.has('trunc') ? [{ ...MOCK_TRUNCATION }] : []
   // A degraded plane always comes with the findings that explain it.
-  if (params.has('warn') || params.get('plane')) {
-    return [...MOCK_WARNINGS.map((w) => ({ ...w })), ...notes]
+  if (params.has('warn') || params.get('plane') || trunc.length > 0) {
+    return [...MOCK_WARNINGS.map((w) => ({ ...w })), ...notes, ...trunc]
   }
   return notes
 }
@@ -508,6 +735,34 @@ export async function getStatus(): Promise<Status> {
   await wait(120)
   const enabled = (CONFIG.Globals as { Enabled: boolean }).Enabled
   const { plane, engine, killSwitch } = mockPlane()
+  // ?mock&cfg=unreadable — the daemon could not READ the configuration (full
+  // /overlay, or a `uci commit` caught half-written). It is not a hypothetical: it
+  // is the situation the fail-closed plane exists for, so it ships with the plane
+  // HOLDING and the whole LAN cut off deliberately — while `enabled`, `kill_switch`
+  // and `panel_port` are placeholders that mean nothing. Reproducing it here is how
+  // the "Turned off" misreading stays fixed: the panel must alarm, not reassure.
+  if (mockParam('cfg') === 'unreadable') {
+    return {
+      running: true,
+      enabled: false, // a placeholder, NOT "the owner switched it off"
+      active: false,
+      table: true,
+      hash,
+      version: '1.11.0-shater',
+      kill_switch: '', // placeholder likewise
+      panel_port: 0, // placeholder likewise
+      config_readable: false,
+      config_error: 'uci show shater: exit status 1',
+      can_rollback: armed || hasLastGood,
+      engine_running: false,
+      plane: 'hold',
+      traffic: mockTraffic('hold'),
+      warnings: [CONFIG_UNREADABLE_WARNING, ...mockWarnings(killSwitch)],
+      started_unix: MOCK_STARTED_UNIX,
+      uptime_seconds: Math.floor(Date.now() / 1000) - MOCK_STARTED_UNIX,
+      byedpi_installed: true,
+    }
+  }
   return {
     running: true,
     enabled,
@@ -517,9 +772,13 @@ export async function getStatus(): Promise<Status> {
     version: '1.11.0-shater',
     kill_switch: killSwitch,
     panel_port: 8088,
+    // The daemon read the config fine in every other mock state. Sent explicitly
+    // rather than left off: absent means "no reading", which is a different claim.
+    config_readable: true,
     can_rollback: armed || hasLastGood,
     engine_running: engine,
     plane,
+    traffic: mockTraffic(plane),
     warnings: mockWarnings(killSwitch),
     // Process uptime. Anchored to when this tab loaded plus a fixed head start, so
     // the reading ticks forward across polls exactly like the real daemon's does.
@@ -1096,20 +1355,59 @@ function healthList(): GroupHealth[] {
   return (CONFIG.Groups ?? []).map((g) => summarise(g.Name, GROUP_MEMBERS.get(g.Name) ?? []))
 }
 
-/** Per-chain reachability for the Targets page's "unused" badge (plan §5.E) — the
- *  chain analogue of healthList's `used` field. The mock's single chain `relay` is
- *  NOT referenced by any rule in CONFIG.Rules (they target group:auto / block /
- *  direct), so it reads used=false and its card renders "unused" — exactly the case
- *  the badge exists to surface. A stopped engine reports no chains. */
+/**
+ * Per-hop health, keyed by chain name — what the observatory measured at each
+ * position of the path, in WIRE order.
+ *
+ * `ewan-wg-subs` is the fixture that matters, and it encodes the ORDERED WALK.
+ * Hop 1 is the WireGuard node and answers; hop 2 is a subscription group whose
+ * copies answer THROUGH it — 119 of 122 tested alive, which is the reading only a
+ * per-hop probe can produce, since the same members are dialled differently on
+ * their own card. Hop 3 is a group whose members all time out at that position,
+ * and the walk STOPS there: hop 4 is dialled through hop 3, so it was never
+ * dialled at all. It comes back `untested` with `blocked_by` naming hop 3, its
+ * counters zeroed, and `selected` still set — the wrapper has a pick, nothing
+ * crossed it to measure. A dead hop with a live hop under it is not in this
+ * fixture because the daemon can no longer produce one.
+ *
+ * `sub-fresh` is used but never yet reached: every hop untested, nothing dead,
+ * no block — the other reason a lamp is unlit, and the one that fixes itself.
+ * `relay` is absent from this map on purpose — an unused chain is never
+ * materialised, so the daemon sends no `hops` key at all, which is "nothing
+ * measured", not "no hops".
+ */
+const CHAIN_HOPS: Record<string, ChainHopHealth[]> = {
+  'ewan-wg-subs': [
+    { index: 1, tag: 'chain-ewan-wg-subs-h1', kind: 'node', exit: false, state: 'alive', delay_ms: 41, age_seconds: 22, selected: '', total: 1, tested: 1, alive: 1, dead: 0, untested: 0 },
+    { index: 2, tag: 'chain-ewan-wg-subs-h2', kind: 'group', exit: false, state: 'alive', delay_ms: 96, age_seconds: 18, selected: '🇳🇱 Amsterdam-01', total: 298, tested: 122, alive: 119, dead: 3, untested: 176 },
+    { index: 3, tag: 'chain-ewan-wg-subs-h3', kind: 'group', exit: false, state: 'dead', delay_ms: 0, age_seconds: 15, selected: '', total: 2, tested: 2, alive: 0, dead: 2, untested: 0 },
+    { index: 4, tag: 'chain-ewan-wg-subs-h4', kind: 'group', exit: true, state: 'untested', delay_ms: 0, age_seconds: -1, selected: '🇸🇬 Singapore-09', total: 6, tested: 0, alive: 0, dead: 0, untested: 6, blocked_by: { index: 3, tag: 'chain-ewan-wg-subs-h3' } },
+  ],
+  'sub-fresh': [
+    { index: 1, tag: 'chain-sub-fresh-h1', kind: 'node', exit: false, state: 'untested', delay_ms: 0, age_seconds: -1, selected: '', total: 1, tested: 0, alive: 0, dead: 0, untested: 1 },
+    { index: 2, tag: 'chain-sub-fresh-h2', kind: 'group', exit: true, state: 'untested', delay_ms: 0, age_seconds: -1, selected: '', total: 24, tested: 0, alive: 0, dead: 0, untested: 24 },
+  ],
+}
+
+/** Per-chain reachability plus per-hop health for the Targets page. `used` is the
+ *  chain analogue of healthList's field; `hops` is OMITTED (never null, never []),
+ *  exactly like the daemon, for a chain the engine never materialised. A stopped
+ *  engine reports no chains at all. */
 function chainHealthList(): ChainHealth[] {
   if (!mockPlane().engine) return []
-  return (CONFIG.Chains ?? []).map((c) => ({ name: c.Name, used: chainUsed(c.Name) }))
+  return (CONFIG.Chains ?? []).map((c) => {
+    const hops = CHAIN_HOPS[c.Name]
+    const h: ChainHealth = { name: c.Name, used: chainUsed(c.Name) }
+    if (hops) h.hops = hops.map((x) => ({ ...x }))
+    return h
+  })
 }
 
 /** A chain is "used" when some enabled routing rule (or Final, or a DNS detour)
  *  targets `chain:<name>` — the same reachability the daemon's observatory derives.
- *  The mock's rules never target a chain, so every chain reads used=false; a real
- *  config would mark the ones rules point at used=true. */
+ *  Two of the mock's rules do (`media-via-chain` → ewan-wg-subs, `spare-via-chain`
+ *  → sub-fresh), so those two chains read used=true and get a hop rail; `relay`
+ *  is targeted by nothing and reads used=false, which is the unused note. */
 function chainUsed(name: string): boolean {
   const target = `chain:${name}`
   return (CONFIG.Rules ?? []).some(
@@ -1161,15 +1459,23 @@ class ApiErrorLike extends Error {
   }
 }
 
-// Mock group/chain test. Deliberately covers every state the UI has to render,
-// one per target, so a single offline run exercises all of them:
-//   auto     → ok WITH an exit address
-//   stealth  → ok WITHOUT one (delay measured, address undeterminable) — a
-//              SUCCESS, and the case the UI most easily gets wrong
-//   relay    → the chain: same wire shape, `group` carries the CHAIN's name and
-//              `selected` the node its exit group picked
-//   fallback → a failure carrying a human reason
-// Results land one per GET poll, so the running/progress state is visible too.
+// Mock refresh results. The endpoint no longer dials anything: it asks the
+// observatory to measure out of turn and reports what the observatory found, so
+// every row here is a READ of a background measurement. Deliberately covers every
+// state the UI has to render, one per target, so a single offline run exercises
+// all of them:
+//   auto         → ok WITH an exit address
+//   stealth      → ok WITHOUT one (delay measured, address undeterminable) — a
+//                  SUCCESS, and the case the UI most easily gets wrong
+//   ewan-wg-subs → the chain: same wire shape, `group` carries the CHAIN's name
+//                  and `selected` the node its exit hop picked
+//   via-tunnel   → the one honest health FAILURE: a probe that ran and failed
+//   fallback,
+//   relay        → not routed at all, so no measurement exists to report
+//   sub-fresh    → routed, but the observatory hasn't come round yet
+// The last three are absence of measurement, not a broken target, and the copy
+// has to keep them apart. Results land one per GET poll, so the running/progress
+// state is visible too.
 const GROUP_TEST_SHAPE: Record<string, Omit<GroupTestResult, 'group' | 'tested_unix'>> = {
   auto: {
     selected: 'nl-reality-2',
@@ -1187,32 +1493,60 @@ const GROUP_TEST_SHAPE: Record<string, Omit<GroupTestResult, 'group' | 'tested_u
     ok: true,
     error: '',
   },
-  // The chain — Selected is the node the chain's exit group (auto) picked.
-  relay: {
-    selected: 'nl-reality-2',
-    delay_ms: 61,
-    exit_ip: '185.12.34.56',
-    exit_country: 'NL',
-    ok: true,
-    error: '',
+  // The chain, and the pairing that makes the whole feature worth building. A
+  // chain is one series path, so with hop 3 dead the end-to-end probe is never
+  // even attempted — the daemon stops walking there. This row and the hop rail
+  // therefore have to tell one story, not two: both name hop 3, and neither
+  // offers hop 4 as a second suspect. Note the row does NOT say "the probe
+  // failed" — no probe of this chain's exit ran at all — which is why the daemon
+  // has a separate message for it.
+  'ewan-wg-subs': {
+    selected: '',
+    delay_ms: 0,
+    exit_ip: '',
+    exit_country: '',
+    ok: false,
+    error:
+      'hop 3 of this chain was probed and did not answer, so nothing reaches the exit through it — fix that hop first',
   },
-  // Dead through its tunnel, exactly as its membership health says — the exit
-  // test and the member health tell the same story about the same group.
+  // The one real health failure in the fixture: the observatory's probe ran along
+  // this path and did not come back.
   'via-tunnel': {
     selected: '',
     delay_ms: 0,
     exit_ip: '',
     exit_country: '',
     ok: false,
-    error: 'no member answered through egress awg (6 of 6 timed out)',
+    error: 'the observatory’s probe through this path failed',
   },
+  // Not a health verdict — nothing routes here, so no measurement of it exists.
   fallback: {
     selected: '',
     delay_ms: 0,
     exit_ip: '',
     exit_country: '',
     ok: false,
-    error: 'no reachable node in the group (all 3 members timed out)',
+    error:
+      'not routed by any enabled rule, so nothing measures it — the observatory only probes paths the rules use',
+  },
+  relay: {
+    selected: '',
+    delay_ms: 0,
+    exit_ip: '',
+    exit_country: '',
+    ok: false,
+    error:
+      'not routed by any enabled rule, so nothing measures it — the observatory only probes paths the rules use',
+  },
+  // Routed, materialised, simply not reached yet. Untested is not dead.
+  'sub-fresh': {
+    selected: '',
+    delay_ms: 0,
+    exit_ip: '',
+    exit_country: '',
+    ok: false,
+    error:
+      'the observatory has not reached this target yet — it refreshes on the global probe interval',
   },
 }
 

panel/src/pages/Alerts.css

@@ -0,0 +1,443 @@
+/* Alerts section (rendered on Settings) — inherits the Faceplate tokens and the
+ * shared page chrome from App.css (.toast, .mono). Every rule below is a
+ * one-to-one copy of the DNS.css rule the markup used before the section moved
+ * here, renamed `dns-*` → `alr-*` so nothing collides. Orange stays an accent. */
+
+/* ---- section shell (matches the Settings group plates one-to-one) ---- */
+.alr-section {
+  margin-top: calc(var(--u, 8px) * 3.5);
+}
+.alr-sec-hd {
+  display: flex;
+  align-items: baseline;
+  gap: 12px;
+  padding-bottom: 10px;
+  border-bottom: 1px solid var(--groove);
+}
+.alr-sec-title {
+  margin: 0;
+  font-family: var(--font-mono);
+  font-size: 13px;
+  font-weight: 700;
+  letter-spacing: var(--track-label, 0.18em);
+  text-transform: uppercase;
+  color: var(--dim);
+}
+.alr-sec-count {
+  font-size: 11px;
+  letter-spacing: 0.06em;
+  color: var(--faint);
+}
+.alr-sec-note {
+  margin: 10px 2px 0;
+  font-family: var(--font-sans);
+  font-size: 12.5px;
+  line-height: 1.55;
+  color: var(--dim);
+  max-width: 56ch;
+}
+
+/* ---- add form ---- */
+.alr-add {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  margin-top: calc(var(--u, 8px) * 2);
+}
+.alr-add-top {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 10px;
+}
+.alr-input {
+  min-width: 0;
+  padding: 9px 12px;
+  border: 1px solid var(--groove);
+  border-radius: 7px;
+  background: var(--sink);
+  color: var(--ink);
+  font-family: var(--font-mono);
+  font-size: 12.5px;
+  letter-spacing: 0.02em;
+  box-shadow: 0 1px 2px var(--shadow) inset;
+  transition: border-color 0.15s, box-shadow 0.15s;
+}
+.alr-input::placeholder {
+  color: var(--faint);
+}
+.alr-input:focus-visible {
+  border-color: var(--accent);
+  outline: 2px solid var(--accent);
+  outline-offset: 1px;
+}
+.alr-input:disabled {
+  opacity: 0.55;
+}
+.alr-input--name {
+  flex: 0 1 14rem;
+}
+
+/* segmented type picker */
+.alr-seg {
+  display: inline-flex;
+  border: 1px solid var(--groove);
+  border-radius: 7px;
+  overflow: hidden;
+  background: var(--sink);
+}
+.alr-seg-btn {
+  padding: 8px 14px;
+  border: 0;
+  background: transparent;
+  color: var(--dim);
+  font-family: var(--font-mono);
+  font-size: 11px;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  cursor: pointer;
+  transition: background 0.15s, color 0.15s;
+}
+.alr-seg-btn + .alr-seg-btn {
+  border-left: 1px solid var(--groove);
+}
+.alr-seg-btn.on {
+  background: var(--accent);
+  color: #fff;
+}
+.alr-seg-btn:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: -2px;
+}
+
+.alr-resp {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+}
+.alr-resp-label {
+  font-size: 10px;
+  letter-spacing: var(--track-label, 0.18em);
+  text-transform: uppercase;
+  color: var(--faint);
+}
+.alr-select {
+  padding: 8px 10px;
+  border: 1px solid var(--groove);
+  border-radius: 7px;
+  background: var(--sink);
+  color: var(--ink);
+  font-family: var(--font-mono);
+  font-size: 11.5px;
+  letter-spacing: 0.04em;
+  cursor: pointer;
+}
+.alr-select:focus-visible {
+  border-color: var(--accent);
+  outline: 2px solid var(--accent);
+  outline-offset: 1px;
+}
+
+.alr-add-actions {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 14px;
+  flex-wrap: wrap;
+}
+.alr-field-err {
+  flex: 1;
+  min-width: 0;
+  margin: 0;
+  font-family: var(--font-mono);
+  font-size: 11.5px;
+  line-height: 1.5;
+  color: var(--crit);
+}
+
+/* ---- rows ---- */
+.alr-rows {
+  list-style: none;
+  margin: calc(var(--u, 8px) * 2) 0 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+.alr-row {
+  display: flex;
+  align-items: center;
+  gap: calc(var(--u, 8px) * 1.5);
+  padding: 12px 14px;
+  border: 1px solid var(--groove);
+  border-radius: 8px;
+  background: linear-gradient(
+    180deg,
+    var(--raised),
+    color-mix(in srgb, var(--raised) 82%, var(--panel))
+  );
+  box-shadow: 0 1px 0 var(--edge) inset;
+}
+.alr-row-main {
+  flex: 1;
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+.alr-row-l1 {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+.alr-row-name {
+  font-family: var(--font-mono);
+  font-size: 13px;
+  font-weight: 600;
+  letter-spacing: 0.01em;
+  color: var(--ink);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  max-width: 24ch;
+}
+.alr-row-l2 {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  flex-wrap: wrap;
+  font-size: 11.5px;
+  letter-spacing: 0.02em;
+}
+.alr-row-detail {
+  color: var(--dim);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  max-width: 40ch;
+}
+
+/* badge — groove-bordered, not orange (accent stays reserved) */
+.alr-badge {
+  display: inline-block;
+  padding: 2px 7px;
+  border: 1px solid var(--groove);
+  border-radius: 5px;
+  background: color-mix(in srgb, var(--sink) 60%, transparent);
+  font-family: var(--font-mono);
+  font-size: 10px;
+  font-weight: 600;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+  color: var(--dim);
+  white-space: nowrap;
+}
+.alr-badge--accent {
+  border-color: color-mix(in srgb, var(--accent) 55%, var(--groove));
+  color: var(--accent);
+}
+
+.alr-masked {
+  font-family: var(--font-mono);
+  font-size: 10px;
+  letter-spacing: 0.08em;
+  color: var(--faint);
+  text-transform: uppercase;
+  cursor: help;
+}
+
+.alr-del {
+  flex: none;
+  padding: 6px 12px;
+  font-size: 10.5px;
+}
+
+/* ---- empty plate ---- */
+.alr-empty {
+  margin-top: calc(var(--u, 8px) * 2);
+  padding: calc(var(--u, 8px) * 3);
+  border: 1px dashed var(--groove);
+  border-radius: 9px;
+  background: color-mix(in srgb, var(--raised) 55%, transparent);
+  text-align: center;
+}
+.alr-empty-title {
+  display: block;
+  font-size: 13px;
+  font-weight: 700;
+  letter-spacing: 0.06em;
+  color: var(--dim);
+}
+.alr-empty-body {
+  margin: 8px auto 0;
+  max-width: 48ch;
+  font-family: var(--font-sans);
+  font-size: 13px;
+  line-height: 1.55;
+  color: var(--dim);
+}
+
+/* ---- loading skeleton ---- */
+.alr-skel {
+  height: 62px;
+  border: 1px solid var(--groove);
+  border-radius: 8px;
+  background: linear-gradient(90deg, var(--raised), var(--sink), var(--raised));
+  background-size: 200% 100%;
+  animation: alr-skel-shift 1.4s ease-in-out infinite;
+}
+@keyframes alr-skel-shift {
+  from {
+    background-position: 200% 0;
+  }
+  to {
+    background-position: -200% 0;
+  }
+}
+
+/* the per-row delivery picker sits inline in the row */
+.alr-detour {
+  flex: none;
+  display: flex;
+  flex-direction: column;
+  gap: 5px;
+  min-width: 0;
+}
+.alr-detour-label {
+  font-size: 10px;
+  letter-spacing: var(--track-label, 0.18em);
+  text-transform: uppercase;
+  color: var(--faint);
+}
+.alr-detour-select {
+  max-width: 22rem;
+}
+
+/* current delivery-path readout on the row */
+.alr-path {
+  color: var(--faint);
+  white-space: nowrap;
+}
+.alr-path[data-active='on'] {
+  color: var(--dim);
+}
+.alr-path-name {
+  color: var(--led-on);
+  font-weight: 600;
+}
+.alr-path[data-missing='y'] .alr-path-name {
+  color: var(--amber);
+}
+.alr-path-flag {
+  color: var(--amber);
+}
+
+/* alert delivery: deliver-via picker + fallback toggle + caution note */
+.alr-delivery {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 10px 20px;
+}
+.alr-fallback {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  cursor: pointer;
+}
+.alr-fallback-label {
+  font-size: 10px;
+  letter-spacing: var(--track-label, 0.18em);
+  text-transform: uppercase;
+  color: var(--faint);
+}
+/* the per-row delivery controls sit inline in the row (like .alr-detour) */
+.alr-ctl {
+  flex: none;
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  min-width: 0;
+}
+.alr-note {
+  margin: 0;
+  font-family: var(--font-sans);
+  font-size: 11.5px;
+  line-height: 1.5;
+  color: var(--amber);
+  max-width: 56ch;
+}
+.alr-note--row {
+  margin-top: 2px;
+}
+
+/* alert event checkboxes */
+.alr-events {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px 16px;
+  margin: 0;
+  padding: 0;
+  border: 0;
+}
+.alr-event {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  font-size: 13px;
+  color: var(--fp-text, inherit);
+  cursor: pointer;
+}
+.alr-event input {
+  accent-color: var(--fp-accent, currentColor);
+}
+
+/* ---- responsive ---- */
+@media (max-width: 640px) {
+  .alr-row {
+    flex-wrap: wrap;
+  }
+  .alr-row-main {
+    flex-basis: calc(100% - 90px);
+  }
+  .alr-del {
+    margin-left: auto;
+  }
+  .alr-input--name {
+    flex-basis: 100%;
+  }
+  .alr-detour {
+    flex-basis: 100%;
+    order: 3;
+    flex-wrap: wrap;
+  }
+  /* A <select> won't shrink below its widest option unless it's allowed to:
+     without min-width:0 the long detour labels push the page into a horizontal
+     scroll at 390px. Let them fill the row and clip instead. */
+  .alr-detour-select,
+  .alr-resp .alr-select {
+    max-width: 100%;
+    width: 100%;
+    min-width: 0;
+  }
+  .alr-resp {
+    display: flex;
+    flex-wrap: wrap;
+    max-width: 100%;
+  }
+  .alr-ctl {
+    flex-basis: 100%;
+    order: 3;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .alr-skel {
+    animation: none;
+  }
+  .alr-input,
+  .alr-seg-btn {
+    transition: none;
+  }
+}

panel/src/pages/Alerts.tsx

@@ -0,0 +1,690 @@
+import './Alerts.css'
+import { useCallback, useMemo, useState } from 'react'
+import { Button, Toggle, useConfirm } from '../components'
+import type { Alert, Model } from '../api'
+
+// The Alerts section — out-of-band notifications (Telegram bot / webhook) for
+// kill-switch trips, apply failures, new devices and subscription expiry. It
+// lived at the bottom of the DNS page, which is the last place an operator
+// looking for "tell me when the tunnel dies" would think to look; it now renders
+// as a group on Settings. The component owns no I/O: every mutation goes through
+// the `onSave` prop so Settings keeps a single dirty banner and a single toast.
+//
+// NOTE on duplication: the detour helpers below (DetourCatalog, canonDetour,
+// detourValues, describeDetour, DetourSelect) plus asArray / uniqueName /
+// maskUrl / EmptyPlate are deliberate copies of the ones in DNS.tsx. DNS keeps
+// its own for resolvers and DNS rules; extracting a shared module would couple
+// two pages that otherwise share nothing, and that refactor is out of scope
+// here. If a third consumer ever appears, promote them then.
+
+// ---- local Model extension --------------------------------------------------
+
+/** The Model with the Alerts slice surfaced (index-signature passthrough). */
+type AlertsModel = Model & { Alerts?: Alert[] | null }
+
+/**
+ * Every event the daemon actually sends. A retired health-probe event was left
+ * out on purpose: nothing ever fired it, so a channel that subscribed to it would
+ * just stay quiet forever — the one failure mode an alert must not have. Only
+ * events with a live firing path are offered here.
+ */
+const ALERT_EVENTS: ReadonlyArray<{ id: string; label: string }> = [
+  { id: 'killswitch', label: 'Kill-switch' },
+  { id: 'apply_fail', label: 'Apply failure' },
+  { id: 'new_device', label: 'New device' },
+  { id: 'sub_expiry', label: 'Subscription expiring' },
+]
+
+// Shown when an alert routes through a detour with no direct fallback — the exact
+// case where a tunnel-down alert could fail to send. The user asked for this.
+const VIA_NO_FALLBACK_NOTE =
+  'A kill-switch/tunnel-down alert may not send if it routes through the affected tunnel — enable fallback.'
+
+// ---- helpers (copies of DNS.tsx — see the header note) ----------------------
+
+const asArray = <T,>(a: T[] | null | undefined): T[] => (a ? a : [])
+
+const HTTP_RE = /^https?:\/\//i
+
+/** A remote URL often carries a token in its query/path — show host only. */
+function maskUrl(url: string): { host: string; masked: boolean } {
+  try {
+    const u = new URL(url)
+    return { host: u.host, masked: u.search !== '' || u.pathname.replace(/\/+$/, '') !== '' }
+  } catch {
+    return { host: url || '—', masked: false }
+  }
+}
+
+function uniqueName(base: string, taken: Set<string>): string {
+  const seed = base.trim() || 'alert'
+  if (!taken.has(seed)) return seed
+  let i = 2
+  while (taken.has(`${seed}-${i}`)) i++
+  return `${seed}-${i}`
+}
+
+/** The live targets an alert's delivery can be pinned to (the picker). */
+interface DetourCatalog {
+  groups: string[]
+  chains: string[]
+  egresses: { name: string; type: string }[]
+  nodes: string[]
+}
+
+/**
+ * Normalise a stored `Via` to a picker option value. Empty/`direct` ⇒
+ * `direct`; already-prefixed values (`group:`/`chain:`/`egress:`/`node:`) pass
+ * through; a bare legacy name is resolved against the catalog so a still-valid
+ * setup isn't mislabelled; anything unresolved is kept verbatim (shown stale).
+ */
+function canonDetour(raw: string | undefined, cat: DetourCatalog): string {
+  const d = (raw ?? '').trim()
+  if (!d || d.toLowerCase() === 'direct') return 'direct'
+  if (/^(node|group|chain|egress):/i.test(d)) return d
+  if (cat.egresses.some((e) => e.name === d)) return `egress:${d}`
+  if (cat.groups.includes(d)) return `group:${d}`
+  if (cat.chains.includes(d)) return `chain:${d}`
+  if (cat.nodes.includes(d)) return `node:${d}`
+  return d
+}
+
+/** Every valid option value for a catalog, including `direct`. */
+function detourValues(cat: DetourCatalog): Set<string> {
+  const s = new Set<string>(['direct'])
+  for (const g of cat.groups) s.add(`group:${g}`)
+  for (const c of cat.chains) s.add(`chain:${c}`)
+  for (const e of cat.egresses) s.add(`egress:${e.name}`)
+  for (const n of cat.nodes) s.add(`node:${n}`)
+  return s
+}
+
+/** Describe a canonical detour value for the row readout. */
+function describeDetour(
+  canon: string,
+  cat: DetourCatalog,
+  valid: Set<string>,
+): { direct: boolean; prefix: string; name: string; missing: boolean } {
+  if (canon === 'direct') return { direct: true, prefix: '', name: '', missing: false }
+  const i = canon.indexOf(':')
+  const kind = i === -1 ? '' : canon.slice(0, i)
+  const name = i === -1 ? canon : canon.slice(i + 1)
+  const missing = !valid.has(canon)
+  let prefix = 'via'
+  if (kind === 'group') prefix = 'via group'
+  else if (kind === 'chain') prefix = 'via chain'
+  else if (kind === 'node') prefix = 'via node'
+  else if (kind === 'egress') {
+    const eg = cat.egresses.find((e) => e.name === name)
+    prefix = eg?.type === 'interface' ? 'via interface' : 'via egress'
+  }
+  return { direct: false, prefix, name, missing }
+}
+
+// ---- section ----------------------------------------------------------------
+
+export function AlertsSection({
+  config,
+  busy,
+  loading,
+  onSave,
+}: {
+  /** Full desired-state model; null until it has loaded. */
+  config: Model | null
+  /** A save/apply is in flight — controls lock. */
+  busy: boolean
+  /** The config is still loading — show a skeleton row. */
+  loading: boolean
+  /** Persist the whole next model; resolves true on success (Settings' `save`). */
+  onSave: (next: Model, okMsg: string) => Promise<boolean>
+}): JSX.Element {
+  const confirm = useConfirm()
+  const model = config as AlertsModel | null
+  const alerts = useMemo<Alert[]>(() => asArray(model?.Alerts), [model])
+
+  // Alerts route through Direct/group/node/egress only (no chains) — the contract
+  // vocabulary for Alert.Via. Built straight from the Model with chains dropped.
+  const alertCatalog = useMemo<DetourCatalog>(
+    () => ({
+      groups: asArray(config?.Groups).map((g) => g.Name),
+      chains: [],
+      egresses: asArray(config?.Egresses).map((e) => ({ name: e.Name, type: e.Type })),
+      nodes: asArray(config?.Nodes).map((n) => n.Name),
+    }),
+    [config],
+  )
+  const alertValid = useMemo(() => detourValues(alertCatalog), [alertCatalog])
+
+  const alertNames = useMemo(() => new Set(alerts.map((a) => a.Name)), [alerts])
+  const alertsOn = alerts.filter((a) => a.Enabled).length
+
+  // ---- mutations — all writes go through onSave -----------------------------
+  const addAlert = useCallback(
+    (draft: Alert): Promise<boolean> => {
+      if (!model) return Promise.resolve(false)
+      const taken = new Set(alerts.map((a) => a.Name))
+      const a: Alert = { ...draft, Name: uniqueName(draft.Name, taken) }
+      return onSave({ ...model, Alerts: [...alerts, a] }, `Added ${a.Name}`)
+    },
+    [model, alerts, onSave],
+  )
+
+  const toggleAlert = useCallback(
+    (idx: number, on: boolean) => {
+      if (!model) return
+      const next = alerts.map((a, i) => (i === idx ? { ...a, Enabled: on } : a))
+      void onSave({ ...model, Alerts: next }, `${next[idx].Name} ${on ? 'enabled' : 'disabled'}`)
+    },
+    [model, alerts, onSave],
+  )
+
+  const removeAlert = useCallback(
+    async (idx: number) => {
+      if (!model) return
+      const target = alerts[idx]
+      const ok = await confirm({
+        label: 'Delete alert',
+        title: `Delete alert “${target.Name}”?`,
+        body: 'This removes it from the config.',
+      })
+      if (!ok) return
+      const next = alerts.filter((_, i) => i !== idx)
+      void onSave({ ...model, Alerts: next }, `Deleted ${target.Name}`)
+    },
+    [model, alerts, onSave, confirm],
+  )
+
+  const setAlertVia = useCallback(
+    (idx: number, v: string) => {
+      if (!model) return
+      const via = v === 'direct' ? '' : v
+      const next = alerts.map((a, i) => (i === idx ? { ...a, Via: via || undefined } : a))
+      void onSave(
+        { ...model, Alerts: next },
+        via ? `${next[idx].Name} delivers via ${via}` : `${next[idx].Name} delivers direct`,
+      )
+    },
+    [model, alerts, onSave],
+  )
+
+  const setAlertFallback = useCallback(
+    (idx: number, on: boolean) => {
+      if (!model) return
+      const next = alerts.map((a, i) => (i === idx ? { ...a, Fallback: on || undefined } : a))
+      void onSave(
+        { ...model, Alerts: next },
+        `${next[idx].Name} direct fallback ${on ? 'on' : 'off'}`,
+      )
+    },
+    [model, alerts, onSave],
+  )
+
+  return (
+    <div className="alr-section" aria-label="Alerts">
+      <header className="alr-sec-hd">
+        <h2 className="alr-sec-title">Alerts</h2>
+        <span className="alr-sec-count mono">
+          {alertsOn} / {alerts.length} on
+        </span>
+      </header>
+      <p className="alr-sec-note">
+        Out-of-band notifications. Delivered <strong>direct to the internet</strong> by default — so a
+        kill-switch or engine-down alert still reaches you when the proxy is down. You can route one
+        through a group, node or egress instead, with a direct fallback if that detour fails.
+      </p>
+
+      <AddAlertForm
+        busy={busy}
+        disabled={!config}
+        taken={alertNames}
+        catalog={alertCatalog}
+        valid={alertValid}
+        onAdd={addAlert}
+      />
+
+      {loading ? (
+        <ul className="alr-rows" aria-hidden="true">
+          <li className="alr-skel" />
+        </ul>
+      ) : alerts.length === 0 ? (
+        <EmptyPlate
+          title="No alerts"
+          body="Add a Telegram bot or a webhook above to get notified when the kill-switch trips, a new device joins, or an apply fails."
+        />
+      ) : (
+        <ul className="alr-rows">
+          {alerts.map((a, i) => (
+            <AlertRow
+              key={`${a.Name}-${i}`}
+              alert={a}
+              busy={busy}
+              catalog={alertCatalog}
+              valid={alertValid}
+              onToggle={(on) => toggleAlert(i, on)}
+              onVia={(v) => setAlertVia(i, v)}
+              onFallback={(on) => setAlertFallback(i, on)}
+              onDelete={() => removeAlert(i)}
+            />
+          ))}
+        </ul>
+      )}
+    </div>
+  )
+}
+
+// ---- alert add form + row ----------------------------------------------------
+
+function AddAlertForm({
+  busy,
+  disabled,
+  taken,
+  catalog,
+  valid,
+  onAdd,
+}: {
+  busy: boolean
+  disabled: boolean
+  taken: Set<string>
+  catalog: DetourCatalog
+  valid: Set<string>
+  onAdd: (a: Alert) => Promise<boolean>
+}) {
+  const [name, setName] = useState('')
+  const [type, setType] = useState<'telegram' | 'webhook'>('telegram')
+  const [token, setToken] = useState('')
+  const [chatId, setChatId] = useState('')
+  const [url, setUrl] = useState('')
+  const [events, setEvents] = useState<string[]>(['killswitch'])
+  const [via, setVia] = useState('direct')
+  const [fallback, setFallback] = useState(false)
+  const [err, setErr] = useState<string | null>(null)
+
+  const reset = () => {
+    setName('')
+    setType('telegram')
+    setToken('')
+    setChatId('')
+    setUrl('')
+    setEvents(['killswitch'])
+    setVia('direct')
+    setFallback(false)
+  }
+
+  const toggleEvent = (id: string) =>
+    setEvents((prev) => (prev.includes(id) ? prev.filter((e) => e !== id) : [...prev, id]))
+
+  const submit = async () => {
+    const nm = name.trim()
+    if (!nm) {
+      setErr('Give the alert a name.')
+      return
+    }
+    if (taken.has(nm)) {
+      setErr(`An alert named “${nm}” already exists.`)
+      return
+    }
+    if (type === 'telegram') {
+      if (!token.trim() || !chatId.trim()) {
+        setErr('Telegram needs a bot token and a chat ID.')
+        return
+      }
+    } else if (!HTTP_RE.test(url.trim())) {
+      setErr('Enter an http(s):// webhook URL.')
+      return
+    }
+    if (events.length === 0) {
+      setErr('Pick at least one event to notify on.')
+      return
+    }
+    setErr(null)
+    const routed = via !== 'direct'
+    const routing = { Via: routed ? via : undefined, Fallback: routed && fallback ? true : undefined }
+    const draft: Alert =
+      type === 'telegram'
+        ? { Name: nm, Enabled: true, Type: 'telegram', Token: token.trim(), ChatID: chatId.trim(), Events: events, ...routing }
+        : { Name: nm, Enabled: true, Type: 'webhook', URL: url.trim(), Events: events, ...routing }
+    const ok = await onAdd(draft)
+    if (ok) reset()
+  }
+
+  const routed = via !== 'direct'
+
+  return (
+    <form
+      className="alr-add"
+      onSubmit={(e) => {
+        e.preventDefault()
+        void submit()
+      }}
+    >
+      <div className="alr-add-top">
+        <input
+          className="alr-input alr-input--name"
+          type="text"
+          spellCheck={false}
+          autoComplete="off"
+          placeholder="Alert name"
+          aria-label="Alert name"
+          value={name}
+          onChange={(e) => {
+            setName(e.target.value)
+            if (err) setErr(null)
+          }}
+          disabled={busy || disabled}
+        />
+        <div className="alr-seg" role="group" aria-label="Alert type">
+          <button
+            type="button"
+            className={type === 'telegram' ? 'alr-seg-btn on' : 'alr-seg-btn'}
+            aria-pressed={type === 'telegram'}
+            onClick={() => setType('telegram')}
+            disabled={busy || disabled}
+          >
+            Telegram
+          </button>
+          <button
+            type="button"
+            className={type === 'webhook' ? 'alr-seg-btn on' : 'alr-seg-btn'}
+            aria-pressed={type === 'webhook'}
+            onClick={() => setType('webhook')}
+            disabled={busy || disabled}
+          >
+            Webhook
+          </button>
+        </div>
+      </div>
+
+      {type === 'telegram' ? (
+        <>
+          <input
+            className="alr-input"
+            type="password"
+            spellCheck={false}
+            autoComplete="off"
+            placeholder="Bot token (kept secret)"
+            aria-label="Telegram bot token"
+            value={token}
+            onChange={(e) => {
+              setToken(e.target.value)
+              if (err) setErr(null)
+            }}
+            disabled={busy || disabled}
+          />
+          <input
+            className="alr-input"
+            type="text"
+            spellCheck={false}
+            autoComplete="off"
+            placeholder="Chat ID (e.g. -1001234567890)"
+            aria-label="Telegram chat ID"
+            value={chatId}
+            onChange={(e) => {
+              setChatId(e.target.value)
+              if (err) setErr(null)
+            }}
+            disabled={busy || disabled}
+          />
+        </>
+      ) : (
+        <input
+          className="alr-input"
+          type="text"
+          inputMode="url"
+          spellCheck={false}
+          autoComplete="off"
+          placeholder="https://hooks.example.com/…"
+          aria-label="Webhook URL"
+          value={url}
+          onChange={(e) => {
+            setUrl(e.target.value)
+            if (err) setErr(null)
+          }}
+          disabled={busy || disabled}
+        />
+      )}
+
+      <fieldset className="alr-events" aria-label="Events to notify on">
+        {ALERT_EVENTS.map((ev) => (
+          <label key={ev.id} className="alr-event">
+            <input
+              type="checkbox"
+              checked={events.includes(ev.id)}
+              onChange={() => toggleEvent(ev.id)}
+              disabled={busy || disabled}
+            />
+            <span>{ev.label}</span>
+          </label>
+        ))}
+      </fieldset>
+
+      <div className="alr-delivery">
+        <label className="alr-resp">
+          <span className="alr-resp-label mono">Deliver via</span>
+          <DetourSelect
+            value={via}
+            catalog={catalog}
+            valid={valid}
+            busy={busy}
+            disabled={disabled}
+            ariaLabel="Deliver alert via"
+            onChange={setVia}
+            directLabel="Direct (default)"
+          />
+        </label>
+        <label className="alr-fallback">
+          <Toggle
+            pressed={fallback}
+            onChange={setFallback}
+            label={fallback ? 'Disable direct fallback' : 'Enable direct fallback'}
+            disabled={busy || disabled || !routed}
+          />
+          <span className="alr-fallback-label mono">Fallback to direct</span>
+        </label>
+      </div>
+      {routed && !fallback && (
+        <p className="alr-note" role="note">
+          {VIA_NO_FALLBACK_NOTE}
+        </p>
+      )}
+
+      <div className="alr-add-actions">
+        {err && (
+          <p className="alr-field-err" role="alert">
+            {err}
+          </p>
+        )}
+        <Button type="submit" variant="primary" disabled={busy || disabled}>
+          {busy ? 'Saving…' : 'Add alert'}
+        </Button>
+      </div>
+    </form>
+  )
+}
+
+function AlertRow({
+  alert,
+  busy,
+  catalog,
+  valid,
+  onToggle,
+  onVia,
+  onFallback,
+  onDelete,
+}: {
+  alert: Alert
+  busy: boolean
+  catalog: DetourCatalog
+  valid: Set<string>
+  onToggle: (on: boolean) => void
+  onVia: (v: string) => void
+  onFallback: (on: boolean) => void
+  onDelete: () => void
+}) {
+  // Never render the token/URL in clear — show a masked descriptor only.
+  const detail = useMemo(() => {
+    if (alert.Type === 'telegram') {
+      return { text: `chat ${alert.ChatID || '—'}`, masked: !!alert.Token }
+    }
+    const { host, masked } = maskUrl(alert.URL ?? '')
+    return { text: host, masked: masked || !!alert.URL }
+  }, [alert.Type, alert.ChatID, alert.Token, alert.URL])
+
+  const events = asArray(alert.Events)
+  const canon = useMemo(() => canonDetour(alert.Via, catalog), [alert.Via, catalog])
+  const route = useMemo(() => describeDetour(canon, catalog, valid), [canon, catalog, valid])
+  const routed = canon !== 'direct'
+  const fallback = alert.Fallback ?? false
+
+  return (
+    <li className="alr-row">
+      <Toggle
+        pressed={alert.Enabled}
+        onChange={onToggle}
+        label={`${alert.Enabled ? 'Disable' : 'Enable'} alert ${alert.Name}`}
+        disabled={busy}
+      />
+      <div className="alr-row-main">
+        <div className="alr-row-l1">
+          <span className="alr-row-name">{alert.Name}</span>
+          <span className="alr-badge">{alert.Type}</span>
+          {events.map((e) => (
+            <span key={e} className="alr-badge alr-badge--accent">
+              {e}
+            </span>
+          ))}
+        </div>
+        <div className="alr-row-l2 mono">
+          <span className="alr-row-detail">{detail.text}</span>
+          {detail.masked && (
+            <span className="alr-masked" title="Secret is stored but hidden here">
+              secret hidden
+            </span>
+          )}
+          {route.direct ? (
+            <span className="alr-path">direct</span>
+          ) : (
+            <span className="alr-path" data-active="on" data-missing={route.missing ? 'y' : undefined}>
+              {route.prefix} <strong className="alr-path-name">{route.name}</strong>
+              {route.missing && <span className="alr-path-flag"> (missing)</span>}
+              {fallback ? ' · +direct fallback' : ' · no fallback'}
+            </span>
+          )}
+        </div>
+        {routed && !fallback && <p className="alr-note alr-note--row">{VIA_NO_FALLBACK_NOTE}</p>}
+      </div>
+      <div className="alr-ctl">
+        <label className="alr-detour">
+          <span className="alr-detour-label mono">Deliver via</span>
+          <DetourSelect
+            value={canon}
+            catalog={catalog}
+            valid={valid}
+            busy={busy}
+            disabled={false}
+            ariaLabel={`Deliver alert ${alert.Name} via`}
+            onChange={onVia}
+            directLabel="Direct (default)"
+          />
+        </label>
+        <label className="alr-fallback">
+          <Toggle
+            pressed={fallback}
+            onChange={onFallback}
+            label={`${fallback ? 'Disable' : 'Enable'} direct fallback for ${alert.Name}`}
+            disabled={busy || !routed}
+          />
+          <span className="alr-fallback-label mono">Fallback to direct</span>
+        </label>
+      </div>
+      <Button
+        className="alr-del"
+        onClick={onDelete}
+        disabled={busy}
+        aria-label={`Delete alert ${alert.Name}`}
+      >
+        Delete
+      </Button>
+    </li>
+  )
+}
+
+/** The live delivery picker: option list built from the Model's targets. */
+function DetourSelect({
+  value,
+  catalog,
+  valid,
+  busy,
+  disabled,
+  ariaLabel,
+  onChange,
+  directLabel = 'Direct (no proxy)',
+}: {
+  value: string // canonical value
+  catalog: DetourCatalog
+  valid: Set<string>
+  busy: boolean
+  disabled: boolean
+  ariaLabel: string
+  onChange: (v: string) => void
+  directLabel?: string
+}) {
+  const missing = value !== 'direct' && !valid.has(value)
+  return (
+    <select
+      className="alr-select alr-detour-select"
+      value={value}
+      onChange={(e) => onChange(e.target.value)}
+      disabled={busy || disabled}
+      aria-label={ariaLabel}
+    >
+      <option value="direct">{directLabel}</option>
+      {catalog.groups.length > 0 && (
+        <optgroup label="Groups">
+          {catalog.groups.map((g) => (
+            <option key={g} value={`group:${g}`}>
+              Group {g} (balancer)
+            </option>
+          ))}
+        </optgroup>
+      )}
+      {catalog.chains.length > 0 && (
+        <optgroup label="Chains">
+          {catalog.chains.map((c) => (
+            <option key={c} value={`chain:${c}`}>
+              Chain {c}
+            </option>
+          ))}
+        </optgroup>
+      )}
+      {catalog.egresses.length > 0 && (
+        <optgroup label="Interfaces / egresses">
+          {catalog.egresses.map((e) => (
+            <option key={e.name} value={`egress:${e.name}`}>
+              Interface/egress {e.name}
+              {e.type ? ` (${e.type})` : ''}
+            </option>
+          ))}
+        </optgroup>
+      )}
+      {catalog.nodes.length > 0 && (
+        <optgroup label="Nodes">
+          {catalog.nodes.map((n) => (
+            <option key={n} value={`node:${n}`}>
+              Node {n}
+            </option>
+          ))}
+        </optgroup>
+      )}
+      {missing && <option value={value}>{value} (missing)</option>}
+    </select>
+  )
+}
+
+function EmptyPlate({ title, body }: { title: string; body: string }) {
+  return (
+    <div className="alr-empty">
+      <span className="alr-empty-title mono">{title}</span>
+      <p className="alr-empty-body">{body}</p>
+    </div>
+  )
+}

panel/src/pages/Apply.tsx

@@ -11,6 +11,8 @@ import {
   ApiError,
 } from '../api'
 import type { Globals, Status } from '../api'
+import { engineReadout, killSwitchReadout } from '../planeState'
+import { onPendingConfirmExpire, usePendingConfirm } from '../pendingConfirm'
 
 // Short, readable config hash — drops the "sha256:" prefix like the footer does.
 function short(hash: string): string {
@@ -25,13 +27,6 @@ function msg(e: unknown): string {
 
 type Busy = 'apply' | 'confirm' | 'rollback' | null
 
-/** A pending commit-confirm window: the daemon has armed an auto-rollback. */
-interface Armed {
-  total: number // the ConfirmTimeout the window started with
-  remaining: number // seconds left before the daemon reverts
-  appliedHash: string // the hash that went live on apply (the "after" of apply)
-}
-
 type ActionKind = 'apply' | 'confirm' | 'rollback' | 'expire'
 interface ActionResult {
   kind: ActionKind
@@ -57,7 +52,11 @@ export default function Apply() {
   const [configError, setConfigError] = useState<string | null>(null)
 
   const [busy, setBusy] = useState<Busy>(null)
-  const [armed, setArmed] = useState<Armed | null>(null)
+  // The armed window is app-wide state, not this page's: it is recorded by the
+  // api layer on every apply and survives a reload. Keeping it local is what made
+  // refreshing this tab lose both the countdown and the only button that could
+  // stop it. See pendingConfirm.ts.
+  const armed = usePendingConfirm()
   const [result, setResult] = useState<ActionResult | null>(null)
   const [confirmingRollback, setConfirmingRollback] = useState(false)
 
@@ -104,32 +103,64 @@ export default function Apply() {
     void loadConfig()
   }, [loadConfig])
 
-  // ---- commit-confirm countdown: a calm 1s numeric tick, effect-scoped so the
-  // timer is always cleared on unmount / confirm / rollback (no leaked intervals) ----
+  // The window running out does NOT mean the daemon rolled back.
+  //
+  // apply.ArmRollback captures the data-plane generation when it arms, and on
+  // expiry it compares. If anything re-applied the plane in between — another
+  // panel apply, SIGHUP, a hotplug or the once-a-minute cron reconcile, the WAN
+  // profile auto-switch — it disarms and KEEPS the running config, logging "NOT
+  // rolling back" and nothing else. That is the common case on a production
+  // router, and this page used to print "daemon auto-rolled back to last-good
+  // config" for it: a confident report of an event that did not happen, with a
+  // hash pair underneath that quietly said "unchanged".
+  //
+  // The panel cannot see which branch ran — the daemon says so only in its log.
+  // So it reports the one thing it CAN observe, the live config hash, and waits
+  // for the revert to land before reading it (a rollback is a full re-apply and
+  // does not complete the instant the timer fires).
+  const liveHashRef = useRef('')
+  liveHashRef.current = status?.hash ?? ''
   useEffect(() => {
-    if (!armed) return
-    if (armed.remaining <= 0) {
-      // Window elapsed — the daemon reverts to last-good on its own. Observe it.
-      const before = armed.appliedHash
-      setArmed(null)
-      flash('Auto-rolled back')
+    let cancelled = false
+    const off = onPendingConfirmExpire(() => {
+      const before = liveHashRef.current
+      flash('Confirm window elapsed')
+      setResult({
+        kind: 'expire',
+        tone: 'warn',
+        text: 'Confirm window elapsed. Reading what the daemon did…',
+        before,
+        after: before,
+      })
       void (async () => {
-        const after = (await refreshStatus())?.hash ?? ''
+        let after = before
+        for (let i = 0; i < 4 && !cancelled; i++) {
+          await new Promise((r) => window.setTimeout(r, 1500))
+          if (cancelled) return
+          after = (await refreshStatus())?.hash ?? after
+          if (after !== before) break
+        }
+        if (cancelled) return
         setResult({
           kind: 'expire',
           tone: 'warn',
-          text: 'Confirm window elapsed — daemon auto-rolled back to last-good config.',
+          text:
+            after !== before
+              ? 'Confirm window elapsed and the live config changed — the daemon reverted to its last-good config.'
+              : 'Confirm window elapsed and the live config has not changed, so this config is still running. ' +
+                'The daemon only reverts if nothing else re-applied the data plane while the window was open; ' +
+                'otherwise it stands down and keeps what is live. Which one happened is in the daemon log — ' +
+                'download it from Settings, or run `logread -e shater`.',
           before,
           after,
         })
       })()
-      return
+    })
+    return () => {
+      cancelled = true
+      off()
     }
-    const id = window.setTimeout(() => {
-      setArmed((a) => (a ? { ...a, remaining: a.remaining - 1 } : a))
-    }, 1000)
-    return () => window.clearTimeout(id)
-  }, [armed, flash, refreshStatus])
+  }, [flash, refreshStatus])
 
   const confirmWindow = globals?.ConfirmTimeout ?? 0
 
@@ -146,8 +177,9 @@ export default function Apply() {
         return
       }
       const after = (await refreshStatus())?.hash ?? before
+      // The window itself was recorded by api.apply(); this branch only writes the
+      // readout for it.
       if (r.changed && confirmWindow > 0) {
-        setArmed({ total: confirmWindow, remaining: confirmWindow, appliedHash: after })
         setResult({
           kind: 'apply',
           tone: 'good',
@@ -179,7 +211,8 @@ export default function Apply() {
   const doConfirm = useCallback(async () => {
     const before = status?.hash ?? ''
     setBusy('confirm')
-    setArmed(null) // stop the countdown immediately; confirm cancels the auto-rollback
+    // api.confirm() clears the shared window on success — the countdown stops the
+    // moment the daemon agrees, not the moment we asked.
     try {
       const r = await apiConfirm()
       if (r.error) {
@@ -208,7 +241,7 @@ export default function Apply() {
     const before = status?.hash ?? ''
     setConfirmingRollback(false)
     setBusy('rollback')
-    setArmed(null) // rolling back also cancels any pending confirm window
+    // api.rollback() clears the shared window on success (rolling back ends it).
     try {
       const r = await apiRollback()
       if (r.error) {
@@ -237,19 +270,50 @@ export default function Apply() {
   }, [status, flash, refreshStatus])
 
   // ---- derived display state (mirrors Overview's LED semantics) ----
-  const killArmed = globals ? globals.KillSwitch === 'closed' : false
-  const engineVariant: LedVariant = !status
-    ? 'off'
-    : status.running && status.active
-      ? 'on'
-      : status.running
-        ? 'amber'
-        : 'crit'
-  const dataVariant: LedVariant = status?.table ? 'on' : status?.running ? 'amber' : 'off'
-  const configVariant: LedVariant = status?.enabled ? 'on' : 'amber'
+  //
+  // The LIVE kill-switch wins over the saved one, exactly as on Overview: this row
+  // is a status readout, and the config on disk can already differ from what is
+  // installed. Falls back to the config only while /api/status is unread.
+  // Whether that setting is actually installed — same three-plus-unknown reading
+  // as Overview, so the two pages cannot disagree about the same router. There is
+  // no separate `killArmed` here any more: it compared the raw string (so "Closed"
+  // read as fail-OPEN) and, being a boolean, could not express "the configuration
+  // could not be read". Both facts come off this one readout now.
+  const kill = killSwitchReadout(status, globals?.KillSwitch)
+  const killWord =
+    kill.state === 'open'
+      ? 'open'
+      : kill.state === 'armed'
+        ? 'fail-closed'
+        : kill.state === 'inert'
+          ? 'closed · not in effect'
+          : // The unknown branch splits: "closed · not reported" asserts the policy
+            // and doubts only the install, which is wrong when the policy itself is
+            // a placeholder from a configuration nothing could read.
+            kill.setting === 'not known'
+            ? 'not known'
+            : 'closed · not reported'
+  // Every engine mark on this page comes from ONE reading, and that reading is
+  // able to say "stopped" — see planeState.engineState for why `status.running`
+  // could not. This page is where someone lands when the network is down; three
+  // green lamps here were the difference between "I broke it" and "nothing broke".
+  const engine = engineReadout(status)
+  const engineVariant: LedVariant = engine.variant
+  // No nft table means there is no data plane at all. Under a fail-closed switch
+  // that is a leak (crit); under an open one it is the documented choice (amber).
+  // It used to go amber whenever `running` was true — i.e. always — and unlit
+  // otherwise, so the one state worth shouting about had no colour of its own.
+  const dataVariant: LedVariant =
+    status?.table ? 'on' : !status ? 'off' : kill.state !== 'open' ? 'crit' : 'amber'
+  // `enabled` is sourced from the configuration, so it means nothing when that
+  // could not be read (Status.config_readable): unlit, not amber, and the pip
+  // beside it says so rather than printing "disabled".
+  const configUnreadable = status?.config_readable === false
+  const configVariant: LedVariant = configUnreadable ? 'off' : status?.enabled ? 'on' : 'amber'
+  const configWord = configUnreadable ? 'unreadable' : status?.enabled ? 'enabled' : 'disabled'
 
   const liveHash = short(status?.hash ?? '')
-  const pct = armed ? Math.max(0, Math.round((armed.remaining / armed.total) * 100)) : 0
+  const pct = armed ? Math.max(0, Math.round((armed.remaining / armed.pending.total) * 100)) : 0
 
   // Only offer rollback when the daemon says one would revert something: an armed
   // commit-confirm snapshot, or an engine last-good predecessor. When false there
@@ -264,25 +328,19 @@ export default function Apply() {
           label="Engine"
           variant={engineVariant}
           pulse={engineVariant === 'on'}
-          value={
-            !status ? 'checking…' : status.running ? (status.active ? 'active' : 'idle') : 'stopped'
-          }
+          value={engine.word}
         />
         <StatusPip
           label="Config"
           variant={configVariant}
-          value={status?.enabled ? 'enabled' : 'disabled'}
+          value={configWord}
         />
         <StatusPip
           label="Data plane"
           variant={dataVariant}
           value={status?.table ? 'nft installed' : 'no table'}
         />
-        <StatusPip
-          label="Kill-switch"
-          variant={killArmed ? 'on' : 'amber'}
-          value={killArmed ? 'fail-closed' : 'open'}
-        />
+        <StatusPip label="Kill-switch" variant={kill.variant} value={killWord} />
       </div>
 
       {statusError && (
@@ -310,9 +368,13 @@ export default function Apply() {
           unit="· sha256"
           led={{ variant: configVariant }}
           rows={[
-            { k: 'engine', v: status?.running ? 'running' : 'stopped', hot: !status?.running },
-            { k: 'data plane', v: status?.table ? 'nft installed' : 'no table' },
-            { k: 'kill-switch', v: killArmed ? 'fail-closed' : 'open', hot: !killArmed },
+            { k: 'engine', v: engine.word, hot: engineVariant === 'crit' },
+            {
+              k: 'data plane',
+              v: status?.table ? 'nft installed' : 'no table',
+              hot: dataVariant === 'crit',
+            },
+            { k: 'kill-switch', v: killWord, hot: kill.variant === 'crit' || kill.settingHot },
           ]}
         />
         <Module
@@ -325,8 +387,11 @@ export default function Apply() {
           }
           led={{ variant: engineVariant }}
           rows={[
-            { k: 'state', v: !status ? 'checking…' : status.active ? 'active' : 'idle' },
-            { k: 'config', v: status?.enabled ? 'enabled' : 'disabled' },
+            { k: 'state', v: engine.word, hot: engineVariant === 'crit' },
+            // Same reading as the pip above — `status.enabled` is a placeholder
+            // when the configuration could not be read, and "disabled" is the one
+            // word that must not be printed for it.
+            { k: 'config', v: configWord, hot: configUnreadable },
             { k: 'schema', v: globals ? `v${globals.SchemaVersion}` : '—' },
           ]}
         />
@@ -362,9 +427,13 @@ export default function Apply() {
             </div>
             <div className="cc-info">
               <p className="cc-copy">
-                Applied config <span className="mono">{short(armed.appliedHash)}</span> is live but
-                not yet kept. Confirm to keep it — otherwise the daemon rolls back to the last-good
-                config when the timer hits zero.
+                {/* The live hash IS the applied one while a window is open — that
+                    is what "live but not kept" means — so the readout survives a
+                    reload instead of depending on what this tab remembers. */}
+                Applied config <span className="mono">{liveHash}</span> is live but not yet kept.
+                Confirm to keep it. At zero the daemon rolls back to the last-good config — unless
+                something else re-applies the data plane first, in which case it stands down and
+                keeps whatever is live.
               </p>
               <div className="cc-bar" aria-hidden="true">
                 <span className="cc-bar-fill" style={{ width: `${pct}%` }} />
@@ -481,7 +550,9 @@ function labelFor(kind: ActionKind): string {
     case 'rollback':
       return 'Rollback'
     case 'expire':
-      return 'Auto-rollback'
+      // NOT "Auto-rollback": on expiry the daemon either reverts or stands down,
+      // and this page cannot tell which. Name the event it did observe.
+      return 'Window elapsed'
   }
 }
 

panel/src/pages/DNS.css

@@ -104,6 +104,16 @@
   font-size: 11.5px;
   color: var(--faint);
 }
+/* Nested inside .dns-filter-copy the note is an ordinary paragraph, but the
+   endpoint-resolver footnote sits as a DIRECT child of the card — which makes it
+   a grid item. Without a span it auto-placed into the toggle's `auto` column and
+   sized that column to its own max-content (322px on desktop, 237px at 390px),
+   which starved the `1fr` copy column down to 0px: the heading then laid out one
+   word per line and spilled 2px past the viewport, scrolling the whole page
+   sideways. It is a full-width footnote under the readout — say so. */
+.dns-filter-card > .dns-filter-note {
+  grid-column: 1 / -1;
+}
 .dns-readout {
   display: flex;
   flex-direction: column;
@@ -387,6 +397,79 @@
 .dns-row-state[data-active='on'] {
   color: var(--led-on);
 }
+/* A list that is switched on but has nothing loaded is not "off" and is certainly
+   not "filtering" — warn semantics, the same amber the badges use. */
+.dns-row-state[data-active='warn'] {
+  color: var(--amber);
+}
+
+/* ---- remote-list freshness (mirrors the rule-set rows on Routing) ---- */
+.dns-row-sync {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 10px;
+  margin-top: 3px;
+}
+.dns-sync-fresh {
+  font-family: var(--font-mono);
+  font-size: 11px;
+  color: var(--dim);
+}
+.dns-sync-fresh[data-never='y'] {
+  color: var(--amber);
+}
+.dns-sync-every,
+.dns-sync-rules {
+  font-family: var(--font-mono);
+  font-size: 10.5px;
+  letter-spacing: 0.02em;
+  color: var(--faint);
+}
+.dns-sync-every::before {
+  content: '↻ ';
+}
+.dns-sync-update {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  padding: 3px 10px;
+  border: 1px solid var(--accent-soft);
+  border-radius: 5px;
+  background: var(--raised);
+  color: var(--accent);
+  font-family: var(--font-mono);
+  font-size: 10px;
+  letter-spacing: var(--track-label);
+  text-transform: uppercase;
+  cursor: pointer;
+  transition: color 0.12s, border-color 0.12s, background 0.12s;
+}
+.dns-sync-update:hover:not(:disabled) {
+  border-color: var(--accent);
+  background: color-mix(in srgb, var(--accent) 12%, transparent);
+}
+.dns-sync-update:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: 2px;
+}
+.dns-sync-update:disabled {
+  opacity: 0.6;
+  cursor: not-allowed;
+}
+.dns-sync-spin {
+  width: 10px;
+  height: 10px;
+  border: 2px solid color-mix(in srgb, var(--accent) 35%, transparent);
+  border-top-color: var(--accent);
+  border-radius: 50%;
+  animation: dns-sync-spin 0.7s linear infinite;
+}
+@keyframes dns-sync-spin {
+  to {
+    transform: rotate(360deg);
+  }
+}
 
 /* badge — groove-bordered, not orange (accent stays reserved) */
 .dns-badge {
@@ -575,80 +658,19 @@
   }
 }
 
-/* alert delivery: deliver-via picker + fallback toggle + caution note */
-.dns-alert-delivery {
-  display: flex;
-  flex-wrap: wrap;
-  align-items: center;
-  gap: 10px 20px;
-}
-.dns-fallback {
-  display: inline-flex;
-  align-items: center;
-  gap: 8px;
-  cursor: pointer;
-}
-.dns-fallback-label {
-  font-size: 10px;
-  letter-spacing: var(--track-label, 0.18em);
-  text-transform: uppercase;
-  color: var(--faint);
-}
-/* the per-alert-row delivery controls sit inline in the row (like .dns-detour) */
-.dns-alert-ctl {
-  flex: none;
-  display: flex;
-  flex-direction: column;
-  gap: 8px;
-  min-width: 0;
-}
-.dns-alert-note {
-  margin: 0;
-  font-family: var(--font-sans);
-  font-size: 11.5px;
-  line-height: 1.5;
-  color: var(--amber);
-  max-width: 56ch;
-}
-.dns-alert-note--row {
-  margin-top: 2px;
-}
-
-@media (max-width: 640px) {
-  .dns-alert-ctl {
-    flex-basis: 100%;
-    order: 3;
-  }
-}
-
-/* alert event checkboxes */
-.dns-events {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 8px 16px;
-  margin: 0;
-  padding: 0;
-  border: 0;
-}
-.dns-event {
-  display: inline-flex;
-  align-items: center;
-  gap: 6px;
-  font-size: 13px;
-  color: var(--fp-text, inherit);
-  cursor: pointer;
-}
-.dns-event input {
-  accent-color: var(--fp-accent, currentColor);
-}
-
 @media (prefers-reduced-motion: reduce) {
   .dns-skel {
     animation: none;
   }
+  /* No spin under reduced motion — the static ring + "Updating…" label carry it. */
+  .dns-sync-spin {
+    animation: none;
+    border-top-color: color-mix(in srgb, var(--accent) 35%, transparent);
+  }
   .dns-chip,
   .dns-input,
-  .dns-seg-btn {
+  .dns-seg-btn,
+  .dns-sync-update {
     transition: none;
   }
 }

panel/src/pages/DNS.tsx

@@ -1,8 +1,16 @@
 import './DNS.css'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { Button, CatSuggest, Led, SrcPicker, Toggle } from '../components'
-import { apply as apiApply, getConfig, putConfig, ApiError } from '../api'
-import type { Alert, DNSRule, Model, Resolver } from '../api'
+import { Button, CatSuggest, Led, SrcPicker, Toggle, useConfirm } from '../components'
+import {
+  apply as apiApply,
+  getConfig,
+  getRulesetStatus,
+  putConfig,
+  updateRuleset as apiUpdateRuleset,
+  ApiError,
+} from '../api'
+import type { Complete, DNSRule, Model, Resolver, RulesetStatus } from '../api'
+import { everyLabel, relFetch } from '../format'
 
 // The DNS / Blocklists page is a thin editor over the desired-state Model —
 // exactly like Nodes.tsx. Every edit rewrites the relevant slice in-place, PUTs
@@ -52,28 +60,9 @@ type GlobalsX = Model['Globals'] & { DNSFilter?: boolean }
 type DNSModel = Model & {
   Blocklists?: Blocklist[] | null
   Allowlists?: Allowlist[] | null
-  Alerts?: Alert[] | null
   DNSRules?: DNSRule[] | null
 }
 
-/**
- * Every event the daemon actually sends. A retired health-probe event was left
- * out on purpose: nothing ever fired it, so a channel that subscribed to it would
- * just stay quiet forever — the one failure mode an alert must not have. Only
- * events with a live firing path are offered here.
- */
-const ALERT_EVENTS: ReadonlyArray<{ id: string; label: string }> = [
-  { id: 'killswitch', label: 'Kill-switch' },
-  { id: 'apply_fail', label: 'Apply failure' },
-  { id: 'new_device', label: 'New device' },
-  { id: 'sub_expiry', label: 'Subscription expiring' },
-]
-
-// Shown when an alert routes through a detour with no direct fallback — the exact
-// case where a tunnel-down alert could fail to send. The user asked for this.
-const VIA_NO_FALLBACK_NOTE =
-  'A kill-switch/tunnel-down alert may not send if it routes through the affected tunnel — enable fallback.'
-
 // ---- helpers ---------------------------------------------------------------
 
 const asArray = <T,>(a: T[] | null | undefined): T[] => (a ? a : [])
@@ -220,6 +209,7 @@ function describeDetour(
 // ---- page ------------------------------------------------------------------
 
 export default function DNS() {
+  const confirm = useConfirm()
   const [config, setConfig] = useState<DNSModel | null>(null)
   const [loadError, setLoadError] = useState<string | null>(null)
 
@@ -301,7 +291,6 @@ export default function DNS() {
   const blocklists = useMemo(() => asArray(config?.Blocklists), [config])
   const allowlists = useMemo(() => asArray(config?.Allowlists), [config])
   const resolvers = useMemo<Resolver[]>(() => asArray(config?.Resolvers), [config])
-  const alerts = useMemo<Alert[]>(() => asArray(config?.Alerts), [config])
   // Ascending Order — the engine evaluates DNS rules first-match, so the list is
   // shown and edited in the order it actually runs.
   const dnsRules = useMemo<DNSRule[]>(
@@ -309,6 +298,68 @@ export default function DNS() {
     [config],
   )
 
+  // ---- did the lists actually LOAD? -----------------------------------------
+  //
+  // A blocklist row said "filtering" whenever the list and the master switch were
+  // both on. Neither of those is evidence that anything is being blocked: a
+  // url/geosite list is fetched by the engine, the daemon treats a failed fetch as
+  // a CRITICAL apply finding, and the row went on saying "filtering" through it.
+  // The Routing page had already been given this reading for rule-sets — the same
+  // endpoint, the same tags (`bl-<name>` / `al-<name>`) — and the DNS page never
+  // asked. Slow poll: lists refresh on a ~24h cadence, so 15s only has to catch a
+  // manual Update-now. Grouped by NAME because a geosite list with N categories
+  // reports N records.
+  const [listStatus, setListStatus] = useState<Map<string, RulesetStatus[]>>(new Map())
+  const [updatingLists, setUpdatingLists] = useState<Set<string>>(new Set())
+  const loadListStatus = useCallback(async () => {
+    try {
+      const all = await getRulesetStatus()
+      const m = new Map<string, RulesetStatus[]>()
+      for (const s of all) {
+        if (s.kind !== 'blocklist' && s.kind !== 'allowlist') continue
+        const key = `${s.kind}:${s.name}`
+        const arr = m.get(key)
+        if (arr) arr.push(s)
+        else m.set(key, [s])
+      }
+      setListStatus(m)
+    } catch {
+      // Engine stopped or an older daemon — keep the last reading. The row falls
+      // back to "load not reported", which claims nothing either way.
+    }
+  }, [])
+  useEffect(() => {
+    void loadListStatus()
+    const id = window.setInterval(() => void loadListStatus(), 15000)
+    return () => window.clearInterval(id)
+  }, [loadListStatus])
+
+  const updateList = useCallback(
+    async (kind: 'blocklist' | 'allowlist', name: string) => {
+      const key = `${kind}:${name}`
+      setUpdatingLists((prev) => new Set(prev).add(key))
+      try {
+        // One geo list can hold several categories, each its own engine tag.
+        const recs = listStatus.get(key) ?? []
+        const tags = recs.length
+          ? recs.map((r) => r.tag)
+          : [`${kind === 'blocklist' ? 'bl' : 'al'}-${name}`]
+        for (const tag of tags) await apiUpdateRuleset(tag)
+        await loadListStatus()
+        flash(`${name} refreshed`)
+      } catch (e) {
+        flash(`Refresh failed — ${errText(e)}`)
+      } finally {
+        setUpdatingLists((prev) => {
+          const next = new Set(prev)
+          next.delete(key)
+          return next
+        })
+      }
+    },
+    [listStatus, loadListStatus, flash],
+  )
+
   const blOn = blocklists.filter((b) => b.Enabled).length
   const alOn = allowlists.filter((a) => a.Enabled).length
   const blNames = useMemo(() => new Set(blocklists.map((b) => b.Name)), [blocklists])
@@ -422,15 +473,19 @@ export default function DNS() {
   )
 
   const removeBlocklist = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
       if (!config) return
       const target = blocklists[idx]
-      if (!window.confirm(`Delete blocklist “${target.Name}”? This removes it from the config.`))
-        return
+      const ok = await confirm({
+        label: 'Delete blocklist',
+        title: `Delete blocklist “${target.Name}”?`,
+        body: 'This removes it from the config.',
+      })
+      if (!ok) return
       const next = blocklists.filter((_, i) => i !== idx)
       void save({ ...config, Blocklists: next }, `Deleted ${target.Name}`)
     },
-    [config, blocklists, save],
+    [config, blocklists, save, confirm],
   )
 
   // ---- allowlist mutations --------------------------------------------------
@@ -457,15 +512,19 @@ export default function DNS() {
   )
 
   const removeAllowlist = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
       if (!config) return
       const target = allowlists[idx]
-      if (!window.confirm(`Delete allowlist “${target.Name}”? This removes it from the config.`))
-        return
+      const ok = await confirm({
+        label: 'Delete allowlist',
+        title: `Delete allowlist “${target.Name}”?`,
+        body: 'This removes it from the config.',
+      })
+      if (!ok) return
       const next = allowlists.filter((_, i) => i !== idx)
       void save({ ...config, Allowlists: next }, `Deleted ${target.Name}`)
     },
-    [config, allowlists, save],
+    [config, allowlists, save, confirm],
   )
 
   // ---- resolver mutations ---------------------------------------------------
@@ -491,15 +550,58 @@ export default function DNS() {
     [config, resolvers, save],
   )
 
+  /**
+   * Delete a resolver, saying what it was still wired into.
+   *
+   * The three GLOBAL slots (default, fallback, endpoint) are cleared here, because
+   * a global pointing at nothing is never what anyone meant. The DNS RULES are a
+   * different matter: each one is a decision about which queries go where, and
+   * silently deleting or repointing them would change where a device's DNS goes
+   * without saying so. So they are named instead and left alone — the dialog is
+   * where the operator finds out they exist, which is precisely what this page
+   * used to skip: it cleared the two globals without a word and never mentioned
+   * the rules at all.
+   */
   const removeResolver = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
       if (!config) return
       const target = resolvers[idx]
-      if (!window.confirm(`Delete resolver “${target.Name}”? This removes it from the config.`))
-        return
-      const next = resolvers.filter((_, i) => i !== idx)
-      // Don't leave default/fallback pointing at a resolver that no longer exists.
       const g = { ...config.Globals }
+      const slots: string[] = []
+      if (g.ResolverDefault === target.Name) slots.push('the default resolver')
+      if (g.ResolverFallback === target.Name) slots.push('the fallback resolver')
+      if (g.EndpointResolver === target.Name) slots.push('the endpoint resolver')
+      const usedBy = dnsRules.filter((r) => r.Resolver === target.Name)
+
+      const parts: string[] = []
+      if (slots.length > 0) {
+        parts.push(
+          `It is ${slots.join(' and ')} — ${
+            slots.length === 1 ? 'that slot is' : 'those slots are'
+          } cleared, so DNS falls back to the engine's built-in resolution.`,
+        )
+      }
+      if (usedBy.length === 1) {
+        parts.push(
+          `One DNS rule still sends queries to it (order ${usedBy[0].Order}). It is left as it is and will have nowhere to resolve — repoint it before you apply.`,
+        )
+      } else if (usedBy.length > 1) {
+        parts.push(
+          `${usedBy.length} DNS rules still send queries to it (orders ${usedBy
+            .map((r) => r.Order)
+            .join(', ')}). They are left as they are and will have nowhere to resolve — repoint them before you apply.`,
+        )
+      }
+      if (parts.length === 0) parts.push('Nothing else in the config points at it.')
+
+      const ok = await confirm({
+        label: 'Delete resolver',
+        title: `Delete resolver “${target.Name}”?`,
+        body: parts.join(' '),
+      })
+      if (!ok) return
+      const next = resolvers.filter((_, i) => i !== idx)
+      // Don't leave default/fallback/endpoint pointing at a resolver that's gone.
       const cleared: string[] = []
       if (g.ResolverDefault === target.Name) {
         g.ResolverDefault = ''
@@ -509,12 +611,16 @@ export default function DNS() {
         g.ResolverFallback = ''
         cleared.push('fallback')
       }
+      if (g.EndpointResolver === target.Name) {
+        g.EndpointResolver = ''
+        cleared.push('endpoint')
+      }
       const msg = cleared.length
         ? `Deleted ${target.Name} — cleared ${cleared.join(' & ')}`
         : `Deleted ${target.Name}`
       void save({ ...config, Globals: g, Resolvers: next }, msg)
     },
-    [config, resolvers, save],
+    [config, resolvers, dnsRules, save, confirm],
   )
 
   const setResolverDefault = useCallback(
@@ -578,84 +684,21 @@ export default function DNS() {
   )
 
   const removeDNSRule = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
       if (!config) return
       const target = dnsRules[idx]
-      if (!window.confirm(`Delete this DNS rule? Matching queries fall back to the default resolver.`))
-        return
+      const ok = await confirm({
+        label: 'Delete DNS rule',
+        title: 'Delete this DNS rule?',
+        body: 'Matching queries fall back to the default resolver.',
+      })
+      if (!ok) return
       const next = dnsRules.filter((_, i) => i !== idx)
       void save({ ...config, DNSRules: next }, `Deleted DNS rule → ${target.Resolver}`)
     },
-    [config, dnsRules, save],
+    [config, dnsRules, save, confirm],
   )
 
-  // ---- alert mutations ------------------------------------------------------
-  const addAlert = useCallback(
-    (draft: Alert): Promise<boolean> => {
-      if (!config) return Promise.resolve(false)
-      const taken = new Set(alerts.map((a) => a.Name))
-      const a: Alert = { ...draft, Name: uniqueName(draft.Name, taken) }
-      return save({ ...config, Alerts: [...alerts, a] }, `Added ${a.Name}`)
-    },
-    [config, alerts, save],
-  )
-
-  const toggleAlert = useCallback(
-    (idx: number, on: boolean) => {
-      if (!config) return
-      const next = alerts.map((a, i) => (i === idx ? { ...a, Enabled: on } : a))
-      void save({ ...config, Alerts: next }, `${next[idx].Name} ${on ? 'enabled' : 'disabled'}`)
-    },
-    [config, alerts, save],
-  )
-
-  const removeAlert = useCallback(
-    (idx: number) => {
-      if (!config) return
-      const target = alerts[idx]
-      if (!window.confirm(`Delete alert “${target.Name}”? This removes it from the config.`)) return
-      const next = alerts.filter((_, i) => i !== idx)
-      void save({ ...config, Alerts: next }, `Deleted ${target.Name}`)
-    },
-    [config, alerts, save],
-  )
-
-  const setAlertVia = useCallback(
-    (idx: number, v: string) => {
-      if (!config) return
-      const via = v === 'direct' ? '' : v
-      const next = alerts.map((a, i) => (i === idx ? { ...a, Via: via || undefined } : a))
-      void save(
-        { ...config, Alerts: next },
-        via ? `${next[idx].Name} delivers via ${via}` : `${next[idx].Name} delivers direct`,
-      )
-    },
-    [config, alerts, save],
-  )
-
-  const setAlertFallback = useCallback(
-    (idx: number, on: boolean) => {
-      if (!config) return
-      const next = alerts.map((a, i) => (i === idx ? { ...a, Fallback: on || undefined } : a))
-      void save(
-        { ...config, Alerts: next },
-        `${next[idx].Name} direct fallback ${on ? 'on' : 'off'}`,
-      )
-    },
-    [config, alerts, save],
-  )
-
-  // Alerts route through Direct/group/node/egress only (no chains) — the contract
-  // vocabulary for Alert.Via. Reuse the resolver detour catalog with chains dropped.
-  const alertCatalog = useMemo<DetourCatalog>(
-    () => ({ ...detourCatalog, chains: [] }),
-    [detourCatalog],
-  )
-  const alertValid = useMemo(() => detourValues(alertCatalog), [alertCatalog])
-
-  const alertNames = useMemo(() => new Set(alerts.map((a) => a.Name)), [alerts])
-  const alertsOn = alerts.filter((a) => a.Enabled).length
-
   const loading = config === null && loadError === null
 
   return (
@@ -883,8 +926,11 @@ export default function DNS() {
                 categories={b.Categories}
                 response={b.Response}
                 filterOn={dnsFilterOn}
+                statuses={listStatus.get(`blocklist:${b.Name}`) ?? null}
+                updating={updatingLists.has(`blocklist:${b.Name}`)}
                 busy={busy}
                 onToggle={(on) => toggleBlocklist(i, on)}
+                onUpdateNow={() => void updateList('blocklist', b.Name)}
                 onDelete={() => removeBlocklist(i)}
               />
             ))}
@@ -942,9 +988,13 @@ export default function DNS() {
                 url={a.URL}
                 path={a.Path}
                 entries={a.Entries}
+                categories={a.Categories}
                 filterOn={dnsFilterOn}
+                statuses={listStatus.get(`allowlist:${a.Name}`) ?? null}
+                updating={updatingLists.has(`allowlist:${a.Name}`)}
                 busy={busy}
                 onToggle={(on) => toggleAllowlist(i, on)}
+                onUpdateNow={() => void updateList('allowlist', a.Name)}
                 onDelete={() => removeAllowlist(i)}
               />
             ))}
@@ -1069,57 +1119,6 @@ export default function DNS() {
         )}
       </div>
 
-      {/* ---- 5. ALERTS ---- */}
-      <div className="dns-section" aria-label="Alerts">
-        <header className="dns-sec-hd">
-          <h2 className="dns-sec-title">Alerts</h2>
-          <span className="dns-sec-count mono">
-            {alertsOn} / {alerts.length} on
-          </span>
-        </header>
-        <p className="dns-sec-note">
-          Out-of-band notifications. Delivered <strong>direct to the internet</strong> by default — so a
-          kill-switch or engine-down alert still reaches you when the proxy is down. You can route one
-          through a group, node or egress instead, with a direct fallback if that detour fails.
-        </p>
-
-        <AddAlertForm
-          busy={busy}
-          disabled={!config}
-          taken={alertNames}
-          catalog={alertCatalog}
-          valid={alertValid}
-          onAdd={addAlert}
-        />
-
-        {loading ? (
-          <ul className="dns-rows" aria-hidden="true">
-            <li className="dns-skel" />
-          </ul>
-        ) : alerts.length === 0 ? (
-          <EmptyPlate
-            title="No alerts"
-            body="Add a Telegram bot or a webhook above to get notified when the kill-switch trips, a new device joins, or an apply fails."
-          />
-        ) : (
-          <ul className="dns-rows">
-            {alerts.map((a, i) => (
-              <AlertRow
-                key={`${a.Name}-${i}`}
-                alert={a}
-                busy={busy}
-                catalog={alertCatalog}
-                valid={alertValid}
-                onToggle={(on) => toggleAlert(i, on)}
-                onVia={(v) => setAlertVia(i, v)}
-                onFallback={(on) => setAlertFallback(i, on)}
-                onDelete={() => removeAlert(i)}
-              />
-            ))}
-          </ul>
-        )}
-      </div>
-
       {toast && (
         <div className="toast" role="status">
           {toast}
@@ -1129,342 +1128,6 @@ export default function DNS() {
   )
 }
 
-// ---- alert add form + row --------------------------------------------------
-
-function AddAlertForm({
-  busy,
-  disabled,
-  taken,
-  catalog,
-  valid,
-  onAdd,
-}: {
-  busy: boolean
-  disabled: boolean
-  taken: Set<string>
-  catalog: DetourCatalog
-  valid: Set<string>
-  onAdd: (a: Alert) => Promise<boolean>
-}) {
-  const [name, setName] = useState('')
-  const [type, setType] = useState<'telegram' | 'webhook'>('telegram')
-  const [token, setToken] = useState('')
-  const [chatId, setChatId] = useState('')
-  const [url, setUrl] = useState('')
-  const [events, setEvents] = useState<string[]>(['killswitch'])
-  const [via, setVia] = useState('direct')
-  const [fallback, setFallback] = useState(false)
-  const [err, setErr] = useState<string | null>(null)
-
-  const reset = () => {
-    setName('')
-    setType('telegram')
-    setToken('')
-    setChatId('')
-    setUrl('')
-    setEvents(['killswitch'])
-    setVia('direct')
-    setFallback(false)
-  }
-
-  const toggleEvent = (id: string) =>
-    setEvents((prev) => (prev.includes(id) ? prev.filter((e) => e !== id) : [...prev, id]))
-
-  const submit = async () => {
-    const nm = name.trim()
-    if (!nm) {
-      setErr('Give the alert a name.')
-      return
-    }
-    if (taken.has(nm)) {
-      setErr(`An alert named “${nm}” already exists.`)
-      return
-    }
-    if (type === 'telegram') {
-      if (!token.trim() || !chatId.trim()) {
-        setErr('Telegram needs a bot token and a chat ID.')
-        return
-      }
-    } else if (!HTTP_RE.test(url.trim())) {
-      setErr('Enter an http(s):// webhook URL.')
-      return
-    }
-    if (events.length === 0) {
-      setErr('Pick at least one event to notify on.')
-      return
-    }
-    setErr(null)
-    const routed = via !== 'direct'
-    const routing = { Via: routed ? via : undefined, Fallback: routed && fallback ? true : undefined }
-    const draft: Alert =
-      type === 'telegram'
-        ? { Name: nm, Enabled: true, Type: 'telegram', Token: token.trim(), ChatID: chatId.trim(), Events: events, ...routing }
-        : { Name: nm, Enabled: true, Type: 'webhook', URL: url.trim(), Events: events, ...routing }
-    const ok = await onAdd(draft)
-    if (ok) reset()
-  }
-
-  const routed = via !== 'direct'
-
-  return (
-    <form
-      className="dns-add"
-      onSubmit={(e) => {
-        e.preventDefault()
-        void submit()
-      }}
-    >
-      <div className="dns-add-top">
-        <input
-          className="dns-input dns-input--name"
-          type="text"
-          spellCheck={false}
-          autoComplete="off"
-          placeholder="Alert name"
-          aria-label="Alert name"
-          value={name}
-          onChange={(e) => {
-            setName(e.target.value)
-            if (err) setErr(null)
-          }}
-          disabled={busy || disabled}
-        />
-        <div className="dns-seg" role="group" aria-label="Alert type">
-          <button
-            type="button"
-            className={type === 'telegram' ? 'dns-seg-btn on' : 'dns-seg-btn'}
-            aria-pressed={type === 'telegram'}
-            onClick={() => setType('telegram')}
-            disabled={busy || disabled}
-          >
-            Telegram
-          </button>
-          <button
-            type="button"
-            className={type === 'webhook' ? 'dns-seg-btn on' : 'dns-seg-btn'}
-            aria-pressed={type === 'webhook'}
-            onClick={() => setType('webhook')}
-            disabled={busy || disabled}
-          >
-            Webhook
-          </button>
-        </div>
-      </div>
-
-      {type === 'telegram' ? (
-        <>
-          <input
-            className="dns-input"
-            type="password"
-            spellCheck={false}
-            autoComplete="off"
-            placeholder="Bot token (kept secret)"
-            aria-label="Telegram bot token"
-            value={token}
-            onChange={(e) => {
-              setToken(e.target.value)
-              if (err) setErr(null)
-            }}
-            disabled={busy || disabled}
-          />
-          <input
-            className="dns-input"
-            type="text"
-            spellCheck={false}
-            autoComplete="off"
-            placeholder="Chat ID (e.g. -1001234567890)"
-            aria-label="Telegram chat ID"
-            value={chatId}
-            onChange={(e) => {
-              setChatId(e.target.value)
-              if (err) setErr(null)
-            }}
-            disabled={busy || disabled}
-          />
-        </>
-      ) : (
-        <input
-          className="dns-input"
-          type="text"
-          inputMode="url"
-          spellCheck={false}
-          autoComplete="off"
-          placeholder="https://hooks.example.com/…"
-          aria-label="Webhook URL"
-          value={url}
-          onChange={(e) => {
-            setUrl(e.target.value)
-            if (err) setErr(null)
-          }}
-          disabled={busy || disabled}
-        />
-      )}
-
-      <fieldset className="dns-events" aria-label="Events to notify on">
-        {ALERT_EVENTS.map((ev) => (
-          <label key={ev.id} className="dns-event">
-            <input
-              type="checkbox"
-              checked={events.includes(ev.id)}
-              onChange={() => toggleEvent(ev.id)}
-              disabled={busy || disabled}
-            />
-            <span>{ev.label}</span>
-          </label>
-        ))}
-      </fieldset>
-
-      <div className="dns-alert-delivery">
-        <label className="dns-resp">
-          <span className="dns-resp-label mono">Deliver via</span>
-          <DetourSelect
-            value={via}
-            catalog={catalog}
-            valid={valid}
-            busy={busy}
-            disabled={disabled}
-            ariaLabel="Deliver alert via"
-            onChange={setVia}
-            directLabel="Direct (default)"
-          />
-        </label>
-        <label className="dns-fallback">
-          <Toggle
-            pressed={fallback}
-            onChange={setFallback}
-            label={fallback ? 'Disable direct fallback' : 'Enable direct fallback'}
-            disabled={busy || disabled || !routed}
-          />
-          <span className="dns-fallback-label mono">Fallback to direct</span>
-        </label>
-      </div>
-      {routed && !fallback && (
-        <p className="dns-alert-note" role="note">
-          {VIA_NO_FALLBACK_NOTE}
-        </p>
-      )}
-
-      <div className="dns-add-actions">
-        {err && (
-          <p className="dns-field-err" role="alert">
-            {err}
-          </p>
-        )}
-        <Button type="submit" variant="primary" disabled={busy || disabled}>
-          {busy ? 'Saving…' : 'Add alert'}
-        </Button>
-      </div>
-    </form>
-  )
-}
-
-function AlertRow({
-  alert,
-  busy,
-  catalog,
-  valid,
-  onToggle,
-  onVia,
-  onFallback,
-  onDelete,
-}: {
-  alert: Alert
-  busy: boolean
-  catalog: DetourCatalog
-  valid: Set<string>
-  onToggle: (on: boolean) => void
-  onVia: (v: string) => void
-  onFallback: (on: boolean) => void
-  onDelete: () => void
-}) {
-  // Never render the token/URL in clear — show a masked descriptor only.
-  const detail = useMemo(() => {
-    if (alert.Type === 'telegram') {
-      return { text: `chat ${alert.ChatID || '—'}`, masked: !!alert.Token }
-    }
-    const { host, masked } = maskUrl(alert.URL ?? '')
-    return { text: host, masked: masked || !!alert.URL }
-  }, [alert.Type, alert.ChatID, alert.Token, alert.URL])
-
-  const events = asArray(alert.Events)
-  const canon = useMemo(() => canonDetour(alert.Via, catalog), [alert.Via, catalog])
-  const route = useMemo(() => describeDetour(canon, catalog, valid), [canon, catalog, valid])
-  const routed = canon !== 'direct'
-  const fallback = alert.Fallback ?? false
-
-  return (
-    <li className="dns-row">
-      <Toggle
-        pressed={alert.Enabled}
-        onChange={onToggle}
-        label={`${alert.Enabled ? 'Disable' : 'Enable'} alert ${alert.Name}`}
-        disabled={busy}
-      />
-      <div className="dns-row-main">
-        <div className="dns-row-l1">
-          <span className="dns-row-name">{alert.Name}</span>
-          <span className="dns-badge">{alert.Type}</span>
-          {events.map((e) => (
-            <span key={e} className="dns-badge dns-badge--accent">
-              {e}
-            </span>
-          ))}
-        </div>
-        <div className="dns-row-l2 mono">
-          <span className="dns-row-detail">{detail.text}</span>
-          {detail.masked && (
-            <span className="dns-masked" title="Secret is stored but hidden here">
-              secret hidden
-            </span>
-          )}
-          {route.direct ? (
-            <span className="dns-path">direct</span>
-          ) : (
-            <span className="dns-path" data-active="on" data-missing={route.missing ? 'y' : undefined}>
-              {route.prefix} <strong className="dns-path-name">{route.name}</strong>
-              {route.missing && <span className="dns-path-flag"> (missing)</span>}
-              {fallback ? ' · +direct fallback' : ' · no fallback'}
-            </span>
-          )}
-        </div>
-        {routed && !fallback && <p className="dns-alert-note dns-alert-note--row">{VIA_NO_FALLBACK_NOTE}</p>}
-      </div>
-      <div className="dns-alert-ctl">
-        <label className="dns-detour">
-          <span className="dns-detour-label mono">Deliver via</span>
-          <DetourSelect
-            value={canon}
-            catalog={catalog}
-            valid={valid}
-            busy={busy}
-            disabled={false}
-            ariaLabel={`Deliver alert ${alert.Name} via`}
-            onChange={onVia}
-            directLabel="Direct (default)"
-          />
-        </label>
-        <label className="dns-fallback">
-          <Toggle
-            pressed={fallback}
-            onChange={onFallback}
-            label={`${fallback ? 'Disable' : 'Enable'} direct fallback for ${alert.Name}`}
-            disabled={busy || !routed}
-          />
-          <span className="dns-fallback-label mono">Fallback to direct</span>
-        </label>
-      </div>
-      <Button
-        className="dns-del"
-        onClick={onDelete}
-        disabled={busy}
-        aria-label={`Delete alert ${alert.Name}`}
-      >
-        Delete
-      </Button>
-    </li>
-  )
-}
-
 // ---- add form --------------------------------------------------------------
 
 interface AddDraft {
@@ -1695,8 +1358,11 @@ function ListRow({
   categories,
   response,
   filterOn,
+  statuses,
+  updating,
   busy,
   onToggle,
+  onUpdateNow,
   onDelete,
 }: {
   name: string
@@ -1708,8 +1374,14 @@ function ListRow({
   categories?: string[] | null
   response?: BlockResponse
   filterOn: boolean
+  /** What the running engine reports about this list, one record per geo category.
+   *  null/[] ⇒ nothing reported: an older daemon, a stopped engine, or a list that
+   *  has not been applied yet. The row then says so instead of guessing. */
+  statuses: RulesetStatus[] | null
+  updating: boolean
   busy: boolean
   onToggle: (on: boolean) => void
+  onUpdateNow: () => void
   onDelete: () => void
 }) {
   const detail = useMemo<{ text: string; masked: boolean; title?: string }>(() => {
@@ -1733,8 +1405,45 @@ function ListRow({
     }
   }, [source, url, path, entries, categories])
 
-  // A list only actually filters when both it and the master switch are on.
-  const active = enabled && filterOn
+  // url and geosite lists are FETCHED by the engine; inline and file ones are read
+  // straight from the config and are loaded the moment they are applied.
+  const remote = source === 'url' || source === 'geosite'
+  const recs = statuses ?? []
+  const hasStatus = recs.length > 0
+  // A geo list with several categories: the OLDEST fetch (so a category that never
+  // arrived is never hidden behind a fresh sibling) and the SUM of the counts.
+  let ruleCount = 0
+  let neverAny = false
+  let oldestIso = ''
+  for (const s of recs) {
+    ruleCount += s.rule_count
+    if (!s.last_updated) neverAny = true
+    else if (!oldestIso || Date.parse(s.last_updated) < Date.parse(oldestIso)) oldestIso = s.last_updated
+  }
+  const interval = everyLabel(recs[0]?.interval_seconds ?? 0)
+
+  /**
+   * Whether this list is BLOCKING ANYTHING, which is a different question from
+   * whether it is switched on — and the one the row used to answer wrongly.
+   *
+   * "filtering" is now only said when the engine reports rules loaded for it. A
+   * remote list that has never been fetched (the daemon raises this as a critical
+   * apply finding) reads "not loaded", and one that fetched an empty list reads
+   * "empty". Nothing reported at all is "load not reported": unknown, not green.
+   */
+  const state: { text: string; tone: 'on' | 'off' | 'warn' } = !enabled
+    ? { text: 'off', tone: 'off' }
+    : !filterOn
+      ? { text: 'inactive', tone: 'off' }
+      : !remote
+        ? { text: 'filtering', tone: 'on' }
+        : !hasStatus
+          ? { text: 'load not reported', tone: 'off' }
+          : neverAny
+            ? { text: 'not loaded — nothing blocked', tone: 'warn' }
+            : ruleCount === 0
+              ? { text: 'loaded empty — nothing blocked', tone: 'warn' }
+              : { text: 'filtering', tone: 'on' }
 
   return (
     <li className="dns-row">
@@ -1764,10 +1473,39 @@ function ListRow({
               token hidden
             </span>
           )}
-          <span className="dns-row-state" data-active={active ? 'on' : 'off'}>
-            {active ? 'filtering' : 'inactive'}
+          <span className="dns-row-state" data-active={state.tone}>
+            {state.text}
           </span>
         </div>
+        {remote && (
+          <div className="dns-row-sync">
+            <span className="dns-sync-fresh" data-never={hasStatus && neverAny ? 'y' : undefined}>
+              {hasStatus ? relFetch(oldestIso) : 'status pending'}
+            </span>
+            {interval && <span className="dns-sync-every">{interval}</span>}
+            {ruleCount > 0 && (
+              <span className="dns-sync-rules">
+                {ruleCount.toLocaleString('en-US')} rule{ruleCount === 1 ? '' : 's'}
+              </span>
+            )}
+            <button
+              type="button"
+              className="dns-sync-update"
+              onClick={onUpdateNow}
+              disabled={busy || updating}
+              aria-label={`Update ${name} now`}
+            >
+              {updating ? (
+                <>
+                  <span className="dns-sync-spin" aria-hidden="true" />
+                  <span>Updating…</span>
+                </>
+              ) : (
+                'Update now'
+              )}
+            </button>
+          </div>
+        )}
       </div>
       <Button
         className="dns-del"
@@ -2206,8 +1944,15 @@ function ruleToDraft(r: DNSRule): DNSRuleDraft {
   }
 }
 
-/** Build the DNSRule to persist. Empty matcher lists are omitted, not sent as []. */
-function draftToRule(d: DNSRuleDraft): DNSRule {
+/**
+ * Build the DNSRule to persist. Empty matcher lists are omitted, not sent as [].
+ *
+ * The return type is `Complete<DNSRule>` for the same reason as Networks.fromDraft:
+ * this REBUILDS the rule from the draft rather than extending the one it was given,
+ * so a field added to `DNSRule` would otherwise be dropped on every edit with
+ * nothing to notice it. Completing the type makes that a build failure here.
+ */
+function draftToRule(d: DNSRuleDraft): Complete<DNSRule> {
   const domains = parseRuleDomains(d.Domains)
   const order = Number.parseInt(d.Order, 10)
   return {

panel/src/pages/Devices.css

@@ -138,57 +138,9 @@
 
 /* inline rename: a quiet pencil affordance beside the name, and the mono input
    it swaps to — in the same sink/groove tone as the domain editors. */
-.dev-rename {
-  flex: none;
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 22px;
-  height: 22px;
-  padding: 0;
-  border: 1px solid transparent;
-  border-radius: 5px;
-  background: none;
-  color: var(--faint);
-  font-size: 12px;
-  line-height: 1;
-  cursor: pointer;
-  transition: color 0.15s, background 0.15s, border-color 0.15s;
-}
-.dev-rename:hover:not(:disabled) {
-  color: var(--accent);
-  background: color-mix(in srgb, var(--accent) 12%, transparent);
-}
-.dev-rename:focus-visible {
-  color: var(--accent);
-  border-color: var(--accent);
-  outline: 2px solid var(--accent);
-  outline-offset: 1px;
-}
-.dev-rename:disabled {
-  opacity: 0.5;
-  cursor: default;
-}
-.dev-name-input {
-  min-width: 0;
-  max-width: 24ch;
-  padding: 4px 8px;
-  border: 1px solid var(--accent);
-  border-radius: 6px;
-  background: var(--sink);
-  color: var(--ink);
-  font-size: 13px;
-  font-weight: 600;
-  letter-spacing: 0.01em;
-  box-shadow: 0 1px 2px var(--shadow) inset;
-}
-.dev-name-input:focus-visible {
-  outline: 2px solid var(--accent);
-  outline-offset: 1px;
-}
-.dev-name-input:disabled {
-  opacity: 0.55;
-}
+/* The pencil button and the name input now live in App.css as .inline-rename /
+   .inline-rename-input — Nodes grew the same affordance and the two pages must
+   not drift. */
 .dev-id-l2 {
   display: flex;
   align-items: center;

panel/src/pages/Devices.tsx

@@ -1,6 +1,6 @@
 import './Devices.css'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { Button, Led, Module, Toggle } from '../components'
+import { Button, Led, Module, Toggle, useConfirm } from '../components'
 import type { LedVariant } from '../components'
 import { apply as apiApply, getConfig, getDevices, putConfig, ApiError } from '../api'
 import type { Device, DiscoveredDevice, Model } from '../api'
@@ -81,6 +81,7 @@ function networkLabel(row: DeviceRow): string {
 // ---- page ------------------------------------------------------------------
 
 export default function Devices() {
+  const confirm = useConfirm()
   const [config, setConfig] = useState<Model | null>(null)
   const [loadError, setLoadError] = useState<string | null>(null)
 
@@ -251,17 +252,22 @@ export default function Devices() {
   const nameOf = (row: DeviceRow) => row.cfg?.Name || row.hostname || row.ip || 'device'
 
   const removeControl = useCallback(
-    (row: DeviceRow) => {
+    async (row: DeviceRow) => {
       if (!config) return
       const devs = asArray(config.Devices)
       const idx = matchDevice(devs, row.mac, row.ip)
       if (idx < 0) return
       const nm = devs[idx].Name || nameOf(row)
-      if (!window.confirm(`Stop managing “${nm}”? Its per-device rules are removed; it falls back to network defaults.`))
-        return
+      const ok = await confirm({
+        label: 'Stop managing device',
+        title: `Stop managing “${nm}”?`,
+        body: 'Its per-device rules are removed; it falls back to network defaults.',
+        confirmLabel: 'Stop managing',
+      })
+      if (!ok) return
       void save({ ...config, Devices: devs.filter((_, i) => i !== idx) }, `Removed control for ${nm}`)
     },
-    [config, save],
+    [config, save, confirm],
   )
 
   const loading = config === null && loadError === null && devices === null && devError === null
@@ -471,7 +477,7 @@ function DeviceCard({
             {renaming ? (
               <input
                 ref={nameInput}
-                className="dev-name-input mono"
+                className="inline-rename-input mono"
                 type="text"
                 spellCheck={false}
                 autoComplete="off"
@@ -497,7 +503,7 @@ function DeviceCard({
                 </span>
                 <button
                   type="button"
-                  className="dev-rename"
+                  className="inline-rename"
                   onClick={beginRename}
                   disabled={busy}
                   aria-label={`Rename ${name}`}

panel/src/pages/Networks.css

@@ -495,6 +495,22 @@
     border-left: 0;
     border-top: 1px solid var(--groove);
   }
+  /* Collapsing to one column was not enough on a phone. A grid column is sized by
+     its widest item's MIN-CONTENT, and a <select> reports the width of its longest
+     option ("Allow everything — most compatible", in the mono face) — so the
+     column stayed ~20px wider than the plate and the COPY beside it was clipped
+     mid-word at the right edge, which is how a sentence about what leaks loses its
+     second half. The select is allowed to shrink and ellipsise its own label
+     instead; the chosen option is still fully readable once opened, and no text
+     that states a consequence is cut. */
+  .nw-policy-ctl {
+    min-width: 0;
+  }
+  .nw-policy-ctl .fp-select {
+    max-width: 100%;
+    min-width: 0;
+    text-overflow: ellipsis;
+  }
 }
 
 /* A daemon info note about the current policy — neutral by design: it states a

panel/src/pages/Networks.tsx

@@ -1,10 +1,11 @@
 import './Networks.css'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { Button, Led, Select, Toggle } from '../components'
+import { Button, Led, Select, Toggle, useConfirm } from '../components'
 import { apply as apiApply, getConfig, putConfig, ApiError } from '../api'
-import type { Inbound, Interface, Model, Status } from '../api'
+import type { Complete, Inbound, Interface, Model, Status } from '../api'
 import { isLanNetwork, isWanNetwork, useInterfaces } from '../srcOptions'
 import { sectionNotes } from '../findings'
+import { killSwitchClosed } from '../planeState'
 
 // The Networks page is the INGRESS editor — a thin editor over Model.Inbounds,
 // following the same save-then-Apply contract as Nodes/DNS/Routing: every edit
@@ -85,6 +86,49 @@ const DEFAULT_TPROXY_PORT = 12345
  * Collapsing those into one switch would make "I want ping to work" silently mean
  * "I permit a parallel VPN bypass", so the middle option exists to remove that
  * false choice — and the labels push anyone who wants diagnostics to `icmp`.
+ *
+ * WHY THIS COPY WAS REWRITTEN. `block` used to say "Nothing leaves except through
+ * the tunnel", and it was not true. The daemon let untunnelable traffic out toward
+ * every destination the ROUTING RULES send direct, on the argument that such a host
+ * already has your address from ordinary TCP. Under the commonest setup here —
+ * "tunnel what's blocked, send the rest direct" — the routing default IS direct, so
+ * that covered everything: `block` behaved exactly like `direct`, including ESP/GRE,
+ * i.e. the parallel-VPN case the middle rung exists to exclude. The daemon now drops
+ * unconditionally under `block`, and this copy states the price instead of hiding it
+ * (the owner's call: this router does not do ping and does not do IPTV).
+ *
+ * `icmp` still carries that destination-dependence for its NON-ping half, so its
+ * cost line says so rather than claiming "nothing else gets out".
+ *
+ * WHY THIS COPY IS NOW A FUNCTION AND NOT A TABLE. Two audit findings, one cause:
+ * a constant string cannot be true about a router whose behaviour three OTHER
+ * settings can override.
+ *
+ *  1. MULTICAST IPTV WAS PROMISED, AND NEVER WORKS. `direct` said "Ping, multicast
+ *     IPTV, and connecting to a VPN ... all work" — an INSTRUCTION, and the worst
+ *     kind of wrong: someone who wants IPTV reads it, moves to the most open rung
+ *     on the ladder (which also permits a client's ESP/GRE straight past the
+ *     proxy), and still has no IPTV. The stream is UDP; every rule this policy
+ *     emits carries `meta l4proto != { tcp, udp }` so UDP never reaches one, and
+ *     the fail-closed forward chain accepts only the RFC1918/link-local daddr
+ *     sets — 224.0.0.0/4 is not there, and unconditional drops follow. The daemon
+ *     says exactly this in the note rendered a few pixels below on this same page.
+ *     IPTV is now stated ONCE, as its own line, and it says it does not work.
+ *  2. THE `block` COST LINE WAS UNCONDITIONAL. Three settings contradict it:
+ *       - an OPEN kill-switch — the forward chain emits no drops at all;
+ *       - Globals.L3Tunnel — prerouting marks ICMP echo into the engine's TUN
+ *         BEFORE the forward chain, so ping keeps working, through the tunnel;
+ *       - Globals.UntunnelableEgress — ESP/AH/GRE/IGMP/SCTP are marked and routed
+ *         out a named interface, so the forward chain never rules on them.
+ *     Neither of the last two existed in the panel's `Globals` type, so the page
+ *     could not have told the truth about them even in principle; they were added
+ *     (api.ts) rather than papered over with a vaguer sentence.
+ *
+ * The copy therefore describes only what the POLICY still decides, and a separate
+ * line names whatever another setting has taken off it. Detail beyond that belongs
+ * to the daemon's own note for this section (`policyNotes`), which is computed
+ * from the running plane and rendered right underneath — this copy's job is to not
+ * contradict it.
  */
 type Untunnelable = 'block' | 'icmp' | 'direct'
 
@@ -98,7 +142,10 @@ function normUntunnelable(raw: string | undefined): Untunnelable {
 
 const UNTUNNELABLE_OPTIONS: ReadonlyArray<{ value: string; label: string }> = [
   { value: 'block', label: 'Block everything — most private' },
-  { value: 'icmp', label: 'Allow ping only — for diagnostics' },
+  // Not "Allow ping only": the rung also lets the other untunnelable protocols
+  // out toward directly-routed addresses, and the cost line below says so. A
+  // label that promised "only" would be contradicted two lines under itself.
+  { value: 'icmp', label: 'Allow ping — for diagnostics' },
   { value: 'direct', label: 'Allow everything — most compatible' },
 ]
 
@@ -106,26 +153,197 @@ interface PolicyCopy {
   works: string
   cost: string | null
   tone: 'good' | 'warn'
+  /** What some OTHER setting decides instead of this one. `null` ⇒ nothing; this policy owns it all. */
+  claimed: string | null
 }
 
-const UNTUNNELABLE_COPY: Record<Untunnelable, PolicyCopy> = {
-  block: {
-    works: 'Nothing leaves except through the tunnel.',
-    cost: 'Ping and traceroute won’t work from your devices, and neither will multicast IPTV or connecting to a VPN from a device on your network.',
-    tone: 'good',
-  },
-  icmp: {
-    works: 'Ping and traceroute work, so you can check whether something is reachable.',
-    cost: 'Whatever you ping sees your real IP address instead of the tunnel’s. Only for hosts you deliberately ping, and nothing else gets out — IPTV and VPN connections stay blocked.',
-    tone: 'warn',
-  },
-  direct: {
-    works: 'Ping, multicast IPTV, and connecting to a VPN from a device on your network all work.',
-    cost: 'All of it goes out with your real IP, around the tunnel. A VPN app left running on a device keeps its own connection open beside this one — traffic through it isn’t proxied or filtered.',
-    tone: 'warn',
-  },
+/**
+ * How much of this traffic the policy still decides.
+ *
+ * Only three combinations are reachable, which is why this is an enum and not two
+ * booleans: UntunnelableEgress claims EVERY untunnelable protocol (the kernel
+ * routes them out its device before the forward chain runs), so once it is set
+ * there is nothing left for L3Tunnel to change about the policy's scope.
+ *
+ *   all        — neither override is on. The policy decides everything.
+ *   exceptPing — L3Tunnel only. Ping rides the tunnel; ESP/AH/GRE/SCTP are the
+ *                policy's.
+ *   none       — UntunnelableEgress is set. Routing settles all of it first; the
+ *                policy answers only for the case where that route fails to come up.
+ */
+type PolicyScope = 'all' | 'exceptPing' | 'none'
+
+interface PolicyContext {
+  /** Globals.L3Tunnel. */
+  l3: boolean
+  /** Globals.UntunnelableEgress, trimmed. */
+  egress: string
+  /** The LIVE kill-switch, normalised the daemon's way. Open ⇒ the chain has no drops. */
+  killSwitchOpen: boolean
 }
 
+function policyScope(ctx: PolicyContext): PolicyScope {
+  if (ctx.egress) return 'none'
+  return ctx.l3 ? 'exceptPing' : 'all'
+}
+
+/** The sentence that stops an operator "fixing" a UDP VPN that was never broken. */
+const UDP_VPNS_FINE =
+  'VPNs that run over UDP — WireGuard, OpenVPN-UDP, and IPsec through NAT (IKEv2/NAT-T) — are unaffected either way: they go through the tunnel like everything else.'
+
+/** Which setting took this traffic off the policy, and what it does with it. */
+function claimedCopy(ctx: PolicyContext): string | null {
+  // Each of these says only WHY the copy above has the shape it has — which other
+  // setting took the traffic, and therefore why the familiar promise is missing.
+  // What that setting then DOES with it is the daemon's note, published for this
+  // same section and rendered immediately below from the RUNNING plane. Saying it
+  // twice would make the shorter, staler one look like a second opinion.
+  if (ctx.egress && ctx.l3) {
+    return `Two other settings decide this before the one above is asked: ping goes through the tunnel (l3_tunnel), and everything else the tunnel can’t carry is routed out “${ctx.egress}” (untunnelable_egress).`
+  }
+  if (ctx.egress) {
+    return `Another setting decides this before the one above is asked: everything the tunnel can’t carry is routed out “${ctx.egress}” (untunnelable_egress).`
+  }
+  if (ctx.l3) {
+    // Deliberately shorter than the two above: when only the L3 ingress is on, the
+    // daemon publishes its own note for this section directly underneath and says
+    // the rest (which addresses can be pinged, and why the others cannot). This
+    // line exists to explain the SHAPE of the copy above it — why ping is missing
+    // from a policy that used to decide it — not to restate the daemon.
+    return 'Ping and Windows tracert are taken through the tunnel before the setting above is asked (l3_tunnel), so it no longer decides them.'
+  }
+  return null
+}
+
+/**
+ * The copy for the policy as it is actually behaving right now.
+ *
+ * Read it as: an open kill-switch beats everything (no drops are emitted at all,
+ * so no rung promises anything), then the scope decides how much of the ladder's
+ * usual story is still this setting's to tell.
+ */
+function policyCopy(policy: Untunnelable, ctx: PolicyContext): PolicyCopy {
+  const scope = policyScope(ctx)
+  const claimed = claimedCopy(ctx)
+
+  // Fail-open: the forward chain emits no drops, so every rung is inert. Saying
+  // what IS happening beats repeating a promise nothing is keeping.
+  if (ctx.killSwitchOpen) {
+    if (scope === 'none') {
+      return {
+        works:
+          'Nothing is being dropped, and nothing is left for this setting to decide: the kill-switch is open, and another setting has already taken this traffic.',
+        cost: 'If that route ever fails to come up, the traffic leaves through your normal connection with your real IP address, quietly, instead of failing.',
+        tone: 'warn',
+        claimed,
+      }
+    }
+    return {
+      works:
+        scope === 'exceptPing'
+          ? 'Nothing is being dropped: with the kill-switch open the forward chain has no drops at all, so a device’s own IPsec or PPTP connection works too.'
+          : 'Nothing is being dropped: with the kill-switch open the forward chain has no drops at all, so ping, traceroute and a device’s own IPsec or PPTP connection all work.',
+      // No "set the kill-switch to fail-closed" here: the moot note below owns
+      // that instruction, and printing it twice in one section is how the second
+      // copy stops being read.
+      cost: `It reaches the internet with your real IP address, around the tunnel. ${UDP_VPNS_FINE}`,
+      tone: 'warn',
+      claimed,
+    }
+  }
+
+  switch (policy) {
+    case 'block':
+      if (scope === 'none') {
+        return {
+          works:
+            'Where this setting still applies, the packet is dropped rather than let out — so a route that fails to come up fails honestly instead of leaking.',
+          cost: null,
+          tone: 'good',
+          claimed,
+        }
+      }
+      return {
+        // Scoped to "this traffic" on purpose. The old line — "Nothing leaves
+        // except through the tunnel" — was doubly loose: it was false (see the
+        // note above), and even read charitably it collides with directly-routed
+        // TCP, which does leave outside the tunnel by design.
+        works:
+          scope === 'exceptPing'
+            ? 'Everything this setting still decides is dropped, whatever your routing rules say. If the ping route ever fails to come up, ping fails outright rather than leaking.'
+            : 'None of this traffic leaves the router — it’s dropped, whatever your routing rules say. It’s the only setting whose promise doesn’t depend on how the rules are written.',
+        cost:
+          scope === 'exceptPing'
+            ? `IPsec and PPTP VPN connections made from a device on your network stop working, and so does SCTP. ${UDP_VPNS_FINE}`
+            : `Ping and traceroute stop working from your devices. So do IPsec and PPTP VPN connections made from a device on your network, and SCTP. ${UDP_VPNS_FINE}`,
+        tone: 'good',
+        claimed,
+      }
+
+    case 'icmp':
+      if (scope === 'none') {
+        return {
+          works:
+            'Where this setting still applies, it lets ping out directly and drops the rest.',
+          cost: 'So if a route ever fails to come up, ping quietly leaves with your real IP address instead of failing.',
+          tone: 'warn',
+          claimed,
+        }
+      }
+      if (scope === 'exceptPing') {
+        return {
+          works:
+            'Ping already travels through the tunnel, so this rung’s exception for it only matters if that route fails to come up.',
+          cost: 'IPsec, PPTP and SCTP get out toward addresses your routing rules already send direct, with your real IP address — so a VPN app on a device can still open its own connection beside this one if its server is one of those. And if the ping route fails, ping leaves with your real address rather than failing.',
+          tone: 'warn',
+          claimed,
+        }
+      }
+      return {
+        works:
+          'Ping and traceroute work everywhere, so you can check whether something is reachable.',
+        cost: 'Whatever you ping sees your real IP address instead of the tunnel’s. IPsec and PPTP also get out — but only toward addresses your routing rules already send direct, so a VPN app on a device can still open its own connection beside this one if its server is one of those.',
+        tone: 'warn',
+        claimed,
+      }
+
+    case 'direct':
+      if (scope === 'none') {
+        return {
+          works:
+            'Nothing is left for this setting to decide: another setting has already taken this traffic.',
+          cost: 'If that route ever fails to come up, this setting lets the traffic leave through your normal connection with your real IP address, quietly, instead of failing.',
+          tone: 'warn',
+          claimed,
+        }
+      }
+      return {
+        works:
+          scope === 'exceptPing'
+            ? 'A device on your network can make its own IPsec or PPTP VPN connection. Ping already travels through the tunnel.'
+            : 'Ping and traceroute work, and a device on your network can make its own IPsec or PPTP VPN connection.',
+        cost:
+          scope === 'exceptPing'
+            ? 'That traffic goes out with your real IP, around the tunnel. A VPN app left running on a device keeps its own connection open beside this one — traffic through it isn’t proxied or filtered. If the ping route ever fails to come up, ping does the same instead of failing.'
+            : 'All of it goes out with your real IP, around the tunnel. A VPN app left running on a device keeps its own connection open beside this one — traffic through it isn’t proxied or filtered.',
+        tone: 'warn',
+        claimed,
+      }
+  }
+}
+
+/**
+ * Multicast IPTV, said once and said straight.
+ *
+ * It is stated unconditionally because it is unconditionally true — the stream is
+ * UDP and no rule this policy emits can match UDP, on any of the three rungs — and
+ * it is stated at all because the page used to promise the opposite under `direct`
+ * and under `icmp`. Someone whose IPTV is broken arrives here looking for the
+ * setting that fixes it; the useful thing to tell them is that there isn't one.
+ */
+const IPTV_LINE =
+  'Multicast IPTV is not one of these things: it doesn’t pass this router on any of the three settings, and “Allow everything” won’t bring it back.'
+
 /** The addr:port an inbound binds — the generator's clash key (listenKey). */
 function listenKey(in_: Inbound): string {
   if (effectiveType(in_) === 'tproxy') {
@@ -242,6 +460,7 @@ function computeWarnings(inbounds: Inbound[], ifaces: Interface[]): Warning[] {
 // ---- page ------------------------------------------------------------------
 
 export default function Networks({ status }: { status?: Status | null }) {
+  const confirm = useConfirm()
   const [config, setConfig] = useState<Model | null>(null)
   const [loadError, setLoadError] = useState<string | null>(null)
   const ifaces = useInterfaces()
@@ -326,11 +545,24 @@ export default function Networks({ status }: { status?: Status | null }) {
   // Untunnelable-traffic policy. Normalised the same way the daemon does, so an
   // absent/unknown UCI value reads as `block` here too rather than as blank.
   const untunnelable = normUntunnelable(config?.Globals?.Untunnelable)
-  const untunnelableCopy = UNTUNNELABLE_COPY[untunnelable]
   // Prefer the LIVE kill-switch off /api/status; fall back to the saved config
-  // when the shell hasn't got a status yet.
-  const killSwitchOpen =
-    (status?.kill_switch ?? config?.Globals?.KillSwitch ?? 'closed').toLowerCase() === 'open'
+  // when the shell hasn't got a status yet. The comparison is the daemon's own
+  // (planeState.killSwitchClosed) — this page normalised and planeState.ts did
+  // not, so the same router read differently on two pages.
+  const killSwitchOpen = !killSwitchClosed(status?.kill_switch ?? config?.Globals?.KillSwitch)
+  // The two settings that decide part of this traffic BEFORE the policy is
+  // consulted. Both are read from the saved config, like `untunnelable` itself:
+  // /api/status reports neither, and this section describes the setting the
+  // operator is editing. The daemon's own note below is the live counterpart.
+  const untunnelableCopy = useMemo(
+    () =>
+      policyCopy(untunnelable, {
+        l3: config?.Globals?.L3Tunnel === true,
+        egress: (config?.Globals?.UntunnelableEgress ?? '').trim(),
+        killSwitchOpen,
+      }),
+    [untunnelable, config?.Globals?.L3Tunnel, config?.Globals?.UntunnelableEgress, killSwitchOpen],
+  )
   // The daemon's info notes about this policy — shown beside the control they
   // describe. The fail-open case has its own dedicated line below, so drop that
   // one here to avoid saying the same thing twice.
@@ -392,23 +624,21 @@ export default function Networks({ status }: { status?: Status | null }) {
   )
 
   const removeInbound = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
       if (!config) return
       const target = inbounds[idx]
-      if (
-        !window.confirm(
-          `Delete inbound “${target.Name}”?${
-            intercepts(target)
-              ? ` ${target.Network || 'Its network'} stops going through the tunnel.`
-              : ''
-          }`,
-        )
-      )
-        return
+      const ok = await confirm({
+        label: 'Delete inbound',
+        title: `Delete inbound “${target.Name}”?`,
+        body: intercepts(target)
+          ? `${target.Network || 'Its network'} stops going through the tunnel.`
+          : undefined,
+      })
+      if (!ok) return
       const next = inbounds.filter((_, i) => i !== idx)
       void save({ ...config, Inbounds: next }, `Deleted ${target.Name}`)
     },
-    [config, inbounds, save],
+    [config, inbounds, save, confirm],
   )
 
   return (
@@ -499,8 +729,8 @@ export default function Networks({ status }: { status?: Status | null }) {
         </header>
         <p className="nw-sec-note">
           The tunnel carries the traffic almost everything uses — web, video, games, email. A few
-          things can’t go through it no matter what: ping, and the protocols that carry IPTV or a VPN
-          connection. Choose what happens to those.
+          things can’t go through it no matter what: ping, and the protocols a device uses to make
+          its own VPN connection. Choose what happens to those.
         </p>
 
         <div className="nw-policy">
@@ -529,13 +759,28 @@ export default function Networks({ status }: { status?: Status | null }) {
           </div>
         </div>
 
-        {/* Fail-open makes the whole policy moot — say so instead of letting the
-            page imply something is being blocked when nothing is. */}
+        {/* What another setting decides instead of this one. Unlit lamp, like the
+            daemon's notes below: it reports a configuration, not a fault. */}
+        {untunnelableCopy.claimed && (
+          <p className="nw-sec-note nw-policy-note" role="status">
+            <Led variant="off" />
+            <span>{untunnelableCopy.claimed}</span>
+          </p>
+        )}
+
+        {/* Said once, on every setting, because it is true on every setting. */}
+        <p className="nw-sec-note nw-policy-note">
+          <Led variant="off" />
+          <span>{IPTV_LINE}</span>
+        </p>
+
+        {/* Fail-open makes the whole policy moot. The copy above now says what IS
+            happening; this line stays because it is the one that says what to DO. */}
         {killSwitchOpen && (
           <p className="nw-sec-note nw-policy-moot" role="status">
-            <Led variant="amber" /> This setting isn’t doing anything right now: the kill-switch is
-            set to fail-open, so traffic keeps flowing directly whenever the tunnel is down. Set it
-            to fail-closed in Settings for this choice to take effect.
+            <Led variant="amber" /> The kill-switch is set to fail-open, so traffic keeps flowing
+            directly whenever the tunnel is down. Set it to fail-closed in Settings for this choice
+            to take effect.
           </p>
         )}
 
@@ -552,7 +797,7 @@ export default function Networks({ status }: { status?: Status | null }) {
 
         {untunnelable === 'block' && (
           <p className="nw-sec-note nw-policy-hint">
-            If you just want to check whether a site is reachable, choose <strong>Allow ping only</strong>{' '}
+            If you just want to check whether a site is reachable, choose <strong>Allow ping</strong>{' '}
             rather than allowing everything — it’s the narrower of the two.
           </p>
         )}
@@ -738,7 +983,22 @@ function toDraft(in_: Inbound): Draft {
  * and a dokodemo listener binds whatever `TargetNetwork` says. Writing anything
  * else would make the daemon warn about a flag no one can see.
  */
-function fromDraft(d: Draft, base: Partial<Inbound>, enabled: boolean): Inbound {
+/**
+ * Build the Inbound this draft describes — REBUILT per type, never extended.
+ *
+ * Rebuilding is the point: an inbound switched from `socks` to `tproxy` binds
+ * 0.0.0.0:TproxyPort, so a surviving `Listen`/`Auth` from its previous life would
+ * be a setting the panel shows nobody and the generator ignores. `base` is
+ * accepted and deliberately unused for that reason.
+ *
+ * The return type is `Complete<Inbound>` so the rebuild cannot go stale in
+ * silence: adding a field to `Inbound` fails the BUILD in all three branches
+ * below until each says what it wants done with it. That is the only mechanism
+ * here that makes the omission loud — `Ruleset.Format` is what a missing one
+ * costs (see ruleset.ts). `undefined` is a positive statement of "this shape has
+ * no use for it", and JSON.stringify drops it, so the wire form is unchanged.
+ */
+function fromDraft(d: Draft, base: Partial<Inbound>, enabled: boolean): Complete<Inbound> {
   void base
   const common = { Name: d.Name.trim(), Enabled: enabled }
   const port = Number.parseInt(d.Port, 10)
@@ -751,6 +1011,16 @@ function fromDraft(d: Draft, base: Partial<Inbound>, enabled: boolean): Inbound
         TproxyPort: Number.parseInt(d.TproxyPort, 10) || DEFAULT_TPROXY_PORT,
         TCP: d.TCP,
         UDP: d.UDP,
+        // Binds 0.0.0.0:TproxyPort and cannot authenticate or rewrite a
+        // destination, so none of the listener fields mean anything here.
+        Listen: undefined,
+        Port: undefined,
+        Auth: undefined,
+        User: undefined,
+        Pass: undefined,
+        TargetAddr: undefined,
+        TargetPort: undefined,
+        TargetNetwork: undefined,
       }
     case 'socks':
     case 'http':
@@ -764,6 +1034,12 @@ function fromDraft(d: Draft, base: Partial<Inbound>, enabled: boolean): Inbound
         Pass: d.Auth === 'password' ? d.Pass : '',
         TCP: true,
         UDP: true,
+        // A local listener diverts no network and has no fixed target.
+        Network: undefined,
+        TproxyPort: undefined,
+        TargetAddr: undefined,
+        TargetPort: undefined,
+        TargetNetwork: undefined,
       }
     case 'dokodemo':
       return {
@@ -776,6 +1052,12 @@ function fromDraft(d: Draft, base: Partial<Inbound>, enabled: boolean): Inbound
         TargetNetwork: d.TargetNetwork,
         TCP: true,
         UDP: true,
+        // Diverts no network, and forwards everything on without authenticating.
+        Network: undefined,
+        TproxyPort: undefined,
+        Auth: undefined,
+        User: undefined,
+        Pass: undefined,
       }
   }
 }

panel/src/pages/Nodes.css

@@ -196,6 +196,52 @@
   border-color: color-mix(in srgb, var(--amber) 55%, var(--groove));
   color: var(--amber);
 }
+/* "not built" — the saved switch says on and the engine has no such outbound. */
+.badge--crit {
+  border-color: color-mix(in srgb, var(--crit) 55%, var(--groove));
+  color: var(--crit);
+}
+
+/* ---- last-apply findings, attached to the row they are about ----
+   Sits under the row's own two lines, inside the row plate, so a node the
+   generator threw away cannot read as an ordinary enabled node. Severity carries
+   the colour; the accent stays reserved for controls. */
+.row-findings {
+  margin: 6px 0 0;
+  padding: 0;
+  list-style: none;
+  display: flex;
+  flex-direction: column;
+  gap: 5px;
+}
+.row-finding {
+  display: flex;
+  align-items: flex-start;
+  gap: 8px;
+  padding: 7px 9px;
+  border: 1px solid color-mix(in srgb, var(--amber) 40%, var(--groove));
+  border-radius: 6px;
+  background: color-mix(in srgb, var(--sink) 35%, transparent);
+}
+.row-finding--critical {
+  border-color: color-mix(in srgb, var(--crit) 45%, var(--groove));
+}
+.row-finding-msg {
+  flex: 1;
+  min-width: 0;
+  font-size: 12px;
+  line-height: 1.5;
+  color: var(--ink);
+  max-width: 82ch;
+  overflow-wrap: anywhere;
+}
+/* Findings that belong to no single row (see Nodes.tsx globalFindings). */
+.node-findings {
+  margin-bottom: calc(var(--u, 8px) * 2);
+}
+.node-findings .row-findings {
+  margin-top: 0;
+}
 
 /* masked-credential marker */
 .masked {
@@ -641,6 +687,20 @@ select.fp-input {
   letter-spacing: 0.06em;
   color: var(--faint);
 }
+/* A collapsed bucket has to carry its own bad news: a 300-node subscription is
+   closed by default, and the per-row findings inside it are otherwise unreachable
+   without knowing to look. */
+.group-flagged {
+  flex: none;
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  font-family: var(--font-mono);
+  font-size: 10.5px;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: var(--amber);
+}
 .group-rows {
   margin-top: 8px;
 }
@@ -727,3 +787,53 @@ select.fp-input {
     width: 9rem;
   }
 }
+
+/* ---- inline node rename ----
+   The pencil / input pair itself is shared (.inline-rename[-input] in App.css);
+   only the row-local sizing and the refusal message live here. A node name is
+   longer than a device name (it carries a protocol and a host), so the field is
+   given more room than the shared 24ch default. */
+.node-name-input {
+  max-width: 32ch;
+  font-family: var(--font-mono);
+  font-size: 12.5px;
+}
+/* Why a rename was refused, pinned under the row it was typed in. Semantic crit:
+   the name did not change, and that must not be mistaken for a saved edit. */
+.row-err {
+  margin: 2px 0 0;
+  font-size: 11.5px;
+  line-height: 1.45;
+  color: var(--crit);
+  max-width: 68ch;
+}
+/* Stated once per subscription bucket: the same rule the locked control in every
+   row carries, so the absent rename is explained before it is looked for. */
+.group-note {
+  margin: 0;
+  padding: 8px 12px;
+  border: 1px solid var(--groove);
+  border-top: 0;
+  background: color-mix(in srgb, var(--sink) 25%, transparent);
+  font-size: 11.5px;
+  line-height: 1.5;
+  color: var(--faint);
+}
+/* The optional name sits beside the link input on a wide row and drops onto its
+   own line when the row can no longer hold both. */
+.add-name {
+  flex: 0 1 22ch;
+  min-width: 12ch;
+}
+.add-row--conf .add-name {
+  flex: none;
+  align-self: stretch;
+}
+@media (max-width: 640px) {
+  .add-row {
+    flex-wrap: wrap;
+  }
+  .add-name {
+    flex: 1 1 100%;
+  }
+}

panel/src/pages/Nodes.tsx

@@ -2,16 +2,18 @@ import './Nodes.css'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import type { ReactNode } from 'react'
 import type { LedVariant } from '../components'
-import { Button, Led, Toggle } from '../components'
+import { Button, Led, Toggle, useConfirm } from '../components'
 import {
   apply as apiApply,
   getConfig,
+  getStatus,
   putConfig,
   importWg,
   updateSubscription,
   ApiError,
 } from '../api'
-import type { Model, Node as NodeCfg, Subscription } from '../api'
+import type { Model, Node as NodeCfg, StatusWarning, Subscription } from '../api'
+import { entityFindings, findingsByName } from '../findings'
 import { fmtBytes, fmtDate, fmtUntil } from '../format'
 
 // The whole page is a thin editor over the desired-state Model: every mutation
@@ -158,6 +160,222 @@ function uniqueName(base: string, taken: Set<string>): string {
   return `${seed}-${i}`
 }
 
+// ---- node names are identity, not a caption --------------------------------
+//
+// A node's Name IS its sing-box outbound tag and the only thing every reference
+// to it spells: a rule target `node:<name>`, a chain hop, a manual group's member
+// list, a resolver detour, an alert delivery, a subscription fetch detour. Rename
+// the node alone and every one of those points at nothing — and an unresolved
+// target does NOT fall back to the default route, the daemon BLOCKS that traffic.
+// So the rename either carries every reference with it, or it is refused.
+
+/** Reserved outbound tags. A node called this is skipped by the generator entirely. */
+const RESERVED_TAGS = ['direct', 'block']
+
+/**
+ * Prefixes that `model.SplitTarget` reads as a KIND, not as part of a name. A
+ * name starting with one of them makes every bare reference to it ambiguous with
+ * a real `kind:name` reference, so it is refused rather than half-supported.
+ */
+const KIND_PREFIXES = ['node', 'group', 'egress', 'chain', 'direct', 'block']
+
+/** Names are rendered into a line-oriented `uci export`; control chars are stripped there. */
+function hasControlChar(s: string): boolean {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i)
+    if (c < 0x20 || c === 0x7f) return true
+  }
+  return false
+}
+
+/**
+ * Why `name` cannot be a node name here, or null if it can.
+ *
+ * Every rule mirrors something the daemon actually does with the name, not a
+ * house style: reserved tags make generate skip the node; a duplicate makes two
+ * outbounds share a tag and the manager silently keeps the last one; a group of
+ * the same name is dropped by buildGroups ("rename the group"); an
+ * `egress-<name>` collision takes over a real egress outbound; and a control
+ * character is rewritten to a space by sanitizeUCIValue on write, so the saved
+ * name would not be the one you typed.
+ */
+function nodeNameError(
+  raw: string,
+  m: Model | null,
+  self: string | null,
+): string | null {
+  const name = raw.trim()
+  if (!name) return 'A node needs a name.'
+  if (hasControlChar(name))
+    return 'Names can’t contain line breaks or control characters — they’re stripped when the config is written.'
+  if (RESERVED_TAGS.some((t) => t.toLowerCase() === name.toLowerCase()))
+    return `“${name}” is a reserved target name — a node called that is skipped by the engine. Pick another.`
+  const head = name.includes(':') ? name.slice(0, name.indexOf(':')).toLowerCase() : ''
+  if (head && KIND_PREFIXES.includes(head))
+    return `A name starting with “${head}:” reads as a ${head} reference everywhere it’s used. Pick another.`
+  if (!m) return null
+
+  const clash = asArray(m.Nodes).find((n) => n.Name === name && n.Name !== self)
+  if (clash)
+    return clash.FromSub
+      ? `“${name}” is already a node from subscription “${clash.FromSub}”. Two nodes with one name share a single outbound — pick another.`
+      : `“${name}” is already another node. Pick another.`
+  if (asArray(m.Groups).some((g) => g.Name === name))
+    return `A group is already named “${name}”. The engine drops the group when a node takes its name — pick another.`
+  const egressClash = asArray(m.Egresses).find((e) => `egress-${e.Name}` === name)
+  if (egressClash)
+    return `“${name}” is the outbound tag of egress “${egressClash.Name}”. Pick another.`
+  return null
+}
+
+/** One place a node name is written, as a short label for the rename summary. */
+interface NodeRefSite {
+  /** Which section — drives the "N rules, M groups" count. */
+  kind: 'rule' | 'group' | 'chain' | 'resolver' | 'alert' | 'subscription' | 'egress'
+  label: string
+}
+
+/** A target/detour string naming this node in its prefixed form (`node:<name>`). */
+const isNodeRef = (v: string | undefined | null, name: string): boolean =>
+  (v ?? '') === `node:${name}`
+
+/** …or in the bare form the engine also resolves (a group member, a bare hop/target). */
+const isBareRef = (v: string | undefined | null, name: string): boolean => (v ?? '') === name
+
+/**
+ * Every place `name` is written outside the node itself. Both spellings count:
+ * `resolveTarget` falls through to a bare node lookup, and a manual group's
+ * member list is bare by contract.
+ */
+function findNodeReferences(m: Model, name: string): NodeRefSite[] {
+  const out: NodeRefSite[] = []
+  for (const r of asArray(m.Rules)) {
+    if (isNodeRef(r.Target, name) || isBareRef(r.Target, name))
+      out.push({ kind: 'rule', label: `rule “${r.Name}” target` })
+  }
+  for (const g of asArray(m.Groups)) {
+    if (asArray(g.Nodes).some((n) => n === name))
+      out.push({ kind: 'group', label: `group “${g.Name}” member` })
+  }
+  for (const c of asArray(m.Chains)) {
+    if (asArray(c.Hops).some((h) => isNodeRef(h, name) || isBareRef(h, name)))
+      out.push({ kind: 'chain', label: `chain “${c.Name}” hop` })
+  }
+  for (const r of asArray(m.Resolvers)) {
+    if (isNodeRef(r.Detour, name)) out.push({ kind: 'resolver', label: `resolver “${r.Name}” DNS path` })
+  }
+  for (const a of asArray(m.Alerts)) {
+    if (isNodeRef(a.Via, name)) out.push({ kind: 'alert', label: `alert “${a.Name}” delivery` })
+  }
+  for (const s of asArray(m.Subscriptions)) {
+    if (isNodeRef(s.FetchDetour, name))
+      out.push({ kind: 'subscription', label: `subscription “${s.Name}” fetch` })
+  }
+  // An egress does not reference a node. The loop that used to sit here read
+  // `e.Target`, a field the Go model has never had — so it was `undefined` on
+  // every egress and the branch could not fire. It read as coverage for a
+  // reference site that does not exist, which is worse than the gap it hid.
+  return out
+}
+
+/**
+ * What makes a rename impossible to carry rather than merely wide.
+ *
+ * A BARE reference is just a name; the engine resolves it node-first, then group.
+ * If something else already answers to the old name, we cannot tell which object
+ * a bare reference meant, and rewriting it would move a reference the operator
+ * never pointed at this node. That is a half-done cascade, so the rename is
+ * refused instead — with the collision named, so it can be fixed.
+ */
+function bareAmbiguity(m: Model, name: string): string | null {
+  const group = asArray(m.Groups).find((g) => g.Name === name)
+  if (!group) return null
+  const bare = [
+    ...asArray(m.Rules)
+      .filter((r) => isBareRef(r.Target, name))
+      .map((r) => `rule “${r.Name}”`),
+    ...asArray(m.Chains)
+      .filter((c) => asArray(c.Hops).some((h) => isBareRef(h, name)))
+      .map((c) => `chain “${c.Name}”`),
+  ]
+  if (bare.length === 0) return null
+  return `A group is also named “${name}”, and ${bare.join(', ')} point${bare.length === 1 ? 's' : ''} at that bare name — there is no way to tell which of the two is meant. Rename the group first, then this node.`
+}
+
+/**
+ * Rewrite every reference from `from` to `to`. Returns a NEW Model with only the
+ * touched sections replaced; the Nodes section is the caller's business.
+ *
+ * Bare references are rewritten too — that is the whole point for a manual
+ * group's member list — which is safe only because `bareAmbiguity` has already
+ * refused the one case where a bare name could mean something else.
+ */
+function renameNodeReferences(m: Model, from: string, to: string): Model {
+  if (from === to) return m
+  /** Prefixed-only sites (a detour is never spelled bare). */
+  const pfx = (v: string | undefined) => (isNodeRef(v, from) ? `node:${to}` : v)
+  /** Sites that accept either spelling — each is rewritten in the spelling it already uses. */
+  const either = (v: string | undefined) => {
+    if (isNodeRef(v, from)) return `node:${to}`
+    if (isBareRef(v, from)) return to
+    return v
+  }
+
+  const next: Model = { ...m }
+  if (m.Rules) next.Rules = m.Rules.map((r) => ({ ...r, Target: either(r.Target) }))
+  if (m.Groups)
+    next.Groups = m.Groups.map((g) => ({
+      ...g,
+      Nodes: g.Nodes ? g.Nodes.map((n) => (n === from ? to : n)) : g.Nodes,
+    }))
+  if (m.Chains)
+    next.Chains = m.Chains.map((c) => ({
+      ...c,
+      Hops: c.Hops ? c.Hops.map((h) => either(h) ?? h) : c.Hops,
+    }))
+  if (m.Resolvers) next.Resolvers = m.Resolvers.map((r) => ({ ...r, Detour: pfx(r.Detour) }))
+  if (m.Alerts) next.Alerts = m.Alerts.map((a) => ({ ...a, Via: pfx(a.Via) }))
+  if (m.Subscriptions)
+    next.Subscriptions = m.Subscriptions.map((s) => ({ ...s, FetchDetour: pfx(s.FetchDetour) }))
+  // No Egresses pass: an egress holds no node reference to rewrite (it has no
+  // Target field), and rewriting one would have WRITTEN the key onto every egress
+  // — which PUT rejects wholesale under DisallowUnknownFields.
+  return next
+}
+
+/** "3 rules, 1 group and 2 chains" — what the rename is about to rewrite. */
+function refSummary(refs: NodeRefSite[]): string {
+  const plural: Record<NodeRefSite['kind'], [string, string]> = {
+    rule: ['rule', 'rules'],
+    group: ['group', 'groups'],
+    chain: ['chain', 'chains'],
+    resolver: ['resolver', 'resolvers'],
+    alert: ['alert', 'alerts'],
+    subscription: ['subscription', 'subscriptions'],
+    egress: ['egress', 'egresses'],
+  }
+  const order: NodeRefSite['kind'][] = [
+    'rule', 'group', 'chain', 'resolver', 'alert', 'subscription', 'egress',
+  ]
+  const parts = order
+    .map((k) => [k, refs.filter((r) => r.kind === k).length] as const)
+    .filter(([, n]) => n > 0)
+    .map(([k, n]) => `${n} ${plural[k][n === 1 ? 0 : 1]}`)
+  if (parts.length === 1) return parts[0]
+  return `${parts.slice(0, -1).join(', ')} and ${parts[parts.length - 1]}`
+}
+
+/**
+ * The name a rename just committed to, waiting for its row to come back.
+ *
+ * A row is keyed by the node's NAME, so committing a rename unmounts the row and
+ * mounts a different one — carrying the focused element away with it. This baton
+ * survives that remount: the row that reappears under the new name claims it and
+ * puts the keyboard back on its own rename button, instead of dropping the user
+ * on <body> halfway down a list of 300 nodes.
+ */
+let pendingRenameFocus: string | null = null
+
 // A subscription with more than this many nodes starts collapsed so the list
 // doesn't become one endless scroll; an active search overrides it.
 const LARGE_GROUP = 20
@@ -289,6 +507,7 @@ function DetourSelect({
 // ---- page ------------------------------------------------------------------
 
 export default function Nodes() {
+  const confirm = useConfirm()
   const [config, setConfig] = useState<Model | null>(null)
   const [loadError, setLoadError] = useState<string | null>(null)
 
@@ -305,6 +524,43 @@ export default function Nodes() {
     void loadConfig()
   }, [loadConfig])
 
+  // ---- what the last apply said about these nodes ---------------------------
+  //
+  // The generator drops a node it cannot build and names it: an unparseable
+  // share link (generate/outbound.go), a name colliding with a reserved tag, a
+  // WireGuard private key materialised twice (generate/wgdedup.go). Until now
+  // this page never read /api/status, so a node the engine had thrown away
+  // rendered as an ordinary row with a green toggle — the switch said on and
+  // there was no such outbound anywhere in the running config.
+  //
+  // Findings are attached to the ROWS, not summarised at the top: a 300-node
+  // subscription makes a list of names useless, and the row is where the false
+  // reassurance was.
+  const [findings, setFindings] = useState<StatusWarning[]>([])
+  const loadFindings = useCallback(async () => {
+    try {
+      const s = await getStatus()
+      setFindings(entityFindings(s.warnings, ['node', 'subscription']))
+    } catch {
+      // Status is a supplement here, not the page. Keep the last set rather than
+      // clearing it — a dropped poll is not the same as "the problem is fixed".
+    }
+  }, [])
+  useEffect(() => {
+    void loadFindings()
+  }, [loadFindings])
+
+  const nodeFindings = useMemo(
+    () => findingsByName(findings.filter((w) => w.section === 'node')),
+    [findings],
+  )
+  const subFindings = useMemo(
+    () => findingsByName(findings.filter((w) => w.section === 'subscription')),
+    [findings],
+  )
+  // Findings about nodes/subscriptions in general, which belong to no single row.
+  const globalFindings = useMemo(() => findings.filter((w) => !w.name), [findings])
+
   // ---- toast + persistent apply banner --------------------------------------
   const [toast, setToast] = useState<string | null>(null)
   const toastTimer = useRef<number | undefined>(undefined)
@@ -359,8 +615,11 @@ export default function Nodes() {
       flash(`Apply failed — ${errText(e)}`)
     } finally {
       setApplying(false)
+      // An apply is exactly what rewrites the findings — including clearing the
+      // ones the operator just fixed.
+      void loadFindings()
     }
-  }, [flash, loadConfig])
+  }, [flash, loadConfig, loadFindings])
 
   // ---- node mutations -------------------------------------------------------
   const nodes = useMemo(() => asArray(config?.Nodes), [config])
@@ -385,6 +644,9 @@ export default function Nodes() {
   const [nodeInput, setNodeInput] = useState('')
   const [nodeErr, setNodeErr] = useState<string | null>(null)
   const [addMode, setAddMode] = useState<'link' | 'conf'>('link')
+  // Optional. Empty keeps the old behaviour (a name derived from the server
+  // address), so "paste a link, press Add" stays a two-step path.
+  const [nodeName, setNodeName] = useState('')
   const [importing, setImporting] = useState(false)
 
   // ---- node search + collapsible grouping -----------------------------------
@@ -445,8 +707,12 @@ export default function Nodes() {
       try {
         const { uri, name } = await importWg(conf)
         const taken = new Set(nodes.map((n) => n.Name))
+        // A typed name is used AS TYPED — uniqueName would silently turn a
+        // collision into "name-2", which is the confusion this field exists to
+        // end. It is validated instead, and a clash is refused out loud above.
+        const wanted = nodeName.trim()
         const node: NodeCfg = {
-          Name: uniqueName(name || 'wireguard', taken),
+          Name: wanted || uniqueName(name || 'wireguard', taken),
           Enabled: true,
           URI: uri,
           FromSub: '',
@@ -455,6 +721,7 @@ export default function Nodes() {
         const ok = await save({ ...config, Nodes: [...nodes, node] }, `Added ${node.Name}`)
         if (ok) {
           setNodeInput('')
+          setNodeName('')
           setAddMode('link')
         }
       } catch (e) {
@@ -463,11 +730,20 @@ export default function Nodes() {
         setImporting(false)
       }
     },
-    [config, nodes, save, flash],
+    [config, nodes, nodeName, save, flash],
   )
 
   const addNode = useCallback(async () => {
     if (!config) return
+    // The name is checked BEFORE the import round-trip, so a bad name costs
+    // nothing and the message lands in the form next to the field.
+    if (nodeName.trim()) {
+      const bad = nodeNameError(nodeName, config, null)
+      if (bad) {
+        setNodeErr(bad)
+        return
+      }
+    }
     // Auto-detect a pasted config, whichever input it landed in.
     if (nodeInput.includes(WG_MARKER)) {
       await addWgConf(nodeInput)
@@ -486,10 +762,20 @@ export default function Nodes() {
     const parsed = parseShareLink(uri)
     const taken = new Set(nodes.map((n) => n.Name))
     const base = parsed.suggested || `${parsed.proto.toLowerCase()}-${parsed.host}`.replace(/[^\w.:-]+/g, '-')
-    const node: NodeCfg = { Name: uniqueName(base, taken), Enabled: true, URI: uri, FromSub: '', Egress: '' }
+    const wanted = nodeName.trim()
+    const node: NodeCfg = {
+      Name: wanted || uniqueName(base, taken),
+      Enabled: true,
+      URI: uri,
+      FromSub: '',
+      Egress: '',
+    }
     const ok = await save({ ...config, Nodes: [...nodes, node] }, `Added ${node.Name}`)
-    if (ok) setNodeInput('')
-  }, [config, nodeInput, nodes, save, addMode, addWgConf])
+    if (ok) {
+      setNodeInput('')
+      setNodeName('')
+    }
+  }, [config, nodeInput, nodeName, nodes, save, addMode, addWgConf])
 
   const toggleNode = useCallback(
     (idx: number, on: boolean) => {
@@ -500,15 +786,110 @@ export default function Nodes() {
     [config, nodes, save],
   )
 
+  /**
+   * Delete a node, naming everything that still points at it.
+   *
+   * `findNodeReferences` was already here and already right — it just wasn't asked
+   * on the one path where the answer matters. A RENAME carried its references and
+   * said so; a DELETE said "This removes it from the config", which is true of the
+   * node and silent about the rule, group member, chain hop or resolver detour
+   * left spelling a name nothing answers to. That is not a cosmetic dangle: an
+   * unresolved target does not fall through to the default route, so the traffic
+   * aimed at it is blocked.
+   */
   const removeNode = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
       if (!config) return
       const target = nodes[idx]
-      if (!window.confirm(`Delete node “${target.Name}”? This removes it from the config.`)) return
+      const refs = findNodeReferences(config, target.Name)
+      const shown = refs.slice(0, 4).map((r) => r.label)
+      const more = refs.length - shown.length
+      const ok = await confirm({
+        label: 'Delete node',
+        title: `Delete node “${target.Name}”?`,
+        body:
+          refs.length === 0
+            ? 'Nothing else in the config points at it.'
+            : `${refSummary(refs)} still ${refs.length === 1 ? 'points' : 'point'} at it — ${shown.join(
+                ', ',
+              )}${
+                more > 0 ? `, and ${more} more` : ''
+              }. Nothing rewrites them, and a target that no longer resolves does not fall through to the default route: the traffic aimed at it is blocked.`,
+      })
+      if (!ok) return
       const next = nodes.filter((_, i) => i !== idx)
       void save({ ...config, Nodes: next }, `Deleted ${target.Name}`)
     },
-    [config, nodes, save],
+    [config, nodes, save, confirm],
+  )
+
+  /**
+   * Rename a manual node, carrying every reference with it.
+   *
+   * The name is this node's identity: its outbound tag, and the exact string a
+   * rule target, a chain hop, a manual group's member list, a resolver detour, an
+   * alert delivery and a subscription fetch detour all spell. So the rename is one
+   * atomic save of the Nodes section AND every referencing section, or it does not
+   * happen at all:
+   *
+   *   - an invalid or colliding name is refused with the reason (`nodeNameError`);
+   *   - a name a GROUP also answers to, with bare references pointing at it, is
+   *     refused too — there is no way to know which object those meant, and
+   *     guessing would move a reference the operator never pointed here;
+   *   - anything else is shown exactly what it will rewrite, and only then saved.
+   *
+   * Errors surface through `onError` so they land in the row that was edited.
+   */
+  const renameNode = useCallback(
+    async (idx: number, raw: string, onError: (msg: string) => void): Promise<boolean> => {
+      if (!config) return false
+      const target = nodes[idx]
+      const from = target.Name
+      const to = raw.trim()
+      if (to === from) return true
+      // Subscription names come back from the feed on the next update; renaming
+      // one would be undone without warning, so this path is manual-only.
+      if (target.FromSub) {
+        onError(`“${from}” is named by subscription “${target.FromSub}” — the feed rewrites it on the next update.`)
+        return false
+      }
+      const bad = nodeNameError(to, config, from)
+      if (bad) {
+        onError(bad)
+        return false
+      }
+      const blocked = bareAmbiguity(config, from)
+      if (blocked) {
+        onError(blocked)
+        return false
+      }
+
+      const refs = findNodeReferences(config, from)
+      if (refs.length > 0) {
+        const shown = refs.slice(0, 4).map((r) => r.label)
+        const more = refs.length - shown.length
+        const ok = await confirm({
+          tone: 'neutral',
+          label: 'Rename node',
+          title: `Rename “${from}” to “${to}”?`,
+          body: `This also updates ${refSummary(refs)} that point at it — ${shown.join(', ')}${more > 0 ? `, and ${more} more` : ''}. They are saved together, so nothing is left pointing at the old name.`,
+          confirmLabel: 'Rename',
+        })
+        if (!ok) return false
+      }
+
+      // One PUT: the node and every reference move in the same write, so no
+      // intermediate state exists where a reference dangles.
+      const carried = renameNodeReferences(config, from, to)
+      const next = asArray(carried.Nodes).map((n, i) => (i === idx ? { ...n, Name: to } : n))
+      return save(
+        { ...carried, Nodes: next },
+        refs.length > 0
+          ? `Renamed to ${to} — updated ${refs.length} reference${refs.length === 1 ? '' : 's'}`
+          : `Renamed to ${to}`,
+      )
+    },
+    [config, nodes, save, confirm],
   )
 
   // Pin (or clear) one node's dial egress. Same optimistic save→apply path as
@@ -563,16 +944,20 @@ export default function Nodes() {
   )
 
   const removeSub = useCallback(
-    (idx: number) => {
+    async (idx: number) => {
       if (!config) return
       const target = subs[idx]
       const hasCache = nodes.some((n) => n.FromSub === target.Name)
-      const extra = hasCache ? ' Its cached nodes stay until you next apply.' : ''
-      if (!window.confirm(`Delete subscription “${target.Name}”?${extra}`)) return
+      const ok = await confirm({
+        label: 'Delete subscription',
+        title: `Delete subscription “${target.Name}”?`,
+        body: hasCache ? 'Its cached nodes stay until you next apply.' : undefined,
+      })
+      if (!ok) return
       const next = subs.filter((_, i) => i !== idx)
       void save({ ...config, Subscriptions: next }, `Deleted ${target.Name}`)
     },
-    [config, subs, nodes, save],
+    [config, subs, nodes, save, confirm],
   )
 
   // Commit an options edit for one subscription. The editor hands back a fully
@@ -654,6 +1039,14 @@ export default function Nodes() {
         </div>
       )}
 
+      {/* Findings about nodes in general — no single row owns them, so they sit
+          above the lists rather than being dropped for having no name. */}
+      {globalFindings.length > 0 && (
+        <div className="node-findings">
+          <RowFindings findings={globalFindings} />
+        </div>
+      )}
+
       {/* ---- NODES ---- */}
       <div className="node-section" aria-label="Nodes">
         <header className="sec-hd">
@@ -736,6 +1129,20 @@ export default function Nodes() {
                 disabled={busy || importing || !config}
               />
             )}
+            <input
+              className="fp-input add-name"
+              type="text"
+              spellCheck={false}
+              autoComplete="off"
+              placeholder="Name (optional)"
+              aria-label="Node name — optional"
+              value={nodeName}
+              onChange={(e) => {
+                setNodeName(e.target.value)
+                if (nodeErr) setNodeErr(null)
+              }}
+              disabled={busy || importing || !config}
+            />
             <Button type="submit" variant="primary" disabled={busy || importing || !config}>
               {importing ? 'Importing…' : saving ? 'Saving…' : addMode === 'conf' ? 'Import' : 'Add node'}
             </Button>
@@ -743,7 +1150,8 @@ export default function Nodes() {
           <p className="add-hint">
             {addMode === 'conf'
               ? 'Paste a wg-quick / AmneziaWG .conf — it starts with [Interface].'
-              : 'vless://, ss://, trojan://, hysteria2://… A pasted [Interface] config is imported automatically.'}
+              : 'vless://, ss://, trojan://, hysteria2://… A pasted [Interface] config is imported automatically.'}{' '}
+            Leave the name empty and it’s taken from the server address; you can rename it later.
           </p>
         </div>
         {nodeErr && (
@@ -794,12 +1202,14 @@ export default function Nodes() {
               <NodeGroup
                 key={g.key || '__manual__'}
                 group={g}
+                findings={nodeFindings}
                 open={isGroupOpen(g)}
                 busy={busy}
                 egressNames={egressNames}
                 onToggle={() => toggleGroup(g)}
                 onToggleNode={toggleNode}
                 onRemoveNode={removeNode}
+                onRenameNode={renameNode}
                 onSetEgress={setNodeEgress}
               />
             ))}
@@ -882,6 +1292,7 @@ export default function Nodes() {
                 busy={busy}
                 catalog={detourCatalog}
                 valid={detourValid}
+                findings={subFindings.get(s.Name) ?? EMPTY_FINDINGS}
                 onToggle={(on) => toggleSub(i, on)}
                 onDelete={() => removeSub(i)}
                 onEdit={(patch) => editSub(i, patch)}
@@ -908,23 +1319,35 @@ function NodeGroup({
   open,
   busy,
   egressNames,
+  findings,
   onToggle,
   onToggleNode,
   onRemoveNode,
+  onRenameNode,
   onSetEgress,
 }: {
   group: NodeGroupData
   open: boolean
   busy: boolean
   egressNames: string[]
+  /** Last-apply findings per node name (findings.ts findingsByName). */
+  findings: Map<string, StatusWarning[]>
   onToggle: () => void
   onToggleNode: (idx: number, on: boolean) => void
   onRemoveNode: (idx: number) => void
+  onRenameNode: (idx: number, name: string, onError: (msg: string) => void) => Promise<boolean>
   onSetEgress: (idx: number, egress: string) => Promise<boolean>
 }) {
   const panelId = `node-group-${group.key || 'manual'}`
   // The same inventory count as the section header, scoped to this bucket.
   const count = useMemo(() => fmtEnabled(group.items.map((i) => i.node)), [group.items])
+  // How many nodes in this bucket the last apply had something to say about —
+  // shown on the COLLAPSED header, because a subscription of 300 nodes is
+  // collapsed by default and the row badge below would never be seen otherwise.
+  const flagged = useMemo(
+    () => group.items.filter(({ node }) => findings.has(node.Name)).length,
+    [group.items, findings],
+  )
   return (
     <section className={`node-group${open ? ' node-group--open' : ''}`}>
       <h3 className="group-hd-wrap">
@@ -938,8 +1361,20 @@ function NodeGroup({
           <span className="group-caret" aria-hidden="true" />
           <span className="group-name">{group.label}</span>
           <span className="group-count mono">{count}</span>
+          {flagged > 0 && (
+            <span className="group-flagged" title="Findings from the last apply">
+              <Led variant="amber" />
+              {flagged} flagged
+            </span>
+          )}
         </button>
       </h3>
+      {open && group.key !== '' && (
+        <p className="group-note">
+          Names come from the subscription feed and are rewritten on every update, so nodes in this
+          list can’t be renamed here.
+        </p>
+      )}
       {open && (
         <ul id={panelId} className="rows-list group-rows">
           {group.items.map(({ node, idx }) => (
@@ -948,8 +1383,10 @@ function NodeGroup({
               node={node}
               busy={busy}
               egressNames={egressNames}
+              findings={findings.get(node.Name) ?? EMPTY_FINDINGS}
               onToggle={(on) => onToggleNode(idx, on)}
               onDelete={() => onRemoveNode(idx)}
+              onRename={(name, onError) => onRenameNode(idx, name, onError)}
               onSetEgress={(egress) => onSetEgress(idx, egress)}
             />
           ))}
@@ -959,19 +1396,42 @@ function NodeGroup({
   )
 }
 
+/** One shared empty array, so a clean row doesn't get a fresh identity per render. */
+const EMPTY_FINDINGS: StatusWarning[] = []
+
+/**
+ * Did the generator say it left this entity OUT of the engine config?
+ *
+ * The producers all end the sentence with the same word — "(skipped)" for an
+ * unparseable share link or a bad WireGuard endpoint (generate/outbound.go),
+ * "skipped" for a name colliding with a reserved tag — and wgdedup says only one
+ * of the duplicates "is kept". Read the daemon's word rather than inventing a
+ * verdict: a finding that does NOT say this may well be about a node that is
+ * running perfectly, and badging it "not built" would be a new lie in place of
+ * the old one.
+ */
+function skipped(findings: StatusWarning[]): boolean {
+  return findings.some((f) => /\bskipped\b|\bis kept\b/i.test(f.message))
+}
+
 function NodeRow({
   node,
   busy,
   egressNames,
+  findings,
   onToggle,
   onDelete,
+  onRename,
   onSetEgress,
 }: {
   node: NodeCfg
   busy: boolean
   egressNames: string[]
+  /** What the last apply said about THIS node; empty when it said nothing. */
+  findings: StatusWarning[]
   onToggle: (on: boolean) => void
   onDelete: () => void
+  onRename: (name: string, onError: (msg: string) => void) => Promise<boolean>
   onSetEgress: (egress: string) => Promise<boolean>
 }) {
   const { proto, host, hasCreds } = useMemo(() => parseShareLink(node.URI), [node.URI])
@@ -982,6 +1442,68 @@ function NodeRow({
   const [open, setOpen] = useState(false)
   const panelId = `node-egress-${node.FromSub || 'manual'}-${node.Name}`
 
+  // ---- inline rename (same interaction as a device row) ---------------------
+  // Enter commits, Esc cancels, blur commits; a ref-guard keeps Esc-then-blur
+  // from committing twice. Unlike a device, the commit can be REFUSED (a name
+  // collision, or references that can't be carried), so the input stays open
+  // with the reason under it instead of closing on a change that never happened.
+  const [renaming, setRenaming] = useState(false)
+  const [draft, setDraft] = useState(node.Name)
+  const [renameErr, setRenameErr] = useState<string | null>(null)
+  const nameInput = useRef<HTMLInputElement>(null)
+  const renameBtn = useRef<HTMLButtonElement>(null)
+  const finished = useRef(false)
+
+  const beginRename = () => {
+    setDraft(node.Name)
+    setRenameErr(null)
+    finished.current = false
+    setRenaming(true)
+  }
+  const finishRename = async (commit: boolean) => {
+    if (finished.current) return
+    finished.current = true
+    const nm = draft.trim()
+    if (!commit || !nm || nm === node.Name) {
+      setRenaming(false)
+      setRenameErr(null)
+      return
+    }
+    // Armed BEFORE the save: the renamed row remounts the moment the config
+    // state lands, which is before this await resolves. Arming afterwards would
+    // always miss it.
+    pendingRenameFocus = nm
+    const ok = await onRename(nm, (msg) => setRenameErr(msg))
+    if (ok) {
+      setRenaming(false)
+      setRenameErr(null)
+    } else {
+      if (pendingRenameFocus === nm) pendingRenameFocus = null
+      // Refused — hold the field open on the rejected text so it can be fixed.
+      finished.current = false
+      nameInput.current?.focus()
+    }
+  }
+
+  useEffect(() => {
+    if (renaming) {
+      nameInput.current?.focus()
+      nameInput.current?.select()
+    }
+  }, [renaming])
+
+  // Claim the baton if this row is the one the rename produced. The row remounts
+  // while the PUT is still in flight, so on that first pass the button is still
+  // disabled and focus() would be a silent no-op — the baton is held until the
+  // save settles and this effect re-runs with a focusable button.
+  useEffect(() => {
+    if (pendingRenameFocus !== node.Name) return
+    const btn = renameBtn.current
+    if (!btn || btn.disabled) return
+    pendingRenameFocus = null
+    btn.focus()
+  }, [node.Name, busy])
+
   return (
     <li className={`row-item node-row${open ? ' node-row--open' : ''}`}>
       <div className="row-head">
@@ -993,10 +1515,83 @@ function NodeRow({
         />
         <div className="row-main">
           <div className="row-line1">
-            <span className="row-name">{node.Name}</span>
+            {renaming ? (
+              <input
+                ref={nameInput}
+                className="inline-rename-input node-name-input mono"
+                type="text"
+                spellCheck={false}
+                autoComplete="off"
+                value={draft}
+                aria-label={`Rename node ${node.Name}`}
+                aria-invalid={renameErr ? true : undefined}
+                onChange={(e) => {
+                  setDraft(e.target.value)
+                  if (renameErr) setRenameErr(null)
+                }}
+                onBlur={() => void finishRename(true)}
+                onKeyDown={(e) => {
+                  if (e.key === 'Enter') {
+                    e.preventDefault()
+                    void finishRename(true)
+                  } else if (e.key === 'Escape') {
+                    e.preventDefault()
+                    void finishRename(false)
+                  }
+                }}
+                disabled={busy}
+              />
+            ) : (
+              <>
+                <span className="row-name" title={node.Name}>
+                  {node.Name}
+                </span>
+                {managed ? (
+                  // Not hidden — withheld, with the reason attached. A control
+                  // that quietly isn't there reads as a bug; this one states the
+                  // rule, and the same sentence is on the group header above.
+                  <button
+                    type="button"
+                    className="inline-rename inline-rename--locked"
+                    disabled
+                    aria-label={`Can’t rename ${node.Name} — its name comes from subscription “${node.FromSub}” and is rewritten on the next update`}
+                    title={`Named by subscription “${node.FromSub}” — the feed rewrites this name on the next update. Rename it in the subscription, or add the node manually.`}
+                  >
+                    🔒
+                  </button>
+                ) : (
+                  <button
+                    ref={renameBtn}
+                    type="button"
+                    className="inline-rename"
+                    onClick={beginRename}
+                    disabled={busy}
+                    aria-label={`Rename node ${node.Name}`}
+                    title="Rename"
+                  >
+                    ✎
+                  </button>
+                )}
+              </>
+            )}
             <span className="badge">{proto}</span>
             {node.Stale && <span className="badge badge--warn">stale</span>}
+            {/* The toggle above is the SAVED state. When the last apply couldn't
+                build this node the engine has no such outbound, and the two
+                disagree — so the row says which, rather than leaving a green
+                switch to imply the node is carrying traffic. The word is the
+                daemon's own where it used one. */}
+            {findings.length > 0 && (
+              <span className={`badge badge--${skipped(findings) ? 'crit' : 'warn'}`}>
+                {skipped(findings) ? 'not built' : 'flagged'}
+              </span>
+            )}
           </div>
+          {renameErr && (
+            <p className="row-err" role="alert">
+              {renameErr}
+            </p>
+          )}
           <div className="row-line2 mono">
             <span className="row-host">{host}</span>
             {hasCreds && (
@@ -1014,6 +1609,7 @@ function NodeRow({
               </span>
             )}
           </div>
+          <RowFindings findings={findings} />
         </div>
         <div className="row-actions">
           {canPin && (
@@ -1133,6 +1729,7 @@ function SubRow({
   busy,
   catalog,
   valid,
+  findings,
   onToggle,
   onDelete,
   onEdit,
@@ -1143,6 +1740,8 @@ function SubRow({
   busy: boolean
   catalog: DetourCatalog
   valid: Set<string>
+  /** What the last apply said about THIS subscription; empty when it said nothing. */
+  findings: StatusWarning[]
   onToggle: (on: boolean) => void
   onDelete: () => void
   onEdit: (patch: Subscription) => Promise<boolean>
@@ -1167,6 +1766,7 @@ function SubRow({
             <span className="row-name">{sub.Name}</span>
             {sub.Format && sub.Format !== 'auto' && <span className="badge">{sub.Format}</span>}
             {sub.FetchVia === 'proxy' && <span className="badge">via proxy</span>}
+            {findings.length > 0 && <span className="badge badge--warn">flagged</span>}
           </div>
           <div className="row-line2 mono">
             <span className="row-host">{host}</span>
@@ -1179,6 +1779,7 @@ function SubRow({
               every {interval} · {count} node{count === 1 ? '' : 's'}
             </span>
           </div>
+          <RowFindings findings={findings} />
         </div>
         <div className="row-actions">
           <Button
@@ -1650,6 +2251,29 @@ function HeaderRows({
   )
 }
 
+/**
+ * What the last apply said about THIS row, under the row it is about.
+ *
+ * Deliberately inside the row rather than in a list at the top of the page: the
+ * failure being fixed is a node that looks fine, and a name in a summary three
+ * screens up does not fix that. The wording is the daemon's own — these messages
+ * already name the entity and say what was done about it ("(skipped)", "only X
+ * is kept"), so paraphrasing them here would only invent a second vocabulary.
+ */
+function RowFindings({ findings }: { findings: StatusWarning[] }) {
+  if (findings.length === 0) return null
+  return (
+    <ul className="row-findings" aria-label="Findings from the last apply">
+      {findings.map((f, i) => (
+        <li key={i} className={`row-finding row-finding--${f.severity}`}>
+          <Led variant={f.severity === 'critical' ? 'crit' : 'amber'} />
+          <span className="row-finding-msg">{f.message}</span>
+        </li>
+      ))}
+    </ul>
+  )
+}
+
 function EmptyPlate({ title, body }: { title: string; body: string }) {
   return (
     <div className="empty-plate">

panel/src/pages/Overview.tsx

@@ -4,17 +4,18 @@ import type { LedVariant } from '../components'
 import { fmtDateTime, fmtDuration } from '../format'
 import {
   apply as apiApply,
-  confirm as apiConfirm,
   rollback as apiRollback,
   getConfig,
+  getRulesReachability,
   getStats,
   ApiError,
 } from '../api'
 import type { Model, Stats, Status, StatusWarning } from '../api'
+import { confirmTimeout } from '../pendingConfirm'
 import { navigate } from '../router'
 import type { Route } from '../router'
-import { attentionFindings } from '../findings'
-import { protectionState } from '../planeState'
+import { attentionFindings, truncationNote } from '../findings'
+import { engineReadout, killSwitchReadout, protectionState } from '../planeState'
 
 // null-safe length for a Go slice that may arrive as null.
 const len = (a: unknown[] | null | undefined): number => (a ? a.length : 0)
@@ -27,7 +28,8 @@ function short(hash: string): string {
   return h.length > 12 ? h.slice(0, 12) : h
 }
 
-type ControlKind = 'apply' | 'confirm' | 'rollback'
+// Confirm is no longer one of them — see the note beside the controls row.
+type ControlKind = 'apply' | 'rollback'
 
 /**
  * Live service uptime in seconds, ticking between status polls.
@@ -42,17 +44,32 @@ type ControlKind = 'apply' | 'confirm' | 'rollback'
  * Returns null when the daemon doesn't report uptime (older builds) — the caller
  * then renders nothing rather than inventing a number.
  */
-function useUptime(status: Status | null): number | null {
+function useUptime(status: Status | null): { seconds: number; startedUnix: number } | null {
   const base = useRef<{ uptime: number; at: number } | null>(null)
+  // The instant the daemon came up, ON THE BROWSER'S CLOCK.
+  //
+  // `status.started_unix` is the router's own clock, and the router has no RTC —
+  // it runs on UTC with no tzdata. Rendering it through the browser's timezone
+  // printed a start time three hours in the FUTURE for a Moscow operator, beside
+  // an uptime of "2 h 41 min". Deriving it instead as now-minus-uptime is a
+  // difference of two client timestamps, so it is skew-proof and can never land
+  // ahead of the clock in the header.
+  const started = useRef<number | null>(null)
   const [, forceTick] = useState(0)
 
   const reported = status?.uptime_seconds
   useEffect(() => {
     if (typeof reported !== 'number' || !Number.isFinite(reported)) {
       base.current = null
+      started.current = null
       return
     }
-    base.current = { uptime: reported, at: Date.now() }
+    const now = Date.now()
+    base.current = { uptime: reported, at: now }
+    // Re-baselining every poll would jitter the displayed second back and forth;
+    // only move it when the estimate has genuinely drifted (a daemon restart).
+    const est = Math.round(now / 1000 - reported)
+    if (started.current === null || Math.abs(started.current - est) > 5) started.current = est
     forceTick((n) => n + 1)
   }, [reported])
 
@@ -64,8 +81,11 @@ function useUptime(status: Status | null): number | null {
     return () => window.clearInterval(id)
   }, [])
 
-  if (!base.current) return null
-  return base.current.uptime + Math.max(0, (Date.now() - base.current.at) / 1000)
+  if (!base.current || started.current === null) return null
+  return {
+    seconds: base.current.uptime + Math.max(0, (Date.now() - base.current.at) / 1000),
+    startedUnix: started.current,
+  }
 }
 
 export function Overview({
@@ -93,6 +113,29 @@ export function Overview({
     void loadConfig()
   }, [loadConfig])
 
+  // ---- how many rules are actually IN FORCE ----------------------------------
+  //
+  // `Rule.Enabled` from /api/config is the DESIRED state; the active WAN profile
+  // overrides it in either direction, and the daemon reports the result as
+  // `effective_enabled`. Counting the saved switches told a router running one
+  // chain that it had "2 / 2" — the Routing page had already been fixed to read
+  // the verdicts, and the home page kept summing the config beside it.
+  //
+  // null ⇒ no verdicts (older daemon, engine stopped, endpoint unreachable). The
+  // module then says so rather than passing the saved count off as the live one.
+  const [inForce, setInForce] = useState<number | null>(null)
+  const loadReach = useCallback(async () => {
+    try {
+      const { rules } = await getRulesReachability()
+      setInForce(rules.filter((r) => r.effective_enabled).length)
+    } catch {
+      setInForce(null)
+    }
+  }, [])
+  useEffect(() => {
+    void loadReach()
+  }, [loadReach])
+
   // ---- live filter stats: poll the aggregate snapshot, degrade to honest empty states ----
   const [stats, setStats] = useState<Stats | null>(null)
   useEffect(() => {
@@ -121,7 +164,7 @@ export function Overview({
     }
   }, [])
 
-  // ---- apply / confirm / rollback ----
+  // ---- apply / rollback ----
   const [busy, setBusy] = useState<ControlKind | null>(null)
   const [result, setResult] = useState<{ ok: boolean; msg: string } | null>(null)
   const [toast, setToast] = useState<string | null>(null)
@@ -139,22 +182,25 @@ export function Overview({
       setBusy(kind)
       setResult(null)
       try {
-        const fn = kind === 'apply' ? apiApply : kind === 'confirm' ? apiConfirm : apiRollback
-        const r = await fn()
+        const r = kind === 'apply' ? await apiApply() : await apiRollback()
         if (r.error) {
           setResult({ ok: false, msg: r.error })
           flash(`${kind} failed`)
         } else {
+          // An apply that changed something armed an auto-rollback, and saying
+          // "data plane reconciled" while a timer runs is how someone walks away
+          // from a config that then reverts. Name the window when there is one.
+          const window = confirmTimeout()
           const msg =
             kind === 'apply'
               ? r.changed
-                ? 'Applied — data plane reconciled'
+                ? window > 0
+                  ? `Applied — keep this config within ${window}s or it rolls back`
+                  : 'Applied — data plane reconciled'
                 : 'Applied — already up to date'
-              : kind === 'confirm'
-                ? 'Confirmed — auto-rollback cancelled'
-                : 'Rolled back to last-good config'
+              : 'Rolled back to last-good config'
           setResult({ ok: true, msg })
-          flash(kind === 'apply' ? 'Applied' : kind === 'confirm' ? 'Confirmed' : 'Rolled back')
+          flash(kind === 'apply' ? 'Applied' : 'Rolled back')
         }
       } catch (e) {
         const msg = e instanceof Error ? e.message : 'request failed'
@@ -163,24 +209,28 @@ export function Overview({
       } finally {
         setBusy(null)
         onStatusChange()
-        if (kind !== 'confirm') void loadConfig()
+        void loadConfig()
+        // An apply or a rollback is exactly what changes which rules are in force.
+        void loadReach()
       }
     },
-    [flash, loadConfig, onStatusChange],
+    [flash, loadConfig, loadReach, onStatusChange],
   )
 
   // ---- service uptime (PROCESS uptime, not "time since the last apply") ----
   const uptime = useUptime(status)
-  const uptimeText = uptime === null ? '' : fmtDuration(uptime)
-  const startedAt = status?.started_unix ? fmtDateTime(status.started_unix) : ''
+  const uptimeText = uptime === null ? '' : fmtDuration(uptime.seconds)
+  // On YOUR clock, derived from the uptime — never `status.started_unix`, which is
+  // the router's clock and has no timezone to convert from. See useUptime.
+  const startedAt = uptime === null ? '' : fmtDateTime(uptime.startedUnix)
 
   // ---- derived display state ----
   const g = config?.Globals
-  // The LIVE kill-switch from /api/status wins over the saved config: this is a
-  // status readout, so it must describe what is actually installed. Reading the
-  // config here let the strip claim "fail-closed" while an apply-time finding
-  // said the running plane was fail-open — two truths on one screen.
-  const killArmed = (status?.kill_switch ?? g?.KillSwitch ?? 'closed') === 'closed'
+  // There is deliberately no local `killArmed` any more. The page asked the same
+  // question twice — once here and once inside killSwitchReadout — and the local
+  // copy was the poorer of the two: it compared the raw string (so "Closed" read
+  // as fail-OPEN) and it was a boolean, which cannot say "the configuration could
+  // not be read". Both answers now come from the readout below.
   // Offer rollback only when the daemon has something to revert to (armed
   // commit-confirm snapshot or an engine last-good); otherwise hide the control.
   const canRollback = status?.can_rollback ?? false
@@ -251,24 +301,27 @@ export function Overview({
       ? `${worstGroup.group} — no answer`
       : `${worstGroup.group} — ${worstGroup.dead} down`
 
-  const engineVariant: LedVariant = !status
-    ? 'off'
-    : status.running && status.active
-      ? 'on'
-      : status.running
-        ? 'amber'
-        : 'crit'
+  // One reading for the engine, and it is able to say "stopped": `status.running`
+  // was a constant `true` on the daemon, so this LED could never go crit and the
+  // Engine module was green through a process that had failed to start. See
+  // planeState.engineState.
+  const engine = engineReadout(status)
+  const engineVariant: LedVariant = engine.variant
 
   const protection = protectionState(status)
-  // Configured fail-closed AND actually enforcing it. `none` means nothing is
-  // installed, so the setting is inert no matter what it says.
-  const killInEffect = killArmed && status?.plane !== 'none'
+  // Configured fail-closed, actually enforcing it, or not known — three answers,
+  // and the third is not folded into the first. See planeState.killSwitchReadout.
+  const kill = killSwitchReadout(status, g?.KillSwitch)
 
   // Findings that need attention. `info` notes are statements about the config,
   // not problems, so they live beside the setting they describe (see findings.ts)
   // — keeping this list to things someone could actually act on.
   const warnings = attentionFindings(status?.warnings)
   const criticalCount = warnings.filter((w) => w.severity === 'critical').length
+  // The daemon caps the published list at 50 and says so in an `info` note — the
+  // one channel this page filters away. Carried separately so the list can admit
+  // it is not the whole list. See findings.ts truncationNote.
+  const truncated = truncationNote(status?.warnings)
 
   return (
     <section className="page" aria-label="Overview">
@@ -291,7 +344,7 @@ export function Overview({
         </p>
       )}
 
-      <Findings warnings={warnings} criticalCount={criticalCount} />
+      <Findings warnings={warnings} criticalCount={criticalCount} truncated={truncated} />
 
       <div className="grid">
         {/* Groups, not nodes: a group is where a dial path is defined, so it is the
@@ -334,14 +387,31 @@ export function Overview({
           />
         )}
 
+        {/* "N / M in force", the same reading the Routing page shows — never the
+            count of saved switches. The lamp follows the same rule: a table of
+            rules none of which are in force routes exactly nothing, and it used
+            to sit under a green light saying "0 / 7". */}
         <Module
           name="Routing"
-          value={String(enabledCount(config?.Rules))}
-          unit={`/ ${len(config?.Rules)} rules`}
-          led={{ variant: len(config?.Rules) ? 'on' : 'amber' }}
+          value={inForce === null ? String(enabledCount(config?.Rules)) : String(inForce)}
+          unit={
+            inForce === null
+              ? `/ ${len(config?.Rules)} rules saved`
+              : `/ ${len(config?.Rules)} in force`
+          }
+          led={{
+            variant:
+              len(config?.Rules) === 0
+                ? 'amber'
+                : inForce === null
+                  ? 'off'
+                  : inForce === 0
+                    ? 'amber'
+                    : 'on',
+          }}
           rows={[
             { k: 'egresses', v: String(len(config?.Egresses)) },
-            { k: 'default', v: defaultTarget(config), hot: true },
+            { k: 'default', v: defaultTarget(status, config), hot: true },
           ]}
         />
 
@@ -381,17 +451,21 @@ export function Overview({
         />
 
         {/* A kill-switch set to fail-closed is only ARMED if something is actually
-            installed to enforce it. With no plane it is configured but inert, and
-            saying "ARMED" there would be a false reassurance next to a readout
-            that says nothing is protected. */}
+            installed to enforce it, and "we haven't been told" is neither. With no
+            plane it is configured but inert; with no reading the lamp stays unlit
+            rather than joining the healthy branch by default. */}
         <Module
           name="Kill-switch"
-          value={killInEffect ? 'ARMED' : killArmed ? 'NOT IN EFFECT' : 'OPEN'}
-          led={{ variant: killInEffect ? 'on' : killArmed ? 'crit' : 'amber' }}
+          value={kill.value}
+          led={{ variant: kill.variant }}
           rows={[
-            { k: 'setting', v: killArmed ? 'fail-closed' : 'fail-open', hot: !killArmed },
-            ...(killArmed && !killInEffect
-              ? [{ k: 'blocking now', v: 'no — nothing installed', hot: true }]
+            // From the readout, not from a second local comparison: the old
+            // `killArmed ? 'fail-closed' : 'fail-open'` had no third answer, so an
+            // unreadable configuration printed a confident "fail-closed" beneath a
+            // lamp that said NOT REPORTED. See planeState.killSwitchReadout.
+            { k: 'setting', v: kill.setting, hot: kill.settingHot },
+            ...(kill.blockingNow
+              ? [{ k: 'blocking now', v: kill.blockingNow, hot: kill.hot }]
               : [{ k: 'ipv6', v: g?.IPv6 ? 'covered' : 'off' }]),
             { k: 'confirm', v: g?.ConfirmTimeout ? `${g.ConfirmTimeout}s window` : 'no auto-rollback' },
           ]}
@@ -414,6 +488,7 @@ export function Overview({
           unit={status?.version?.includes('-') ? '· ' + status.version.split('-').slice(1).join('-') : ''}
           led={{ variant: engineVariant }}
           rows={[
+            { k: 'process', v: engine.word, hot: engineVariant === 'crit' },
             { k: 'config hash', v: <span className="mono">{short(status?.hash ?? '')}</span> },
             // Uptime of the daemon PROCESS. "started" is the moment it came up,
             // by the router's clock — not the moment a config was applied.
@@ -431,9 +506,14 @@ export function Overview({
           <Button variant="primary" onClick={() => void run('apply')} disabled={busy !== null}>
             {busy === 'apply' ? 'Applying…' : 'Apply config'}
           </Button>
-          <Button onClick={() => void run('confirm')} disabled={busy !== null}>
-            {busy === 'confirm' ? 'Confirming…' : 'Confirm'}
-          </Button>
+          {/* A "Confirm" button used to sit here permanently, and pressing it
+              always printed "Confirmed — auto-rollback cancelled": `apply.Confirm()`
+              returns nil whether or not a window was ever armed, so the message was
+              a success report for an event that usually had not happened.
+              Keeping a config is now offered only while a window is actually open,
+              and that is announced by the app-wide band directly above this page —
+              which is where the button lives, beside the countdown it belongs to,
+              rather than duplicated here. */}
           {canRollback && (
             <Button onClick={() => void run('rollback')} disabled={busy !== null}>
               {busy === 'rollback' ? 'Rolling back…' : 'Rollback'}
@@ -464,11 +544,23 @@ const SECTION_ROUTE: Record<string, Route> = {
   rule: 'routing',
   ruleset: 'routing',
   blocklist: 'dns',
+  allowlist: 'dns',
   resolver: 'dns',
+  dns_rule: 'dns',
   device: 'devices',
   chain: 'targets',
   group: 'targets',
+  // A node the generator dropped (unparseable share link, duplicate WireGuard
+  // key, name colliding with a reserved tag) is reported under `node` — and had
+  // nowhere to jump to, so the one page that could show it a green toggle was
+  // also the one page the finding could not reach.
+  node: 'nodes',
+  subscription: 'nodes',
+  egress: 'targets',
+  inbound: 'networks',
   interface: 'networks',
+  profile: 'profiles',
+  alert: 'settings',
   // The standing note about non-TCP/UDP traffic — its control lives on Networks.
   untunnelable: 'networks',
 }
@@ -486,11 +578,14 @@ const SECTION_ROUTE: Record<string, Route> = {
 function Findings({
   warnings,
   criticalCount,
+  truncated,
 }: {
   warnings: StatusWarning[]
   criticalCount: number
+  /** The daemon's "N further suppressed" note, when the list was capped. */
+  truncated: StatusWarning | null
 }) {
-  if (warnings.length === 0) return null
+  if (warnings.length === 0 && !truncated) return null
 
   const rank = { critical: 0, warning: 1, info: 2 } as const
   const sorted = [...warnings].sort((a, b) => rank[a.severity] - rank[b.severity])
@@ -500,6 +595,10 @@ function Findings({
       <header className="findings-hd">
         <h2 className="findings-title">Last apply</h2>
         <span className="findings-count mono">
+          {/* "at least" whenever the list was capped: the counts below it are a
+              floor, not a total, and the cap drops the least severe FIRST — so
+              on a config with fifty criticals the thing it drops is a critical. */}
+          {truncated ? 'at least ' : ''}
           {criticalCount > 0
             ? `${criticalCount} critical · ${warnings.length} total`
             : `${warnings.length} note${warnings.length === 1 ? '' : 's'}`}
@@ -538,6 +637,20 @@ function Findings({
             </li>
           )
         })}
+        {/* The list saying it is not the whole list. Last, because it is about
+            everything above it — and never filtered out with the other `info`
+            notes, which is where it used to disappear. */}
+        {truncated && (
+          <li className="finding finding--truncated">
+            <Led variant="amber" />
+            <div className="finding-copy">
+              <span className="finding-where mono">list truncated</span>
+              <span className="finding-msg">
+                Some findings are missing from this list. {truncated.message}
+              </span>
+            </div>
+          </li>
+        )}
       </ul>
     </section>
   )
@@ -563,12 +676,20 @@ const NAV_LABEL: Record<Route, string> = {
 // for the apply/rollback flow, where the individual flags are the actual
 // subject of the page.)
 
-function defaultTarget(config: Model | null): string {
-  const rules = config?.Rules ?? []
-  if (rules.length === 0) return '—'
-  // The highest Order enabled rule is the effective catch-all.
-  const enabled = rules.filter((r) => r.Enabled)
-  if (enabled.length === 0) return 'none'
-  const last = enabled.reduce((a, b) => (b.Order >= a.Order ? b : a))
-  return last.Target || last.Egress || last.Name
+/** Where everything not matched by a rule goes — the engine's route `final`.
+ *
+ *  Taken from the daemon (status.traffic.default), which reads it off the config
+ *  it is running. The guess this replaced was "the highest-Order enabled rule",
+ *  and that is not what the default is: a rule only becomes the default by having
+ *  NO conditions at all, whatever its Order (model.IsCatchAll), so a specific
+ *  high-Order rule was routinely printed here as the router's default. It also
+ *  described the config on disk rather than the one running, and could not see a
+ *  target that failed to resolve and fell back.
+ *
+ *  Falls back to the rule count only when the daemon has not reported — never to
+ *  a guess about where traffic goes. */
+function defaultTarget(status: Status | null, config: Model | null): string {
+  const d = status?.traffic?.default
+  if (d) return d
+  return len(config?.Rules) === 0 ? '—' : 'not reported'
 }

panel/src/pages/Profiles.tsx

@@ -1,6 +1,6 @@
 import './Profiles.css'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { Button, Led, Toggle } from '../components'
+import { Button, Led, Toggle, useConfirm } from '../components'
 import { apply as apiApply, getConfig, getInterfaces, putConfig, ApiError } from '../api'
 import type { Interface, Model, Profile } from '../api'
 
@@ -36,6 +36,7 @@ function namesOf(v: unknown): string[] {
 // ---- page ------------------------------------------------------------------
 
 export default function Profiles() {
+  const confirm = useConfirm()
   const [config, setConfig] = useState<Model | null>(null)
   const [loadError, setLoadError] = useState<string | null>(null)
 
@@ -192,9 +193,14 @@ export default function Profiles() {
   )
 
   const deleteProfile = useCallback(
-    (name: string) => {
+    async (name: string) => {
       if (!config) return
-      if (!window.confirm(`Delete profile “${name}”? Its overrides stop applying.`)) return
+      const ok = await confirm({
+        label: 'Delete profile',
+        title: `Delete profile “${name}”?`,
+        body: 'Its overrides stop applying.',
+      })
+      if (!ok) return
       const next = profiles.filter((p) => p.Name !== name)
       const g =
         config.Globals.ActiveProfile === name
@@ -202,7 +208,7 @@ export default function Profiles() {
           : config.Globals
       void save({ ...config, Profiles: next, Globals: g }, `Deleted ${name}`)
     },
-    [config, profiles, save],
+    [config, profiles, save, confirm],
   )
 
   // ---- expansion (only one profile editor open at a time) -------------------

panel/src/pages/Routing.css

@@ -58,6 +58,45 @@
   color: var(--ink);
 }
 
+/* ---- active-profile banner ----
+ *
+ * Deliberately NOT the accent plate the save→apply bar wears above. Orange is
+ * "there is something for you to do" on this faceplate, and an active WAN profile
+ * is a standing condition, not a pending action. A quiet plate with an amber tag
+ * reads as "note the state" — and it is the SAME amber the overridden rows below
+ * carry, so the banner and its rows are visibly one story rather than two
+ * unrelated oddities. */
+.rt-prof-banner {
+  display: flex;
+  align-items: flex-start;
+  gap: 10px;
+  margin: 0 0 calc(var(--u, 8px) * 2.5);
+  padding: 10px 14px;
+  border: 1px solid color-mix(in srgb, var(--amber) 35%, var(--groove));
+  border-radius: 8px;
+  background: color-mix(in srgb, var(--amber) 7%, transparent);
+  font-family: var(--font-sans);
+  font-size: 12px;
+  line-height: 1.55;
+  color: var(--dim);
+}
+.rt-prof-banner strong {
+  color: var(--ink);
+  font-weight: 600;
+}
+.rt-prof-tag {
+  flex: none;
+  margin-top: 1px;
+  padding: 2px 7px;
+  border: 1px solid color-mix(in srgb, var(--amber) 55%, var(--groove));
+  border-radius: 999px;
+  background: color-mix(in srgb, var(--amber) 12%, transparent);
+  font-size: 9px;
+  letter-spacing: var(--track-label);
+  text-transform: uppercase;
+  color: var(--amber);
+}
+
 /* ---- empty state ---- */
 .rt-empty {
   padding: calc(var(--u, 8px) * 4) 0 calc(var(--u, 8px) * 3);
@@ -289,6 +328,51 @@
   opacity: 0.62;
 }
 
+/* ---- a rule the active WAN profile overrides ----
+ *
+ * The row itself needs no new paint: an overridden-off rule already wears `.off`
+ * (it is off, whatever its switch says) and an overridden-on rule wears nothing
+ * (it is on). What was missing was never colour — it was the sentence naming who
+ * decided. So this is the per-row twin of the banner and borrows .rt-dead-note's
+ * type wholesale: same voice, same size, one <p> margin to reset. */
+/* The same pill as .rt-badge.dead, so the two override states read as one pair,
+ * but in accent — a rule the profile forces ON is active, and active is orange on
+ * this faceplate. The pill is also what keeps it from running into the plain
+ * "default route · final" badge beside it, where "final on · by profile" read as
+ * one phrase. */
+.rt-badge.prof-on {
+  padding: 1px 7px;
+  border: 1px solid var(--accent-soft);
+  border-radius: 999px;
+  background: color-mix(in srgb, var(--accent) 10%, transparent);
+}
+
+.rt-prof-note {
+  margin: 0;
+}
+.rt-prof-note strong {
+  color: var(--ink);
+  font-weight: 600;
+}
+
+/* Switch + its legend. The caption shows ONLY while a profile overrides the rule,
+ * and it is what keeps the control honest: the plate says what the router is
+ * doing, this says the switch is about the saved setting. A legend under the
+ * control it names is the faceplate's own idiom. */
+.rt-switch {
+  display: inline-flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 3px;
+}
+.rt-switch-note {
+  font-family: var(--font-mono);
+  font-size: 8.5px;
+  letter-spacing: var(--track-label);
+  text-transform: uppercase;
+  color: var(--faint);
+}
+
 /* ---- target chip (styled like the artifact's group:auto mono chips) ---- */
 .rt-target {
   display: inline-flex;
@@ -396,9 +480,6 @@
   gap: 5px;
   min-width: 0;
 }
-.rt-field-wide {
-  grid-column: span 2;
-}
 .rt-flabel {
   font-family: var(--font-mono);
   font-size: 9px;
@@ -515,6 +596,8 @@ select.rt-input {
   border-color: var(--accent);
   box-shadow: 0 1px 0 var(--edge) inset, 0 0 0 1px var(--accent-soft);
 }
+/* "no matchers" flag in the plate foot — shared by BOTH rule forms (add and
+ * edit), so the same non-blocking warning reads identically in either. */
 .rt-edit-warn {
   font-family: var(--font-mono);
   font-size: 11.5px;
@@ -837,9 +920,6 @@ select.rt-input {
     justify-content: flex-start;
     align-self: start;
   }
-  .rt-field-wide {
-    grid-column: auto;
-  }
   .rt-rs-row {
     grid-template-columns: 1fr;
     row-gap: 10px;

panel/src/pages/Settings.tsx

@@ -1,9 +1,11 @@
 import './Settings.css'
 import { useCallback, useEffect, useRef, useState } from 'react'
 import type { ReactNode } from 'react'
-import { Button, Led, Select, Toggle } from '../components'
+import { Button, Led, Select, Toggle, useConfirm } from '../components'
+import { AlertsSection } from './Alerts'
 import { apply as apiApply, downloadLog, getConfig, putConfig, ApiError } from '../api'
 import type { Globals, LogRange, Model } from '../api'
+import { killSwitchClosed } from '../planeState'
 
 // The Settings page is a thin editor over the desired-state Model's Globals —
 // same save→apply split as DNS.tsx: every edit rewrites model.Globals in-place,
@@ -116,15 +118,24 @@ const LOG_LEVELS: ReadonlyArray<{ value: string; label: string }> = [
 // Logging/stats backend. "off" collects nothing; "memory" keeps aggregates in RAM
 // (lost on restart); "sqlite" persists logs to /etc/shater/stats.db so they survive
 // a restart, bounded by the retention row caps + the disk-limit knob below.
+//
+// THE VALUE `sqlite` IS A HISTORICAL NAME AND THE LABELS NO LONGER REPEAT IT. There
+// is no SQLite in the daemon: the store is bbolt (stats/boltring.go) — pure Go, no
+// CGO, already linked into the binary via experimental/cachefile — and it was chosen
+// precisely to be rid of "the stop-the-world window the sqlite VACUUM used to
+// impose", in that file's own words. The wire value has to stay (it is in every
+// shipped config, and the daemon still matches on it); what the operator READS
+// should describe where the logs go, which is the disk.
 const STATS_BACKENDS: ReadonlyArray<{ value: string; label: string }> = [
   { value: 'off', label: 'Off — no logging' },
   { value: 'memory', label: 'Memory (RAM)' },
-  { value: 'sqlite', label: 'SQLite · persistent' },
+  { value: 'sqlite', label: 'Disk · survives a restart' },
 ]
 
 // ---- page ------------------------------------------------------------------
 
 export default function Settings() {
+  const confirm = useConfirm()
   const [config, setConfig] = useState<Model | null>(null)
   const [loadError, setLoadError] = useState<string | null>(null)
 
@@ -217,14 +228,16 @@ export default function Settings() {
   const ringUnlimited = (globals?.StatsRingSize ?? 0) === 0
   const timelineUnlimited = (globals?.StatsTimelineMinutes ?? 0) === 0
   const domainsUnlimited = (globals?.StatsMaxDomains ?? 0) === 0
-  // SQLite disk cap: 0 = unlimited (stats.db grows with the disk).
+  // Disk cap: 0 = unlimited (stats.db grows with the disk).
   const diskUnlimited = (globals?.StatsDiskLimitMB ?? 0) === 0
 
   // Logging backend. Default "memory" when the field is absent (older config). When
   // "off", nothing is collected, so the retention sizes below don't apply — dim them.
   const statsBackend = globals?.StatsBackend || 'memory'
   const loggingOff = statsBackend === 'off'
-  const loggingSqlite = statsBackend === 'sqlite'
+  // The wire value is still `sqlite` (historical — see STATS_BACKENDS); the store
+  // is bbolt on disk, so everything the operator reads calls it the disk backend.
+  const loggingDisk = statsBackend === 'sqlite'
   // Retention controls are meaningless with logging off; disable them there.
   const retentionDisabledCtl = busy || !ready || loggingOff
 
@@ -256,11 +269,63 @@ export default function Settings() {
   // the Targets page. Absent ⇒ enabled (older config), so read it as `!== false`.
   const groupHealthOn = globals?.GroupHealth !== false
 
-  const killSwitch = globals?.KillSwitch === 'open' ? 'open' : 'closed'
+  // Normalised the daemon's way (planeState.killSwitchClosed), not by string
+  // equality: `kill_switch 'OPEN'` is fail-OPEN on the router, and `=== 'open'`
+  // read it as closed — the panel would have drawn the protective setting over a
+  // router that has none.
+  const killSwitch = killSwitchClosed(globals?.KillSwitch) ? 'closed' : 'open'
+
+  /**
+   * The master switch, which is the most destructive control in the panel and was
+   * the only one that asked nothing.
+   *
+   * Turning it off is not "pausing the proxy": apply.go runs Teardown() — the nft
+   * table goes, the policy routing goes, `plane` becomes `none`. The kill-switch
+   * does not save you, because a kill-switch is a rule in a table that no longer
+   * exists. Everything on the LAN then leaves through the plain WAN, unproxied and
+   * unfiltered. Deleting a rule-set asked for confirmation; this did not.
+   *
+   * Turning it back ON is not destructive and is not gated.
+   */
+  const toggleService = useCallback(
+    async (on: boolean) => {
+      if (!on) {
+        const ok = await confirm({
+          label: 'Turn off the service',
+          title: 'Turn the proxy engine off?',
+          body: (
+            <>
+              This tears the whole data plane down — the firewall table, the policy routing and the
+              DNS interception are removed, not paused. Nothing is proxied, filtered or blocked, and
+              every device leaves through your normal internet connection with its real address.{' '}
+              {killSwitch === 'closed' ? (
+                <>
+                  The kill-switch does not hold here: with nothing installed there is nothing left
+                  to block with.
+                </>
+              ) : (
+                <>The kill-switch is already open, so nothing changes about that.</>
+              )}
+            </>
+          ),
+          confirmLabel: 'Turn it off',
+        })
+        if (!ok) return
+      }
+      setGlobal('Enabled', on, on ? 'Engine enabled' : 'Engine disabled')
+    },
+    [confirm, killSwitch, setGlobal],
+  )
+  // "so nothing leaks unproxied" claimed more than the holding plane promises.
+  // netplane/nft.go states its own contract as "No client TRAFFIC reaches the WAN"
+  // and names the exception in the same paragraph: clients still reach the router's
+  // resolver and dnsmasq forwards those lookups to the ISP in the clear. It cannot
+  // be closed — blocking it would also cut the daemon's own name resolution, and
+  // with it any chance of recovering unattended.
   const killNote =
     killSwitch === 'open'
       ? 'Fail-open — if the engine stops, traffic falls back to the direct WAN. Stays online, but unprotected.'
-      : 'Fail-closed — if the engine stops, LAN→WAN is blocked so nothing leaks unproxied.'
+      : 'Fail-closed — if the engine stops, LAN→WAN is blocked so no traffic from your devices reaches the internet. DNS is the exception: lookups sent to the router still go out to your provider in the clear, which is what lets the router recover on its own.'
 
   const loading = config === null && loadError === null
 
@@ -296,10 +361,13 @@ export default function Settings() {
         <div className="set-groups">
           {/* ---- SERVICE ---- */}
           <Group title="Service" count={globals?.Enabled ? 'enabled' : 'disabled'}>
-            <Field label="Proxy engine" note="Master on/off for the whole appliance.">
+            <Field
+              label="Proxy engine"
+              note="Master on/off for the whole appliance. Off removes the firewall table and the policy routing — every device goes out directly, with no kill-switch to catch it."
+            >
               <Toggle
                 pressed={globals?.Enabled ?? false}
-                onChange={(on) => setGlobal('Enabled', on, on ? 'Engine enabled' : 'Engine disabled')}
+                onChange={(on) => void toggleService(on)}
                 label={globals?.Enabled ? 'Disable proxy engine' : 'Enable proxy engine'}
                 size="md"
                 disabled={busy || !ready}
@@ -328,7 +396,16 @@ export default function Settings() {
 
             <Field
               label="Panel port"
-              note="Admin-panel port. 0 uses the default 8088. A change needs a restart to rebind."
+              // "needs a restart to rebind" read as a promise that the rebind
+              // happens. It is not one the panel can make: cmd/shaterd/main.go
+              // treats a failed panel listen as `logger.Warn("panel server
+              // unavailable (daemon continues)")` and carries on — the daemon keeps
+              // routing traffic and the panel simply is not there. Nothing reports
+              // it in the UI either, because the UI is what went missing, and
+              // `status.panel_port` keeps naming the CONFIGURED port regardless
+              // (which is also what LuCI builds its "Open panel" button from). So
+              // the note names the failure and where the answer actually is.
+              note="Admin-panel port. 0 uses the default 8088. A change takes effect on restart — and if the new port is already taken the panel does not come back at all: the daemon keeps running and only says so in its log."
             >
               <InlineEdit<number>
                 value={globals?.PanelPort ?? 0}
@@ -360,7 +437,7 @@ export default function Settings() {
 
             <Field
               label="Log level"
-              note="Verbosity of the daemon log. “none” silences the engine and drops the control-plane to panic-only — a turn-down, not a true off: even warnings and errors are hidden. The toggles below decide where whatever is emitted gets written; turning both off is the only full silence. Failures still raise alerts regardless of this level."
+              note="Verbosity of the daemon log. “none” silences the engine and drops the control-plane to panic-only — a turn-down, not a true off: even warnings and errors are hidden. The toggles below decide where whatever is emitted gets written; turning both off is the only full silence. Failures still raise alerts regardless of this level — set up where they go in the Alerts section below."
             >
               <Select
                 value={globals?.LogLevel || 'warning'}
@@ -574,6 +651,13 @@ export default function Settings() {
             </Field>
           </Group>
 
+          {/* ---- ALERTS ---- */}
+          {/* Extracted from the DNS page — out-of-band notifications belong with
+              the appliance-wide knobs, next to the log level whose note points
+              here. Renders its own section header (same plate as a Group); all
+              writes go through `save`, so the dirty banner and toast stay one. */}
+          <AlertsSection config={config} busy={busy} loading={loading} onSave={save} />
+
           {/* ---- STATISTICS & LOGGING ---- */}
           <Group
             title="Statistics &amp; logging"
@@ -581,7 +665,7 @@ export default function Settings() {
           >
             <Field
               label="Logging backend"
-              note="Off: collect nothing. Memory: fast, lost on restart, RAM-bounded. SQLite: survives restart, disk-bounded."
+              note="Off: collect nothing. Memory: fast, lost on restart, RAM-bounded. Disk: survives a restart, disk-bounded."
             >
               <Select
                 value={statsBackend}
@@ -596,7 +680,7 @@ export default function Settings() {
                     v === 'off'
                       ? 'Logging off — collecting nothing'
                       : v === 'sqlite'
-                        ? 'Logging backend → SQLite (persistent)'
+                        ? 'Logging backend → disk (survives a restart)'
                         : 'Logging backend → memory',
                   )
                 }
@@ -609,13 +693,13 @@ export default function Settings() {
                 Insights page shows an off state. The retention limits below apply once logging
                 is turned back on.
               </p>
-            ) : loggingSqlite ? (
+            ) : loggingDisk ? (
               <p className="set-group-note">
                 Logs persist to <span className="mono">/etc/shater/stats.db</span> and survive a
                 restart. The <strong>entries</strong> limit below caps rows kept per log table; the{' '}
-                <strong>disk limit</strong> caps the whole <span className="mono">stats.db</span>{' '}
-                file (oldest rows are pruned to stay under it). Set any size to <strong>0</strong>{' '}
-                for <strong>Unlimited</strong>.
+                <strong>disk limit</strong> aims the whole <span className="mono">stats.db</span>{' '}
+                file at a size (oldest rows are deleted and the file rebuilt to stay near it). Set
+                any size to <strong>0</strong> for <strong>Unlimited</strong>.
               </p>
             ) : (
               <p className="set-group-note">
@@ -652,10 +736,16 @@ export default function Settings() {
               </p>
             )}
 
-            {loggingSqlite && (
+            {loggingDisk && (
               <Field
-                label="SQLite disk limit (MB) (0 = unlimited)"
-                note="Hard cap on the on-disk stats.db file. A positive number is the ceiling — oldest rows are pruned and the DB vacuumed to stay under it; 0 lets it grow with the disk."
+                label="Disk limit (MB) (0 = unlimited)"
+                // Was: "oldest rows are pruned and the DB vacuumed". There is no
+                // SQLite and no VACUUM here — the store is bbolt, and reclaiming
+                // space means rebuilding the file (bbolt.Compact + atomic swap).
+                // The rebuild is SKIPPED when the filesystem cannot fit the
+                // transient second copy, so "ceiling" was a promise too: the DB
+                // then sits over the cap until space frees up. Both are said.
+                note="Target size for the on-disk stats.db file. Above it, the oldest rows are deleted and the file is rebuilt to give the space back — the rebuild needs room for a temporary second copy, so on a full disk the file stays over the limit until space frees up. 0 lets it grow with the disk."
               >
                 <InlineEdit<number>
                   value={globals?.StatsDiskLimitMB ?? 0}
@@ -665,7 +755,7 @@ export default function Settings() {
                   inputMode="numeric"
                   width="9rem"
                   placeholder="Unlimited"
-                  ariaLabel="SQLite disk limit in MB (0 = unlimited)"
+                  ariaLabel="Stats database disk limit in MB (0 = unlimited)"
                   busy={busy}
                   disabled={retentionDisabledCtl}
                   onCommit={(v) =>
@@ -674,7 +764,7 @@ export default function Settings() {
                 />
               </Field>
             )}
-            {loggingSqlite && diskUnlimited && (
+            {loggingDisk && diskUnlimited && (
               <p className="set-warn" role="status">
                 Unlimited — stats.db grows with disk; set a cap (MB) to bound it.
               </p>

panel/src/pages/Targets.css

@@ -704,6 +704,13 @@
 .tg-test--bad .tg-test-msg {
   color: var(--crit);
 }
+/* "Nothing measured this" is not a failure and must never be dressed as one: an
+   unlit lamp and the faintest text on the card, the same register the group
+   readout uses for its unmeasured state. */
+.tg-test--none .tg-test-msg {
+  font-family: var(--font-sans);
+  color: var(--faint);
+}
 .tg-test--wait .tg-test-msg {
   color: var(--amber);
 }
@@ -1038,6 +1045,235 @@
 }
 
 /* ---- responsive ---- */
+/* ---- chain hop rail ----
+ * The chain section's signature, and the one place this card spends any
+ * boldness: the path is drawn as a CONDUCTOR with a numbered lamp at each hop,
+ * and the conductor is SEVERED below the first hop that was probed and did not
+ * answer. A chain is a single series path, so the question is never "how many
+ * hops are green", it is "where does my traffic stop" — and a broken line answers
+ * that before a word has been read.
+ *
+ * The two marks carry two different facts and must not be conflated:
+ *   - the LAMP is that hop's own measurement (good / warn / crit / unlit). Below
+ *     the break there is no measurement to draw: the daemon stops walking at the
+ *     first dead hop, so those lamps are UNLIT and the row says which hop stopped
+ *     the walk. Unlit is never a shade of red — it claims nothing, which is the
+ *     truth about a hop nobody dialled;
+ *   - the CONDUCTOR is reachability through the path, which really does stop.
+ *
+ * Orange is untouched here. Semantics carry every colour, and everything that is
+ * not a lamp is groove-grey. No transitions and no animation anywhere in the
+ * rail, so there is nothing for reduced-motion to switch off. */
+.ch-rail {
+  gap: 8px;
+}
+.ch-eyebrow {
+  font-family: var(--font-mono);
+  font-size: 9px;
+  letter-spacing: var(--track-label);
+  text-transform: uppercase;
+  color: var(--faint);
+}
+.ch-hops {
+  --ch-num: 1.8ch; /* the engraved hop number's gutter */
+  --ch-gap: 8px;
+  --ch-led: 10px; /* must match .led's width */
+  --ch-lampy: 14px; /* row top → lamp centre; the conductor's anchor */
+  /* x of the conductor: the number gutter, one gap, then the lamp's centre */
+  --ch-spine: calc(var(--ch-num) + var(--ch-gap) + var(--ch-led) / 2);
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+.ch-hop {
+  position: relative;
+  display: grid;
+  grid-template-columns: var(--ch-num) var(--ch-led) minmax(0, 1fr);
+  column-gap: var(--ch-gap);
+  align-items: start;
+}
+
+/* the conductor — two halves per row, so a break lands on one link only */
+.ch-hop::before,
+.ch-hop::after {
+  content: '';
+  position: absolute;
+  left: var(--ch-spine);
+  width: 2px;
+  margin-left: -1px;
+  /* Brighter than a plain groove: this line IS the readout, and at groove
+     strength it disappeared into the panel and took the whole idea with it. */
+  background: color-mix(in srgb, var(--dim) 55%, var(--groove));
+}
+.ch-hop::before {
+  top: 0;
+  height: calc(var(--ch-lampy) - var(--ch-led) / 2 - 3px);
+}
+.ch-hop::after {
+  top: calc(var(--ch-lampy) + var(--ch-led) / 2 + 3px);
+  bottom: 0;
+}
+/* Nothing feeds hop 1 from above, and nothing leaves the exit downward — the
+   path starts and ends inside this rail. */
+.ch-hop--first::before {
+  display: none;
+}
+.ch-hop--exit::after {
+  bottom: auto;
+  height: 9px;
+}
+/* …the exit ends on a crossbar instead of trailing off: end of line. */
+.ch-hop--exit .ch-socket {
+  position: relative;
+}
+.ch-hop--exit .ch-socket::after {
+  content: '';
+  position: absolute;
+  left: 50%;
+  transform: translateX(-50%);
+  top: calc(var(--ch-lampy) + var(--ch-led) / 2 + 12px);
+  width: 11px;
+  height: 2px;
+  background: color-mix(in srgb, var(--dim) 55%, var(--groove));
+}
+
+/* THE SEVER. Everything from the dead hop's outgoing link downward is drawn as a
+   broken conductor: unmistakably not-a-line at a glance, and unmistakably not a
+   colour, because a colour here would compete with the lamps that carry health. */
+.ch-hop--dead::after,
+.ch-hop--severed::before,
+.ch-hop--severed::after {
+  background: repeating-linear-gradient(
+    to bottom,
+    color-mix(in srgb, var(--dim) 45%, var(--groove)) 0 3px,
+    transparent 3px 7px
+  );
+}
+
+.ch-num {
+  font-size: 10px;
+  line-height: calc(var(--ch-lampy) * 2);
+  text-align: right;
+  color: var(--faint);
+}
+.ch-socket {
+  display: flex;
+  align-items: center;
+  height: calc(var(--ch-lampy) * 2);
+}
+.ch-body {
+  min-width: 0;
+  /* Separates one hop from the next. The conductor runs through this space, so
+     too little of it and two hops read as one wrapped row. */
+  padding-bottom: 8px;
+}
+.ch-l1 {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 8px;
+  min-height: calc(var(--ch-lampy) * 2);
+}
+.ch-name {
+  font-size: 12px;
+  color: var(--ink);
+  overflow-wrap: anywhere;
+}
+.ch-hop--untested .ch-name {
+  color: var(--dim);
+}
+/* The exit marker is NEUTRAL on purpose. The config path above this rail tags its
+   exit green, which is free there — but in here green means "answering", and a
+   green badge on the last hop would read as a health claim about it. */
+.ch-tag {
+  font-family: var(--font-mono);
+  font-size: 8.5px;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+  color: var(--faint);
+}
+.ch-delay {
+  font-size: 11.5px;
+  font-weight: 700;
+  color: var(--ink);
+}
+.ch-quiet {
+  font-family: var(--font-sans);
+  font-size: 12px;
+  color: var(--faint);
+}
+/* A blocked hop's phrase carries a tooltip with the blocking hop's engine
+   outbound, so it takes the same help cursor as .ch-dead. No colour of its own:
+   the finding is red once, on the hop that actually failed. */
+.ch-blocked {
+  cursor: help;
+}
+.ch-age {
+  margin-left: auto;
+  font-size: 10.5px;
+  color: var(--faint);
+  white-space: nowrap;
+}
+
+/* The counters read exactly as they do on a group card — alive out of TESTED,
+   with the untested remainder as a quiet aside only when there is one. Same
+   register, same weights, deliberately not a second dialect. */
+.ch-l2 {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 8px;
+  margin-top: 1px;
+  font-size: 11.5px;
+  letter-spacing: 0.02em;
+  color: var(--dim);
+}
+.ch-count {
+  font-size: 12px;
+  color: var(--dim);
+  white-space: nowrap;
+}
+.ch-count b {
+  font-size: 14px;
+  font-weight: 700;
+  color: var(--ink);
+}
+.ch-hop--dead .ch-count b {
+  color: var(--crit);
+}
+.ch-word {
+  font-size: 10.5px;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+  color: var(--faint);
+}
+.ch-dead {
+  padding: 1px 6px;
+  border-radius: 4px;
+  background: color-mix(in srgb, var(--crit) 12%, transparent);
+  font-size: 10.5px;
+  color: var(--crit);
+  white-space: nowrap;
+  cursor: help;
+}
+.ch-rest {
+  font-size: 10.5px;
+  color: var(--faint);
+}
+/* On a blocked hop this chip says "set to", not "now": a pick nothing crossed.
+   It steps back to faint so it can't be mistaken for a live reading. */
+.ch-hop--blocked .ch-now {
+  color: var(--faint);
+}
+.ch-now {
+  max-width: 28ch;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  font-size: 10.5px;
+  color: var(--dim);
+}
+
 @media (max-width: 640px) {
   .tg-sec-hd {
     flex-wrap: wrap;
@@ -1060,6 +1296,20 @@
   .gh-now {
     max-width: 100%;
   }
+  /* On a phone the age stamp stops being pushed to a lonely right edge and just
+     joins the end of the hop's line; the selected node gets the full width
+     instead of an ellipsis it doesn't need. */
+  .ch-age {
+    margin-left: 0;
+  }
+  .ch-now {
+    max-width: 100%;
+  }
+  /* Every field of a hop wraps onto its own line at this width, so the gap
+     between hops has to grow with them or the rail reads as one block of text. */
+  .ch-body {
+    padding-bottom: 12px;
+  }
   .gh-mems {
     max-height: 260px;
   }

panel/src/pages/Targets.tsx

@@ -1,6 +1,6 @@
 import './Targets.css'
 import { Fragment, useCallback, useEffect, useMemo, useRef, useState } from 'react'
-import { Button, Led, Toggle } from '../components'
+import { Button, Led, Toggle, useConfirm } from '../components'
 import type { LedVariant } from '../components'
 import {
   apply as apiApply,
@@ -22,11 +22,20 @@ import type {
   GroupTestResult,
   GroupTestStatus,
   Chain,
+  ChainHealth,
+  ChainHopHealth,
   Egress,
   Interface,
   Node,
 } from '../api'
 import { fmtClock, fmtDuration } from '../format'
+import {
+  DPI_TYPES,
+  EGRESS_TYPES,
+  UNKNOWN_EGRESS_TYPE_HINT,
+  egressTypeInfo,
+  nextEgress,
+} from '../egressEdit'
 
 // The Targets page is a thin editor over the desired-state Model — the same
 // shape as DNS.tsx and Nodes.tsx. It manages the three things a routing rule
@@ -110,9 +119,9 @@ function findReferences(m: Model, kind: RefKind, name: string): RefSite[] {
     if (asArray(c.Hops).some((h) => isPrefixed(h, kind, name)))
       out.push({ label: `chain “${c.Name}” hop` })
   }
-  for (const e of asArray(m.Egresses)) {
-    if (isPrefixed(e.Target, kind, name)) out.push({ label: `egress “${e.Name}” target` })
-  }
+  // No Egresses loop: an egress carries no target. The one that stood here read
+  // `e.Target`, absent from the Go model, so it was `undefined` on every egress
+  // and never once matched — a dead branch shaped like a covered case.
   for (const r of asArray(m.Resolvers)) {
     if (isPrefixed(r.Detour, kind, name)) out.push({ label: `resolver “${r.Name}” DNS path` })
   }
@@ -150,7 +159,8 @@ function renameReferences(m: Model, kind: RefKind, from: string, to: string): Mo
   if (m.Rules) next.Rules = m.Rules.map((r) => ({ ...r, Target: pfx(r.Target), Egress: br(r.Egress) }))
   if (m.Chains)
     next.Chains = m.Chains.map((c) => ({ ...c, Hops: c.Hops ? c.Hops.map((h) => pfx(h) ?? h) : c.Hops }))
-  if (m.Egresses) next.Egresses = m.Egresses.map((e) => ({ ...e, Target: pfx(e.Target) }))
+  // No Egresses pass — see targetRefs above: an egress holds no target to rewrite,
+  // and writing the key on would make PUT reject the whole rename with a 400.
   if (m.Resolvers) next.Resolvers = m.Resolvers.map((r) => ({ ...r, Detour: pfx(r.Detour) }))
   if (m.Alerts) next.Alerts = m.Alerts.map((a) => ({ ...a, Via: pfx(a.Via) }))
   if (m.Subscriptions)
@@ -161,18 +171,18 @@ function renameReferences(m: Model, kind: RefKind, from: string, to: string): Mo
 }
 
 /**
- * The sentence a delete confirmation appends: what still points at this target,
- * and what happens to it. Empty list ⇒ an explicit "nothing references it", so
- * the operator can delete a stray with confidence instead of guessing.
+ * The body of a delete confirmation: what still points at this target, and what
+ * happens to it. Empty list ⇒ an explicit "nothing references it", so the
+ * operator can delete a stray with confidence instead of guessing.
  */
 function refWarning(refs: RefSite[]): string {
-  if (refs.length === 0) return ' Nothing references it.'
+  if (refs.length === 0) return 'Nothing references it.'
   const shown = refs.slice(0, 4).map((r) => r.label)
   const more = refs.length - shown.length
   const list = `${shown.join(', ')}${more > 0 ? `, and ${more} more` : ''}`
   return refs.length === 1
-    ? ` It is referenced by ${list}, whose traffic will be blocked (an unresolved target never falls through to the default route).`
-    : ` It is referenced by ${refs.length} places — ${list} — whose traffic will be blocked (an unresolved target never falls through to the default route).`
+    ? `It is referenced by ${list}, whose traffic will be blocked (an unresolved target never falls through to the default route).`
+    : `It is referenced by ${refs.length} places — ${list} — whose traffic will be blocked (an unresolved target never falls through to the default route).`
 }
 
 /**
@@ -242,29 +252,6 @@ function normStrategy(raw: string | undefined): string {
 
 const PROTOS = ['vless', 'vmess', 'trojan', 'ss'] as const
 
-/**
- * The three egress kinds that produce a real way out. `Proxy` and `Block` were
- * removed: neither ever created an outbound, so everything bound to them fell
- * through to the plain WAN with the real address. Send traffic through a proxy by
- * routing it at a group/node/chain, and drop it with the `block` target on a rule.
- */
-const EGRESS_TYPES: ReadonlyArray<{ id: string; label: string; blurb: string }> = [
-  {
-    id: 'interface',
-    label: 'Interface — out a specific WAN or tunnel',
-    blurb: 'Binds to one device (wan, wg0, …) so this traffic leaves over that uplink.',
-  },
-  {
-    id: 'direct',
-    label: 'Direct — straight out, with an optional DPI preset',
-    blurb: 'Uses the normal route. Its point is the DPI preset below, applied to what you route here.',
-  },
-  {
-    id: 'byedpi',
-    label: 'ByeDPI — through the local ciadpi desync proxy',
-    blurb: 'Hands traffic to ciadpi on 127.0.0.1, which desyncs it and goes out direct.',
-  },
-]
 const EGRESS_TYPE_LABEL: Record<string, string> = Object.fromEntries(
   EGRESS_TYPES.map((t) => [t.id, t.label.split(' — ')[0]]),
 )
@@ -276,12 +263,6 @@ const DPI_PRESETS: ReadonlyArray<{ id: string; label: string }> = [
   { id: 'spoof', label: 'Spoof' },
 ]
 
-/**
- * Types whose native DPI-bypass preset applies. NOT byedpi: the desync happens
- * inside the ciadpi process, and the engine's tls_* flags are never stamped on top
- * of it — so the control is hidden there rather than accepted and dropped.
- */
-const DPI_TYPES = new Set(['interface', 'direct'])
 
 // ---- group membership health ------------------------------------------------
 //
@@ -436,14 +417,14 @@ const normalizeTest = (st: GroupTestStatus): GroupTestStatus => ({
 })
 
 /**
- * How the header names the reach of a running exit test. The name matters more
+ * How the header names the reach of a running refresh pass. The name matters more
  * than the number when there is only one: "auto" tells the operator which button
  * they pressed; "1 target" tells them nothing they didn't already know.
  */
 function scopeLabel(scope: string[], targetCount: number): string {
   if (scope.length === 1) return scope[0]
-  if (scope.length === 0) return 'exits' // pre-scope daemon — say nothing false
-  return scope.length >= targetCount ? 'every exit' : `${scope.length} exits`
+  if (scope.length === 0) return 'targets' // pre-scope daemon — say nothing false
+  return scope.length >= targetCount ? 'every target' : `${scope.length} targets`
 }
 
 /** Which editor (add or edit-by-name) is open within a section. */
@@ -457,6 +438,7 @@ interface Opt {
 // ---- page ------------------------------------------------------------------
 
 export default function Targets() {
+  const confirm = useConfirm()
   const [config, setConfig] = useState<Model | null>(null)
   const [loadError, setLoadError] = useState<string | null>(null)
 
@@ -589,10 +571,12 @@ export default function Targets() {
     [health],
   )
 
-  // ---- group/chain exit test: how fast, through which node, out which address --
-  // The POST only kicks a run off, and a 2 s poll of the GET carries progress
-  // plus every result so far. One endpoint covers groups and chains alike:
-  // POST with a group or chain name tests that one; an empty name tests them all.
+  // ---- out-of-turn refresh: how fast, through which node, out which address ----
+  // The POST does NOT dial. It asks the observatory — the only thing in the daemon
+  // that measures anything, and it measures along the real dial path — to come
+  // round out of turn; a 2 s poll of the GET carries progress plus every reading
+  // so far. One endpoint covers groups and chains alike: POST with a name refreshes
+  // that one, an empty name refreshes them all.
   const [gtest, setGtest] = useState<GroupTestStatus>(IDLE_TEST)
   const [gtestErr, setGtestErr] = useState<string | null>(null)
   const [polling, setPolling] = useState(false)
@@ -635,7 +619,7 @@ export default function Targets() {
       void readTest().then((st) => {
         if (!alive || !st || st.running) return
         setPolling(false)
-        flash('Group test complete')
+        flash('Readings refreshed')
       })
     }, 2000)
     return () => {
@@ -651,16 +635,16 @@ export default function Targets() {
         if (r.started) {
           setGtestErr(null)
           setPolling(true)
-          flash(name ? `Testing ${name}…` : 'Testing every exit…')
+          flash(name ? `Refreshing ${name}…` : 'Refreshing every reading…')
           void readTest()
         } else if (r.reason === 'already running') {
-          setPolling(true) // pick up the run someone else started
-          flash('A group test is already running')
+          setPolling(true) // pick up the pass someone else started
+          flash('The prober is already refreshing')
         } else {
-          flash(`Couldn’t start the test — ${r.reason || 'the daemon refused it'}`)
+          flash(`Couldn’t ask for a refresh — ${r.reason || 'the daemon refused it'}`)
         }
       } catch (e) {
-        flash(`Couldn’t start the test — ${errText(e)}`)
+        flash(`Couldn’t ask for a refresh — ${errText(e)}`)
       }
     },
     [flash, readTest],
@@ -787,13 +771,18 @@ export default function Targets() {
   )
 
   const removeGroup = useCallback(
-    (name: string) => {
+    async (name: string) => {
       if (!config) return
       const refs = findReferences(config, 'group', name)
-      if (!window.confirm(`Delete group “${name}”?${refWarning(refs)}`)) return
+      const ok = await confirm({
+        label: 'Delete group',
+        title: `Delete group “${name}”?`,
+        body: refWarning(refs),
+      })
+      if (!ok) return
       void save({ ...config, Groups: groups.filter((g) => g.Name !== name) }, `Deleted ${name}`)
     },
-    [config, groups, save],
+    [config, groups, save, confirm],
   )
 
   // ---- chain mutations ------------------------------------------------------
@@ -820,13 +809,18 @@ export default function Targets() {
   )
 
   const removeChain = useCallback(
-    (name: string) => {
+    async (name: string) => {
       if (!config) return
       const refs = findReferences(config, 'chain', name)
-      if (!window.confirm(`Delete chain “${name}”?${refWarning(refs)}`)) return
+      const ok = await confirm({
+        label: 'Delete chain',
+        title: `Delete chain “${name}”?`,
+        body: refWarning(refs),
+      })
+      if (!ok) return
       void save({ ...config, Chains: chains.filter((c) => c.Name !== name) }, `Deleted ${name}`)
     },
-    [config, chains, save],
+    [config, chains, save, confirm],
   )
 
   // ---- egress mutations -----------------------------------------------------
@@ -853,13 +847,18 @@ export default function Targets() {
   )
 
   const removeEgress = useCallback(
-    (name: string) => {
+    async (name: string) => {
       if (!config) return
       const refs = findReferences(config, 'egress', name)
-      if (!window.confirm(`Delete egress “${name}”?${refWarning(refs)}`)) return
+      const ok = await confirm({
+        label: 'Delete egress',
+        title: `Delete egress “${name}”?`,
+        body: refWarning(refs),
+      })
+      if (!ok) return
       void save({ ...config, Egresses: egresses.filter((e) => e.Name !== name) }, `Deleted ${name}`)
     },
-    [config, egresses, save],
+    [config, egresses, save, confirm],
   )
 
   const busy = saving || applying
@@ -894,10 +893,11 @@ export default function Targets() {
           <h2 className="tg-sec-title">Groups</h2>
           <span className="tg-sec-count mono">{groups.length} configured</span>
           {/* The observatory's background probing is invisible by design — it
-              keeps every used group's and chain's numbers fresh on its own. The
-              one manual run left is the exit test: it is scoped to the groups
-              and chains it names, so its progress says WHICH, and its badge
-              lands only on those cards. */}
+              keeps every used group's and chain's numbers fresh on its own, along
+              the path traffic actually takes. The one manual control left does
+              not measure anything itself: it asks that prober to come round out
+              of turn. It is scoped to the groups and chains it names, so its
+              progress says WHICH, and its badge lands only on those cards. */}
           <div className="tg-sec-ctl">
             {groupHealthOn && (
              <>
@@ -905,11 +905,11 @@ export default function Targets() {
               <span
                 className="tg-run tg-run--exit"
                 role="status"
-                title="An exit test sends one connection through each group or chain it covers and reports the delay and the address the internet sees."
+                title="The background prober is measuring the targets this refresh covers, along the path each one's traffic really takes."
               >
                 <Led variant="amber" pulse />
                 <span className="tg-run-what">
-                  exit test · {scopeLabel(asArray(gtest.scope), groups.length + chains.length)}
+                  refreshing · {scopeLabel(asArray(gtest.scope), groups.length + chains.length)}
                 </span>
                 <span className="tg-run-n mono">
                   {gtest.done}/{gtest.total}
@@ -919,9 +919,9 @@ export default function Targets() {
             <Button
               onClick={() => void runTest()}
               disabled={busy || !config || (groups.length === 0 && chains.length === 0) || gtest.running}
-              title="Send one connection through each group and chain and report the delay and the exit address the internet sees"
+              title="Ask the background prober to measure every group and chain out of turn, then show what it measured. The panel opens no connection of its own."
             >
-              {gtest.running ? 'Testing…' : 'Test every exit'}
+              {gtest.running ? 'Refreshing…' : 'Refresh every reading'}
             </Button>
              </>
             )}
@@ -941,6 +941,13 @@ export default function Targets() {
           dials out through a tunnel measures them through that tunnel, so the same node can be alive
           in one group and dead in another.
         </p>
+        <p className="tg-sec-note">
+          One thing measures, and the panel is not it. A background prober walks every path your
+          rules use — hop by hop, exactly as traffic goes — and every number on this page is a read
+          of what it found. <strong>Refresh every reading</strong> asks it to come round out of turn
+          instead of waiting for the next pass; it opens no connection of its own, so a target no
+          rule routes through has nothing to report and says so.
+        </p>
 
         {groupHealthOn && healthErr && (
           <p className="tg-test-err" role="alert">
@@ -951,7 +958,7 @@ export default function Targets() {
 
         {groupHealthOn && gtestErr && (
           <p className="tg-test-err" role="alert">
-            Couldn’t read the test results — {gtestErr}.{' '}
+            Couldn’t read the refreshed numbers — {gtestErr}.{' '}
             <button className="linkish" onClick={() => void readTest()}>
               Retry
             </button>
@@ -1094,7 +1101,9 @@ export default function Targets() {
                   chain={c}
                   busy={busy}
                   showHealth={groupHealthOn}
-                  used={healthByChain.get(c.Name)?.used}
+                  // The whole chain health record, not just `.used` — the card
+                  // renders the observatory's per-hop measurements from it.
+                  health={healthByChain.get(c.Name)}
                   test={testByGroup.get(c.Name)}
                   // The badge is this card's business only when the run names it.
                   testing={gtest.running && testScope.has(c.Name)}
@@ -1216,7 +1225,7 @@ function GroupRow({
   group: Group
   busy: boolean
   /** Group health checks are on (Settings). When false, the card drops its health
-   *  readout, its exit-test readout and its Test button — it is config only. */
+   *  readout, its end-to-end reading and its Refresh button — it is config only. */
   showHealth: boolean
   /** This group's membership health, or undefined when the engine hasn't built
    *  it (not applied yet, or dropped for having no usable members). */
@@ -1226,14 +1235,14 @@ function GroupRow({
   healthKnown: boolean
   test?: GroupTestResult
   /**
-   * A group exit test covering THIS group is in flight.
+   * A refresh pass covering THIS group is in flight.
    *
    * Deliberately not "a test is running": the caller resolves it against the run's
    * scope. There is no per-card equivalent for the health run — that one measures
    * every group at once and is reported once, in the section header.
    */
   testing: boolean
-  /** Any exit test is in flight; the daemon runs one at a time. */
+  /** Any refresh pass is in flight; the daemon runs one at a time. */
   testBusy: boolean
   onTest: () => void
   onEdit: () => void
@@ -1293,7 +1302,11 @@ function GroupRow({
               health={health}
               healthKnown={healthKnown}
             />
-            <GroupTestReadout test={test} pending={testing && !test} />
+            <GroupTestReadout
+              test={test}
+              pending={testing && !test}
+              hideAbsence={health?.used === false}
+            />
           </>
         )}
       </div>
@@ -1304,7 +1317,7 @@ function GroupRow({
         editLabel={`Edit group ${group.Name}`}
         deleteLabel={`Delete group ${group.Name}`}
         onTest={showHealth ? onTest : undefined}
-        testLabel={showHealth ? `Test the exit of group ${group.Name}` : undefined}
+        testLabel={showHealth ? `Refresh the reading for group ${group.Name}` : undefined}
         testDisabled={testBusy}
       />
     </li>
@@ -1363,21 +1376,7 @@ function GroupHealthReadout({
   // its members would stay "untested" forever. That is a fact about the ROUTING
   // CONFIG, not about the members — so instead of counters that could only ever
   // read as a permanent unknown, the card says so, quietly: unused, not unwell.
-  if (!health.used) {
-    return (
-      <div className="gh gh--unused">
-        <div className="gh-line">
-          <span
-            className="gh-unused"
-            title="No enabled rule routes through this group, so its members are not probed. Add it to a rule to see health."
-          >
-            unused
-          </span>
-          <span className="gh-quiet">not probed — no enabled rule routes through this group</span>
-        </div>
-      </div>
-    )
-  }
+  if (!health.used) return <NotRoutedNote kind="group" />
 
   const v = verdictOf(health)
   const { total, tested, alive, dead, untested } = health
@@ -1540,6 +1539,56 @@ function GroupHealthReadout({
   )
 }
 
+/**
+ * The card's answer when NOTHING ROUTES THROUGH THIS TARGET. Shared by the group
+ * card and the chain card, because it is the same misunderstanding on both.
+ *
+ * It has to carry two statements, and the old one-liner ("not probed — no enabled
+ * rule routes through this group") only carried the first. Read fast it still
+ * landed as a verdict: a card that normally shows health and today shows a grey
+ * pill reads as "the health is bad". So the two meanings are now separated, on
+ * purpose and in this order:
+ *
+ *   1. the ROUTING FACT — nothing routes here, so nothing measures it;
+ *   2. the NON-FACT — this is not a health reading at all. Absent numbers are
+ *      absence of measurement, never failure.
+ *
+ * For a GROUP there is a third line, and it is the confusion this whole change
+ * exists to end: a group used only as a hop inside a chain is never routed to
+ * DIRECTLY, so it correctly reads unused here while carrying real traffic as a
+ * hop. Its health is measured at that hop, on the chain's card.
+ *
+ * Unused is neutral — groove-grey, never amber, never crit. It is a state of the
+ * config, and the config is not sick.
+ */
+function NotRoutedNote({ kind }: { kind: 'group' | 'chain' }) {
+  return (
+    <div className="gh gh--unused">
+      <div className="gh-line">
+        <span className="gh-unused">unused</span>
+        <span className="gh-quiet">
+          No enabled rule routes through this {kind}, so the observatory never probes it.
+        </span>
+      </div>
+      <p className="gh-say">
+        That is a routing fact, not a health reading. There are no numbers here because nothing
+        measured this {kind} — not because it failed.
+      </p>
+      {kind === 'group' ? (
+        <p className="gh-say">
+          A group used only as a hop inside a chain reads unused here on purpose: the rules point at
+          the chain, not at the group. Its members are measured at that hop, so its real health is on
+          that chain’s card, hop by hop.
+        </p>
+      ) : (
+        <p className="gh-say">
+          Point a rule at this chain and the observatory starts measuring every hop within seconds.
+        </p>
+      )}
+    </div>
+  )
+}
+
 /**
  * One group's member rows, fetched on demand.
  *
@@ -1645,7 +1694,9 @@ function MemberRow({ member }: { member: GroupMemberHealth }) {
 }
 
 /**
- * What a group test found, in the four states it actually has.
+ * What the OBSERVATORY measured for this target end to end, in the four states it
+ * actually has. Nothing here was dialled by the panel — it is a read of the
+ * background prober's own measurement along the real path.
  *
  * The one worth spelling out: `ok` with an EMPTY `exit_ip` is a SUCCESS. The
  * delay was measured; only the address lookup came back empty. Rendering that as
@@ -1653,15 +1704,45 @@ function MemberRow({ member }: { member: GroupMemberHealth }) {
  * traffic, so it reads as a result with the address slot marked unknown — dim,
  * not red, and the LED stays green.
  */
-function GroupTestReadout({ test, pending }: { test?: GroupTestResult; pending: boolean }) {
+/**
+ * Errors that mean NO MEASUREMENT EXISTS, as opposed to "this target is broken".
+ *
+ * Three of the observatory's four failure reasons are about the observatory, not
+ * about the path: nothing routes here, nothing has reached it yet, or background
+ * probing is switched off. Painting those crit-red — which is what `ok:false`
+ * used to buy you — reports a fault that nobody has found, on a target that may
+ * be carrying traffic perfectly. Only "the observatory's probe through this path
+ * failed" is a health finding, and it is deliberately NOT in this list.
+ *
+ * Matched on a stable fragment rather than the whole sentence, so a daemon that
+ * rewords the tail still classifies. An error we don't recognise stays red: an
+ * unknown failure is likelier to be real than not, and that is the safe default.
+ */
+const NO_MEASUREMENT = [
+  'not routed by any enabled rule',
+  'has not reached this target yet',
+  'background probing is disabled',
+]
+const isAbsence = (err: string): boolean => NO_MEASUREMENT.some((frag) => err.includes(frag))
+
+function GroupTestReadout({
+  test,
+  pending,
+  hideAbsence,
+}: {
+  test?: GroupTestResult
+  pending: boolean
+  /** The card already explains why nothing measures this target (the unused
+   *  note), so an absence error here would just say it a second time. */
+  hideAbsence?: boolean
+}) {
   if (pending) {
-    // "testing", never "measuring": the health run owns that word and covers every
-    // group at once. Two runs that read the same on a card is how one group's test
-    // came to look like all four were busy.
+    // Names who is working and on what: the prober, on this target. The badge is
+    // scoped to the cards the run covers, so it can say "this one" honestly.
     return (
       <div className="tg-test tg-test--wait" role="status">
         <Led variant="amber" pulse />
-        <span className="tg-test-msg">testing this exit…</span>
+        <span className="tg-test-msg">waiting for the prober to measure this…</span>
       </div>
     )
   }
@@ -1670,10 +1751,22 @@ function GroupTestReadout({ test, pending }: { test?: GroupTestResult; pending:
   const at = test.tested_unix ? fmtClock(test.tested_unix) : ''
 
   if (!test.ok) {
+    // No measurement exists. Unlit lamp, quiet text: this panel's way of saying
+    // "no verdict", which is precisely the state — never a red one.
+    if (isAbsence(test.error)) {
+      if (hideAbsence) return null
+      return (
+        <div className="tg-test tg-test--none" role="status">
+          <Led variant="off" />
+          <span className="tg-test-msg">{test.error}</span>
+          {at && <span className="tg-test-at mono">{at}</span>}
+        </div>
+      )
+    }
     return (
       <div className="tg-test tg-test--bad" role="status">
         <Led variant="crit" />
-        <span className="tg-test-msg">{test.error || 'the test failed'}</span>
+        <span className="tg-test-msg">{test.error || 'the probe failed'}</span>
         {at && <span className="tg-test-at mono">{at}</span>}
       </div>
     )
@@ -2098,7 +2191,7 @@ function ChainRow({
   chain,
   busy,
   showHealth,
-  used,
+  health,
   test,
   testing,
   testBusy,
@@ -2109,31 +2202,41 @@ function ChainRow({
   chain: Chain
   busy: boolean
   /** Group health checks are on (Settings). When false, the card drops its
-   *  exit-test readout and Test button — it is config only. */
+   *  health readout and Refresh button — it is config only. */
   showHealth: boolean
-  /** This chain's reachability (GroupHealth.Used's chain analogue, plan §5.E).
-   *  undefined ⇒ the health endpoint hasn't reported this chain (not applied yet, or
-   *  a daemon version without chains): no badge. false ⇒ no enabled rule routes
-   *  through the chain, so the observatory never probes it and the card renders
-   *  "unused" instead of an exit-test readout. */
-  used?: boolean
+  /** Everything the observatory knows about this chain: whether any enabled rule
+   *  routes through it, and the per-hop measurements along it.
+   *  undefined ⇒ the health endpoint hasn't reported this chain at all (not
+   *  applied yet, or a daemon version without chains): the card says nothing
+   *  rather than guessing. */
+  health?: ChainHealth
   test?: GroupTestResult
-  /** An exit test covering THIS chain is in flight (the caller resolves it
+  /** A refresh pass covering THIS chain is in flight (the caller resolves it
    *  against the run's scope, exactly as for a group card). */
   testing: boolean
-  /** Any exit test is in flight; the daemon runs one at a time. */
+  /** Any refresh pass is in flight; the daemon runs one at a time. */
   testBusy: boolean
   onTest: () => void
   onEdit: () => void
   onDelete: () => void
 }) {
   const hops = asArray(chain.Hops)
+  // A LEADING `egress:` is not a hop and the rail below already knows it: the
+  // daemon lifts it into hop 1's entry detour (see hopLabels), so it is tagged
+  // "entry" and never numbered. The badge counted it anyway, which is how a chain
+  // drawn with four hops came to be labelled "5 hops" directly above them.
+  const entryEgress = hops.length > 0 && hops[0].startsWith('egress:')
+  const numbered = entryEgress ? hops.length - 1 : hops.length
   return (
     <li className="tg-row">
       <div className="tg-row-main">
         <div className="tg-row-l1">
           <span className="tg-row-name">{chain.Name}</span>
-          <span className="tg-badge">{hops.length} hop{hops.length === 1 ? '' : 's'}</span>
+          <span className="tg-badge">
+            {numbered === 0 && entryEgress
+              ? 'entry only · no exit'
+              : `${numbered} hop${numbered === 1 ? '' : 's'}`}
+          </span>
         </div>
         <div className="tg-row-l2">
           {hops.length === 0 ? (
@@ -2165,25 +2268,21 @@ function ChainRow({
         {showHealth && (
           <>
             {/* A chain no enabled rule routes through is never probed (the
-                observatory walks only reachable paths), so instead of an exit-test
-                readout the card says so, quietly — the same "unused" pattern the
-                group card uses (GroupHealthReadout), not a new design. `used` is
-                undefined until the health endpoint reports this chain (or from a
-                daemon version without chains): no badge then. */}
-            {used === false && (
-              <div className="gh gh--unused">
-                <div className="gh-line">
-                  <span
-                    className="gh-unused"
-                    title="No enabled rule routes through this chain, so its exit is not probed. Add it to a rule to see health."
-                  >
-                    unused
-                  </span>
-                  <span className="gh-quiet">not probed — no enabled rule routes through this chain</span>
-                </div>
-              </div>
-            )}
-            <GroupTestReadout test={test} pending={testing && !test} />
+                observatory walks only reachable paths), so instead of a health
+                readout the card says so — the same "unused" note the group card
+                uses, not a new design. `health` is undefined until the endpoint
+                reports this chain (or on a daemon without chains): say nothing
+                then rather than guess. */}
+            {health?.used === false ? (
+              <NotRoutedNote kind="chain" />
+            ) : health?.used ? (
+              <ChainHopRail chain={chain.Name} defs={hops} hops={health.hops} />
+            ) : null}
+            <GroupTestReadout
+              test={test}
+              pending={testing && !test}
+              hideAbsence={health?.used === false}
+            />
           </>
         )}
       </div>
@@ -2194,13 +2293,250 @@ function ChainRow({
         editLabel={`Edit chain ${chain.Name}`}
         deleteLabel={`Delete chain ${chain.Name}`}
         onTest={showHealth ? onTest : undefined}
-        testLabel={showHealth ? `Test the exit of chain ${chain.Name}` : undefined}
+        testLabel={showHealth ? `Refresh the reading for chain ${chain.Name}` : undefined}
         testDisabled={testBusy}
       />
     </li>
   )
 }
 
+// ---- chain hop rail --------------------------------------------------------
+
+/**
+ * The API gives hops an index and no name. The page already knows the names — the
+ * model's own `Hops` strings ("egress:ewan", "node:awgout", "group:sub0") — so
+ * zip the two by POSITION.
+ *
+ * Two things make that safe rather than clever. A LEADING `egress:` is not a
+ * numbered hop: the daemon lifts it into hop 1's entry detour, so it is dropped
+ * before counting. And if the counts still disagree — a chain that splices
+ * sub-chains gets FLATTENED by the daemon, producing more wire hops than the
+ * config lists — every label is dropped. A hop labelled with its neighbour's name
+ * is worse than a hop with no name at all: it would send someone to fix the wrong
+ * target.
+ */
+function hopLabels(defs: string[], hops: ChainHopHealth[]): (string | undefined)[] {
+  const numbered = defs.length > 0 && defs[0].startsWith('egress:') ? defs.slice(1) : defs
+  if (numbered.length !== hops.length) return hops.map(() => undefined)
+  return hops.map((h) => (h.index >= 1 && h.index <= numbered.length ? numbered[h.index - 1] : undefined))
+}
+
+/**
+ * One hop's lamp.
+ *
+ * `dead` is crit and `untested` is an UNLIT socket — never red, because nothing
+ * has been measured and an unlit lamp is this panel's way of saying "no verdict".
+ * That covers a hop the walk never reached (`blocked_by`) too: it is neither
+ * healthy nor broken, and unlit is the only mark that claims neither.
+ * The fourth case is the page's existing house reading, applied here for
+ * consistency rather than invented: a group hop that is carrying traffic but has
+ * confirmed failures on its board is amber. `state` stays the daemon's word for
+ * "can this hop carry traffic"; the amber only qualifies HOW WELL.
+ */
+function hopLed(h: ChainHopHealth): LedVariant {
+  if (h.state === 'dead') return 'crit'
+  if (h.state === 'untested') return 'off'
+  return h.dead > 0 ? 'amber' : 'on'
+}
+
+/**
+ * What the observatory measured at each position of a chain — the reading the
+ * daemon always took and the panel never showed.
+ *
+ * THE DESIGN RISK, and the one place this card spends any boldness: the rail
+ * draws the CONDUCTOR as well as the lamps, and severs it below the first dead
+ * hop. A chain is a single series path, so the operator's real question is never
+ * "how many hops are green" — it is "where does my traffic stop". Four lamps in a
+ * column answer the first question and leave the second to arithmetic. A broken
+ * conductor answers the second one before you have read a single word, which is
+ * the whole reason this feature exists.
+ *
+ * It stays honest by keeping two different facts on two different marks. The
+ * CONDUCTOR is reachability through the path, and that genuinely does stop at the
+ * break. The LAMPS are measurements — and there are none below the break to show:
+ * the daemon walks the path in order and stops at the first hop that does not
+ * answer, because every later hop is dialled THROUGH that one. Those hops arrive
+ * `untested` with `blocked_by` naming the hop that stopped the walk, so their
+ * lamps stay UNLIT: not a soft red, not a pale green, just this panel's way of
+ * saying no verdict exists about a hop nobody reached. The row says so in words
+ * too, naming that hop, because "why is this row empty" is the question the shape
+ * alone cannot answer.
+ *
+ * Nothing here is re-derived from the daemon's counters — the block, the zeroed
+ * numbers and the state all come off the wire. The only thing the panel adds is
+ * what a chain structurally is.
+ *
+ * Everything around the rail is deliberately quiet: no colour but the semantic
+ * lamps, no motion at all, the orange accent untouched.
+ */
+function ChainHopRail({
+  chain,
+  defs,
+  hops,
+}: {
+  chain: string
+  /** The chain's configured hops, straight off the model — the only source of names. */
+  defs: string[]
+  /** Absent ⇒ the engine never materialised per-hop outbounds. NOT "no hops". */
+  hops?: ChainHopHealth[]
+}) {
+  const ordered = useMemo(() => [...asArray(hops)].sort((a, b) => a.index - b.index), [hops])
+  const labels = useMemo(() => hopLabels(defs, ordered), [defs, ordered])
+
+  // The first hop that was probed and did not answer. Everything after it is
+  // unreachable THROUGH THIS CHAIN, whatever its own lamp says. `untested` is
+  // never a break: nothing was measured, so nothing is known to be severed.
+  const breakAt = ordered.findIndex((h) => h.state === 'dead')
+
+  if (ordered.length === 0) {
+    // Say why, in one line, instead of an empty rail. The daemon collapses a
+    // single-target chain into a plain alias and never builds copies to measure,
+    // so we can tell the two absences apart from the config alone.
+    const numbered = defs.filter((d, i) => !(i === 0 && d.startsWith('egress:')))
+    return (
+      <div className="gh gh--absent">
+        <span className="gh-absent-msg">
+          {numbered.length <= 1
+            ? 'This chain has a single hop, so the engine points traffic straight at that target instead of building a path to measure. Its health is on that target’s own card.'
+            : 'The engine hasn’t built this chain’s hops yet, so there is nothing measured per hop. They appear once it is running with this config applied.'}
+        </span>
+      </div>
+    )
+  }
+
+  return (
+    <div className="gh ch-rail">
+      <span className="ch-eyebrow">measured, hop by hop</span>
+      <ol className="ch-hops">
+        {ordered.map((h, i) => {
+          const label = labels[i]
+          const severed = breakAt >= 0 && i > breakAt
+          // Straight off the wire: present ⇒ the walk never reached this hop, so
+          // there is nothing measured here and the daemon has already named the
+          // hop that stopped it. Never inferred from the counters.
+          const blocked = h.blocked_by
+          const cls = [
+            'ch-hop',
+            `ch-hop--${h.state}`,
+            blocked ? 'ch-hop--blocked' : '',
+            severed ? 'ch-hop--severed' : '',
+            h.exit ? 'ch-hop--exit' : '',
+            i === 0 ? 'ch-hop--first' : '',
+          ]
+            .filter(Boolean)
+            .join(' ')
+          const age = fmtAge(h.age_seconds)
+          return (
+            <li key={h.tag || h.index} className={cls}>
+              <span className="ch-num mono" aria-hidden="true">
+                {h.index}
+              </span>
+              <span className="ch-socket">
+                <Led variant={hopLed(h)} />
+              </span>
+              <div className="ch-body">
+                <div className="ch-l1">
+                  <span className="ch-name mono" title={`engine outbound ${h.tag}`}>
+                    {label ?? (h.kind === 'group' ? 'a group hop' : 'a node hop')}
+                  </span>
+                  {h.exit && <span className="ch-tag">exit</span>}
+                  {h.state === 'alive' && h.delay_ms > 0 && (
+                    <span className="ch-delay mono">{h.delay_ms} ms</span>
+                  )}
+                  {/* Two different silences. A plain untested hop is a timing
+                      gap that fills in by itself; a BLOCKED one never will,
+                      because the walk stopped above it — so it says which hop
+                      stopped it instead of implying someone should wait. */}
+                  {blocked ? (
+                    <span
+                      className="ch-quiet ch-blocked"
+                      title={`hop ${blocked.index} did not answer, so nothing was dialled through it (engine outbound ${blocked.tag})`}
+                    >
+                      no reading — the probe stopped at hop {blocked.index}
+                    </span>
+                  ) : (
+                    h.state === 'untested' && <span className="ch-quiet">not measured yet</span>
+                  )}
+                  {age && <span className="ch-age mono">{age}</span>}
+                </div>
+
+                {/* A node hop IS its own measurement (total 1), so counters would
+                    only restate the lamp. A group hop rolls up its per-hop member
+                    copies, and those read exactly as they do everywhere else in
+                    this app: alive out of TESTED, with the untested remainder as a
+                    quiet aside only when there is one. A blocked hop has those
+                    counters zeroed by the daemon, so it lands in the tested === 0
+                    branch — and there it must say the members were never REACHED,
+                    not that they are still waiting their turn. */}
+                {h.kind === 'group' && h.total > 0 && (
+                  <div className="ch-l2">
+                    {h.tested === 0 ? (
+                      <span className="ch-rest mono">
+                        {h.total} member{h.total === 1 ? '' : 's'},{' '}
+                        {blocked ? 'none of them reached' : 'none measured'}
+                      </span>
+                    ) : (
+                      <>
+                        <span className="ch-count mono">
+                          <b>{h.alive}</b> / {h.tested}
+                        </span>
+                        <span className="ch-word">alive</span>
+                        {h.dead > 0 && (
+                          <span
+                            className="ch-dead mono"
+                            title={`${h.dead} member${h.dead === 1 ? '' : 's'} were probed at this hop and did not answer`}
+                          >
+                            {h.dead} not answering
+                          </span>
+                        )}
+                        {h.untested > 0 && (
+                          <span className="ch-rest mono">
+                            tested {h.tested} of {h.total}
+                          </span>
+                        )}
+                      </>
+                    )}
+                    {/* The wrapper keeps its pick even when nothing crossed it,
+                        so on a blocked hop this is the node it WOULD use — say
+                        that, rather than "now", which claims live traffic. */}
+                    {h.selected && (
+                      <span
+                        className="ch-now mono"
+                        title={
+                          blocked
+                            ? `Hop ${h.index} of “${chain}” is set to ${h.selected}; nothing crossed it to measure`
+                            : `Traffic crossing hop ${h.index} of “${chain}” is on ${h.selected}`
+                        }
+                      >
+                        {blocked ? 'set to' : 'now'} → {h.selected}
+                      </span>
+                    )}
+                  </div>
+                )}
+              </div>
+            </li>
+          )
+        })}
+      </ol>
+
+      {/* The sentence the rail's shape implies, written out — because the break is
+          the answer someone came here for, and a graphic alone should never be the
+          only place a finding exists. It names the dead hop, since that is the one
+          thing here anybody can act on. */}
+      {breakAt >= 0 && (
+        <p className="gh-say gh-say--bad">
+          Hop {ordered[breakAt].index}
+          {labels[breakAt] ? ` (${labels[breakAt]})` : ''} was probed and did not answer, so traffic
+          stops there
+          {breakAt < ordered.length - 1
+            ? ' — and the hops below it are dialled through it, so nothing reached them and nothing is known about them.'
+            : '.'}
+        </p>
+      )}
+    </div>
+  )
+}
+
 function ChainEditor({
   initial,
   hopOptions,
@@ -2482,7 +2818,7 @@ function EgressEditor({
   const [port, setPort] = useState(initial?.Port != null ? String(initial.Port) : '')
   const [dpi, setDpi] = useState(initial?.DPI || 'off')
   const [err, setErr] = useState<string | null>(null)
-  const typeInfo = EGRESS_TYPES.find((t) => t.id === type)
+  const typeInfo = egressTypeInfo(type)
   // This egress was byedpi when the editor opened — its own type stays legal
   // even with the package gone, so saved config can always round-trip.
   const wasByedpi = initial?.Type === 'byedpi'
@@ -2499,14 +2835,11 @@ function EgressEditor({
     if (type === 'byedpi' && byedpiLocked)
       return setErr('Install the byedpi package to add a ByeDPI egress.')
     setErr(null)
-    const base: Egress = { ...(initial ?? ({} as Egress)), Name: nm, Type: type }
-    // Only carry the fields the chosen type uses; clear the rest. `Target` belonged
-    // to the removed `proxy` type and is cleared unconditionally.
-    base.Interface = type === 'interface' ? iface.trim() : undefined
-    base.Target = undefined
-    base.Port = type === 'byedpi' ? Number(port.trim()) || 1080 : undefined
-    base.DPI = DPI_TYPES.has(type) ? dpi : undefined
-    await onSave(base)
+    // Carry the fields the chosen type uses and clear the rest — but ONLY for a
+    // type this editor renders those fields for. An unknown type keeps every
+    // stored setting untouched, because this form showed the operator none of
+    // them and must not delete what it declined to display. See nextEgress.
+    await onSave(nextEgress(initial, { name: nm, type, iface, port, dpi }))
   }
 
   return (
@@ -2555,10 +2888,7 @@ function EgressEditor({
             })}
             {!typeInfo && <option value={type}>{type || '—'} (unknown)</option>}
           </select>
-          <p className="tg-fhint">
-            {typeInfo?.blurb ??
-              'This engine builds no outbound for that type, so everything routed here is blocked. Pick one above.'}
-          </p>
+          <p className="tg-fhint">{typeInfo?.blurb ?? UNKNOWN_EGRESS_TYPE_HINT}</p>
           {byedpiLocked && (
             <p className="tg-fhint">
               Install the <code>byedpi</code> package to enable the ByeDPI egress.
@@ -2675,8 +3005,8 @@ function RowActions({
   busy: boolean
   editLabel: string
   deleteLabel: string
-  // Only groups and chains can be tested, so the control is optional and absent
-  // everywhere else rather than a disabled stub on every row.
+  // Only groups and chains are probed, so the refresh control is optional and
+  // absent everywhere else rather than a disabled stub on every row.
   onTest?: () => void
   testLabel?: string
   testDisabled?: boolean
@@ -2689,8 +3019,9 @@ function RowActions({
           onClick={onTest}
           disabled={busy || testDisabled}
           aria-label={testLabel}
+          title="Ask the background prober to measure this target out of turn. It does not open a connection from the panel."
         >
-          Test
+          Refresh
         </Button>
       )}
       <Button className="tg-act" onClick={onEdit} disabled={busy} aria-label={editLabel}>

panel/src/pendingConfirm.test.ts

@@ -0,0 +1,91 @@
+// pendingConfirm — the record of an armed auto-rollback, shared by the whole panel.
+//
+// Run with `npm test`. The module imports React only for its hook; the plain
+// functions exercised here touch neither React nor the DOM, and `localStorage` is
+// absent under node, which is itself one of the cases worth pinning (the panel
+// must still work, it just forgets on reload).
+//
+// What these protect:
+//   - arming when commit-confirm is OFF must record nothing. The daemon does not
+//     arm a window then, and a countdown for a rollback that will never happen is
+//     the same class of lie as the "Confirmed" message this module replaced.
+//   - a window that has elapsed reads as gone, so nothing renders "0 s left".
+//   - expiry notifies exactly once even though several components watch it.
+
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+
+import {
+  armPendingConfirm,
+  clearPendingConfirm,
+  confirmTimeout,
+  noteConfirmTimeout,
+  onPendingConfirmExpire,
+  readPendingConfirm,
+} from './pendingConfirm.ts'
+
+test('commit-confirm off ⇒ arming records nothing', () => {
+  noteConfirmTimeout(0)
+  assert.equal(confirmTimeout(), 0)
+  armPendingConfirm()
+  assert.equal(readPendingConfirm(), null)
+})
+
+test('a window is recorded with the timeout the config reported', () => {
+  noteConfirmTimeout(90)
+  armPendingConfirm()
+  const p = readPendingConfirm()
+  assert.notEqual(p, null)
+  assert.equal(p!.total, 90)
+  // Deadline is in the future and within a second of now + the window.
+  const left = (p!.until - Date.now()) / 1000
+  assert.ok(left > 89 && left <= 90, `expected ~90s left, got ${left}`)
+  clearPendingConfirm()
+  assert.equal(readPendingConfirm(), null)
+})
+
+test('switching commit-confirm off drops a window that was already armed', () => {
+  noteConfirmTimeout(60)
+  armPendingConfirm()
+  assert.notEqual(readPendingConfirm(), null)
+  noteConfirmTimeout(0)
+  assert.equal(readPendingConfirm(), null)
+})
+
+test('an elapsed window reads as gone, never as a countdown at zero', () => {
+  noteConfirmTimeout(1)
+  armPendingConfirm()
+  const p = readPendingConfirm()
+  assert.notEqual(p, null)
+  // Wind the clock forward rather than sleeping through the window.
+  const realNow = Date.now
+  Date.now = () => realNow() + 5000
+  try {
+    assert.equal(readPendingConfirm(), null)
+  } finally {
+    Date.now = realNow
+  }
+  clearPendingConfirm()
+})
+
+test('confirming does NOT fire the expiry listeners', () => {
+  noteConfirmTimeout(30)
+  let fired = 0
+  const off = onPendingConfirmExpire(() => {
+    fired++
+  })
+  armPendingConfirm()
+  clearPendingConfirm()
+  off()
+  assert.equal(fired, 0)
+})
+
+test('a nonsense timeout is ignored rather than taken as "off"', () => {
+  noteConfirmTimeout(45)
+  noteConfirmTimeout(Number.NaN)
+  noteConfirmTimeout(-1)
+  noteConfirmTimeout(undefined)
+  assert.equal(confirmTimeout(), 45)
+  clearPendingConfirm()
+  noteConfirmTimeout(0)
+})

panel/src/pendingConfirm.ts

@@ -0,0 +1,186 @@
+// The commit-confirm window, as ONE fact the whole panel can see.
+//
+// WHY THIS EXISTS. `POST /api/apply` always arms an auto-rollback for
+// `Globals.ConfirmTimeout` seconds (shater/panel/api.go handleApply →
+// ArmRollback) — EVERY Apply button does that, not just the one on the Apply
+// page. But the countdown, and the button that stops it, lived in one component's
+// local state. So:
+//
+//   - pressing Apply on Routing/DNS/Nodes/Settings/Devices/Profiles/Targets said
+//     "Applied" and nothing else; the operator walked away and the router quietly
+//     reverted a minute later;
+//   - reloading the tab wiped the countdown AND the "Keep this config" button, so
+//     there was no way left to confirm from the panel at all.
+//
+// The daemon does not report a deadline, so this module records the one the panel
+// itself armed, in `localStorage`. That is a deliberately modest claim — it knows
+// about windows THIS BROWSER opened and says nothing about one opened elsewhere —
+// but it survives a reload, a new tab and a navigation, which is what the two
+// failures above needed.
+//
+// It is also the answer to "is there anything to confirm?". `apply.Confirm()`
+// returns nil unconditionally, so a Confirm button that is always live can only
+// ever report success. Gating it on a record here means the panel offers the
+// action when it knows a window is open, and then reports an outcome it knows.
+
+import { useEffect, useState } from 'react'
+
+/** A live commit-confirm window the panel armed. */
+export interface PendingConfirm {
+  /** Epoch ms at which the daemon auto-rolls back if nobody confirms. */
+  until: number
+  /** The window it started with, in seconds — the progress bar's denominator. */
+  total: number
+}
+
+const KEY = 'shater.pendingConfirm'
+
+type Listener = () => void
+const listeners = new Set<Listener>()
+const expiryListeners = new Set<Listener>()
+
+/** localStorage is absent under SSR/tests and throws in some privacy modes. A
+ *  panel that cannot remember a window must still work — it just forgets on
+ *  reload, which is exactly the old behaviour and no worse. */
+function store(): Storage | null {
+  try {
+    return typeof localStorage === 'undefined' ? null : localStorage
+  } catch {
+    return null
+  }
+}
+
+function load(): PendingConfirm | null {
+  const s = store()
+  if (!s) return null
+  try {
+    const raw = s.getItem(KEY)
+    if (!raw) return null
+    const v = JSON.parse(raw) as Partial<PendingConfirm>
+    if (typeof v.until !== 'number' || typeof v.total !== 'number') return null
+    if (!Number.isFinite(v.until)) return null
+    return { until: v.until, total: v.total }
+  } catch {
+    return null
+  }
+}
+
+// The single in-process copy. Storage is the durable mirror, not the source of
+// truth for a running tab: a `storage` event re-hydrates it when another tab
+// writes.
+let armed: PendingConfirm | null = load()
+
+function emit() {
+  for (const l of [...listeners]) l()
+}
+
+function write(v: PendingConfirm | null) {
+  armed = v
+  const s = store()
+  if (s) {
+    try {
+      if (v) s.setItem(KEY, JSON.stringify(v))
+      else s.removeItem(KEY)
+    } catch {
+      // Storage full or blocked — the in-process copy still drives this tab.
+    }
+  }
+  emit()
+}
+
+/** The armed window, or null when there is none or it has already elapsed. */
+export function readPendingConfirm(): PendingConfirm | null {
+  if (!armed) return null
+  return armed.until > Date.now() ? armed : null
+}
+
+// ---- the window's length ----------------------------------------------------
+
+// `Globals.ConfirmTimeout` is all that is needed to arm a window, and every page
+// reads the config anyway — so api.getConfig() feeds it here rather than each
+// caller threading it through. 0 (or never seen) means commit-confirm is off, and
+// arming then does nothing: an apply on such a router really is immediate.
+let timeout = 0
+
+export function noteConfirmTimeout(seconds: number | undefined) {
+  if (typeof seconds !== 'number' || !Number.isFinite(seconds) || seconds < 0) return
+  timeout = Math.floor(seconds)
+  // A window armed before commit-confirm was switched off is no longer real —
+  // drop it rather than count down to an event that will not happen.
+  if (timeout === 0 && armed) write(null)
+}
+
+export function confirmTimeout(): number {
+  return timeout
+}
+
+/** Record the window an apply just opened. Call only when the apply CHANGED
+ *  something: an unchanged apply reconciles nothing and arms nothing. */
+export function armPendingConfirm() {
+  if (timeout <= 0) return
+  write({ until: Date.now() + timeout * 1000, total: timeout })
+}
+
+/** Confirm and rollback both end the window. */
+export function clearPendingConfirm() {
+  if (armed) write(null)
+}
+
+/** Fires when a window ran out on its own — i.e. the daemon has reverted — and
+ *  NOT when it was confirmed or rolled back. Returns an unsubscribe. */
+export function onPendingConfirmExpire(fn: Listener): () => void {
+  expiryListeners.add(fn)
+  return () => {
+    expiryListeners.delete(fn)
+  }
+}
+
+/** Idempotent: several mounted countdowns race to notice the same deadline, and
+ *  only the first one gets to announce it. */
+function expire() {
+  if (!armed) return
+  write(null)
+  for (const l of [...expiryListeners]) l()
+}
+
+// Another tab confirming, rolling back or applying is the same event as this one
+// doing it.
+if (typeof window !== 'undefined') {
+  window.addEventListener('storage', (e) => {
+    if (e.key !== KEY && e.key !== null) return
+    armed = load()
+    emit()
+  })
+}
+
+/**
+ * The armed window and its remaining seconds, ticking once a second.
+ *
+ * Returns null when nothing is armed. While non-null `remaining` is at least 1:
+ * reaching zero clears the record and notifies {@link onPendingConfirmExpire}, so
+ * no component ever renders "0 s left" for a window that is already over.
+ */
+export function usePendingConfirm(): { pending: PendingConfirm; remaining: number } | null {
+  const [, tick] = useState(0)
+
+  useEffect(() => {
+    const sync = () => tick((n) => n + 1)
+    listeners.add(sync)
+    sync()
+    return () => {
+      listeners.delete(sync)
+    }
+  }, [])
+
+  useEffect(() => {
+    const id = window.setInterval(() => {
+      if (armed && armed.until <= Date.now()) expire()
+      else if (armed) tick((n) => n + 1)
+    }, 1000)
+    return () => window.clearInterval(id)
+  }, [])
+
+  const pending = readPendingConfirm()
+  if (!pending) return null
+  return { pending, remaining: Math.max(1, Math.ceil((pending.until - Date.now()) / 1000)) }
+}